Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,746 results · page 61 of 95
Nov 22, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.CVE-2023-47668 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 22, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce plugin <= 7.1.1 versions.CVE-2023-40002 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce plugin <= 7.1.1 versions.
- Affected
- up to 7.1.1
- What to do
- Affects up to 7.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 22, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SwitchWP WP Client Reports plugin <= 1.0.16 versions.CVE-2023-23978 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SwitchWP WP Client Reports plugin <= 1.0.16 versions.
- Fixed in
- 1.0.17
- What to do
- Update the plugin to 1.0.17 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 22, 2023WP Customer Reviews: Sensitive Information ExposureCVE-2023-4686 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the ajax_enabled_posts function. This can allow authenticated attackers to extract sensitive data such as post titles and slugs, including those of protected and trashed posts and pages in addition to other post types such as galleries.
- Product
- WP Customer Reviews
- Affected
- up to 3.6.6
- What to do
- Affects up to 3.6.6. Update WP Customer Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 22, 2023Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Botanik Software Pharmacy Automation allows Retrieve Embedded Sensitive Data.CVE-2023-5983 · Other software · Botanik Software · reported by iletisim@usom.gov.trHigh 7.5
Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Botanik Software Pharmacy Automation allows Retrieve Embedded Sensitive Data. This issue affects Pharmacy Automation: before 2.1.133.0.
- Product
- Pharmacy Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Nov 22, 2023Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API methCVE-2023-6189 · Other software · M-Files · reported by security@m-files.comMedium 4.3
Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API methods.
- Product
- M-Files Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordempower.m-files.comproduct.m-files.com
Nov 16, 2023In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5.0.0 from MyPrestaModules for PrestaShop, a guest can perform SCVE-2023-45387 · Other software · Myprestamodules · reported by MITRECritical 9.8
In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5.0.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection via `exportProduct::_addDataToDb().`
- Product
- Exportproducts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurity.friendsofpresta.org
Nov 16, 2023nagayama_copabowl Line 13.6.1 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor.CVE-2023-48134 · Other software · linecorp · reported by MITREHigh 7.5
nagayama_copabowl Line 13.6.1 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor.
- Product
- line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2023Elementor Addon Elements: Sensitive Information ExposureCVE-2023-4723 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.12.7 via the ajax_eae_post_data function. This can allow unauthenticated attackers to extract sensitive data including post/page ids and titles including those of with pending/draft/future/private status.
- Product
- Elementor Addon Elements
- Affected
- up to 1.12.7
- What to do
- Affects up to 1.12.7. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 15, 2023An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed.CVE-2023-6105 · Other software · ManageEngine · reported by vulnreport@tenable.comMedium 5.5
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.
- Product
- Service Desk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.comtenable.com
Nov 15, 2023MyPrestaModules ordersexport before v5.0 was discovered to contain multiple SQL injection vulnerabilities at send.php via the key and save_setting parameters.CVE-2023-40923 · Other software · Myprestamodules · reported by MITREHigh 8.8
MyPrestaModules ordersexport before v5.0 was discovered to contain multiple SQL injection vulnerabilities at send.php via the key and save_setting parameters.
- Product
- Orders (csv, Excel) Export Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Nov 14, 2023Exposure of sensitive information to an unauthorized actor in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to potentialCVE-2023-28723 · Other software · Intel · reported by secure@intel.comLow 3.3
Exposure of sensitive information to an unauthorized actor in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Aptio V Uefi Firmware Integrator Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Exposure of sensitive information to an unauthorized actor in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentiallCVE-2023-24588 · Other software · Intel · reported by secure@intel.comMedium 5.9
Exposure of sensitive information to an unauthorized actor in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentially enable information disclosure via physical access.
- Product
- Optane Memory H20 With Solid State Storage Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access to expose the contents of ASP memory potentially leadiCVE-2023-20526 · Other software · AMD · reported by psirt@amd.comLow 1.9
Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access to expose the contents of ASP memory potentially leading to a loss of confidentiality.
- Product
- AMD Ryzen™ Threadripper™ 2000 Series Processors “Colfax”
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Exposure of sensitive information to an unauthorized actor for some Intel Unison software may allow an authenticated user to potentially enable information discCVE-2022-46646 · Other software · Intel · reported by secure@intel.comLow 2.2
Exposure of sensitive information to an unauthorized actor for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Unison Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Exposure of sensitive system information due to uncleared debug information for some Intel Unison software may allow an authenticated user to potentially enableCVE-2022-43666 · Other software · Intel · reported by secure@intel.comLow 3.3
Exposure of sensitive system information due to uncleared debug information for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Unison Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially leading to a loss of cCVE-2021-46766 · Other software · AMD · reported by psirt@amd.comLow 2.5
Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially leading to a loss of confidentiality.
