Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,937 results · page 62 of 99
Sep 13, 2022The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens.CVE-2022-40622 · Other software · WAVLINK · reported by cve@rapid7.comHigh 8.8
The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator, session takeover is possible.
- Product
- WN531G3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022IBM Control Desk 7.6.1 does not set the secure attribute on authorization tokens or session cookies.CVE-2022-22329 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Control Desk 7.6.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 219124.
- Product
- Control Desk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 13, 2022Unisys Data Exchange Management Studio before 6.0.IC2 and 7.x before 7.0.IC1 doesn't have an Anti-CSRF token to authenticate the POST request.CVE-2022