- Product
- Ryzen™ Threadripper™ PRO 3000WX Series Processors “Chagall” WS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023An exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version 7.0.0 and before 6.7.5 may allow an attacker with access to windowCVE-2023-41676 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 4.3
An exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version 7.0.0 and before 6.7.5 may allow an attacker with access to windows agent logs to obtain the windows agent password via searching through the logs.
- Product
- FortiSIEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Nov 14, 2023Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device.CVE-2023-44318 · Other software · Siemens · reported by productcert@siemens.comMedium 6.9
Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could allow an authenticated attacker with administrative privileges or an attacker that obtains a configuration backup to extract configuration information from the exported file.
- Product
- RUGGEDCOM RM1224 LTE(4G) EU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Nov 10, 2023An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed.CVE-2023-4804 · Other software · Johnson Controls · reported by productsecurity@jci.comCritical 10
An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed.
- Product
- Quantum HD Unity Compressor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Nov 10, 2023A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDCVE-2023-47614 · Other software · Telit Cinterion · reported by vulnerability@kaspersky.comLow 3.3
A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to disclose hidden virtual paths and file names on the targeted system.
- Product
- BGS5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comics-cert.kaspersky.com
Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in ReCorp Export WP Page to Static HTML/CSS plugin <= 2.1.9 versions.CVE-2023-31077 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ReCorp Export WP Page to Static HTML/CSS plugin <= 2.1.9 versions.
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 9, 2023A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDCVE-2023-47616 · Other software · Telit Cinterion · reported by vulnerability@kaspersky.comLow 2.4
A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow an attacker with physical access to the target system to get access to a sensitive data on the targeted system.
- Product
- BGS5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comics-cert.kaspersky.com
Nov 9, 2023A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit CinteCVE-2023-47615 · Other software · Telit Cinterion · reported by vulnerability@kaspersky.comLow 3.3
A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to get access to a sensitive data on the targeted system.
- Product
- BGS5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comics-cert.kaspersky.com
Nov 9, 2023CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a crafted script to the export-v2.php and aCVE-2023-47489 · Other software · Combodo · reported by MITREHigh 7.8
CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a crafted script to the export-v2.php and ajax.render.php components.
- Product
- Itop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugplorer.github.ionitipoom-jar.github.io
Nov 7, 2023Insecure permissions in Smart Soft advancedexport before v4.4.7 allow unauthenticated attackers to arbitrarily download user information from the ps_customer taCVE-2023-43984 · Other software · Advanced Export Products Orders Cron CSV Excel Project · reported by MITREHigh 7.5
Insecure permissions in Smart Soft advancedexport before v4.4.7 allow unauthenticated attackers to arbitrarily download user information from the ps_customer table.
- Product
- Advanced Export Products Orders Cron CSV Excel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Nov 7, 2023Local File Inclusion vulnerability in Midori-global Better PDF Exporter for Jira Server and Jira Data Center v.10.3.0 and before allows an attacker to view arbiCVE-2023-42361 · Other software · midori-global · reported by MITREHigh 7.8
Local File Inclusion vulnerability in Midori-global Better PDF Exporter for Jira Server and Jira Data Center v.10.3.0 and before allows an attacker to view arbitrary files and cause other impacts via use of crafted image during PDF export.
- Product
- better_pdf_exporter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgccybermonks.commarketplace.atlassian.com
Nov 7, 2023A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only DomCVE-2023-4154 · Other software · Red Hat · reported by Red HatHigh 7.5
A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.
- Product
- Red Hat Enterprise Linux 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 7, 2023Simple CSV/XLS Exporter: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-42882 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Shambix Simple CSV/XLS Exporter.This issue affects Simple CSV/XLS Exporter: from n/a through 1.5.8.
- Product
- Simple CSV/XLS Exporter
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Simple CSV/XLS Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023Export Users Data CSV: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-41616 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Formula Elements in a CSV File vulnerability in Kaushik Kalathiya Export Users Data CSV.This issue affects Export Users Data CSV: from n/a through 2.1.
- Product
- Export Users Data CSV
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Export Users Data CSV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023WP CSV Exporter: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-38702 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Nakashima Masahiro WP CSV Exporter.This issue affects WP CSV Exporter: from n/a through 2.0.
- Product
- WP CSV Exporter
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update WP CSV Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023Export Users Data Distinct: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46804 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Narola Infotech Solutions LLP Export Users Data Distinct.This issue affects Export Users Data Distinct: from n/a through 1.3.
- Product
- Export Users Data Distinct
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Export Users Data Distinct to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023WordPress Comments Import & Export: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45370 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1.
- Product
- WordPress Comments Import & Export
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update WordPress Comments Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023A local non-privileged user can make GPU processing operations that expose sensitive data from previously freed memory.CVE-2023-4272 · Computers, phones & browsers · Arm Ltd · reported by arm-security@arm.comMedium 5.5
A local non-privileged user can make GPU processing operations that expose sensitive data from previously freed memory.
- Product
- Midgard GPU Kernel Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.arm.comdeveloper.arm.com
Nov 7, 2023Product Reviews Import Export for WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46802 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8.
- Product
- Product Reviews Import Export for WooCommerce
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Product Reviews Import Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023Improper input validation vulnerability in ProcessWriteFile of libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to expose sensitive informationCVE-2023-42527 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.6
Improper input validation vulnerability in ProcessWriteFile of libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to expose sensitive information.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Nov 6, 2023Pressference Exporter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-45046 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pressference Pressference Exporter allows SQL Injection.This issue affects Pressference Exporter: from n/a through 1.0.3.
- Product
- Pressference Exporter
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Pressference Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 3, 2023Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls.CVE-2023-41260 · Other software · best_practical_solutions · reported by MITREHigh 7.5
Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls.
- Product
- request_tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Nov 1, 2023The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability.CVE-2023-33228 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 4.5
The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to obtain sensitive information.
- Product
- Network Configuration Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Oct 29, 2023 When the isula export command is used to export a container to an image and the container is controlled by an attacker, the attacker can escape the container.CVE-2021-33637 · Other software · openEuler · reported by securities@openeuler.orgHigh 8.4
When the isula export command is used to export a container to an image and the container is controlled by an attacker, the attacker can escape the container.
- Product
- iSulad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2023IBM QRadar SIEM 7.5 is vulnerable to information exposure allowing a delegated Admin tenant user with a specific domain security profile assigned to see data frCVE-2023-43041 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM QRadar SIEM 7.5 is vulnerable to information exposure allowing a delegated Admin tenant user with a specific domain security profile assigned to see data from other domains. This vulnerability is due to an incomplete fix for CVE-2022-34352. IBM X-Force ID: 266808.
- Product
- QRadar SIEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 25, 2023Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting in its exposure.CVE-2023-46653 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting in its exposure.
- Product
- Jenkins lambdatest-automation Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 25, 2023In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 4.1.1 from MyPrestaModules for PrestaShop, a guest can download CVE-2023-46346 · Other software · myprestamodules · reported by MITREHigh 7.5
In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 4.1.1 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system.
- Product
- exportproducts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Oct 25, 2023 EisBaer Scada - CWE-749: Exposed Dangerous Method or FunctionCVE-2023-42494 · Other software · EisBaer Scada · reported by cna@cyber.gov.ilHigh 7.5
EisBaer Scada - CWE-749: Exposed Dangerous Method or Function
- Product
- v3.0.6433.1964
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023 EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2023-42490 · Other software · EisBaer Scada · reported by cna@cyber.gov.ilHigh 7.5
EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- Product
- v3.0.6433.1964
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely exposed by the Android Agent applicatioCVE-2023-41960 · Other software · Rexroth · reported by psirt@bosch.comHigh 7.1
The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely exposed by the Android Agent application, potentially modifying sensitive settings of the Android Client application itself.
- Product
- ctrlX HMI Web Panel - WR21 (WR2107)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Oct 23, 2023The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled wheCVE-2023-5633 · Other software · Red Hat · reported by Red HatHigh 7.8
The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.
- Product
- Red Hat Enterprise Linux 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 23, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0.CVE-2023-46288 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for configuration even when the expose_config option is set to non-sensitive-only. The expose_config option is False by default. It is recommended to upgrade to a version that is not affected if you set expose_config to non-sensitive-only configuration. This is a different error than CVE-2023-45348 which allows authenticated user to retrieve individual configuration values in 2.7.* by specially crafting their request (solved in 2.7.2). Users are recommended to upgrade to version 2.7.2, which fixes the issue and additionally fixes CVE-2023-45348.
- Product
- Apache Airflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 21, 2023IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in environment variables which could aid in further attacks against the system.CVE-2023-38276 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in environment variables which could aid in further attacks against the system. IBM X-Force ID: 260736.
- Product
- Cognos Dashboards on Cloud Pak for Data
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 21, 2023IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in container images which could lead to further attacks against the system.CVE-2023-38275 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in container images which could lead to further attacks against the system. IBM X-Force ID: 260730.
- Product
- Cognos Dashboards on Cloud Pak for Data
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.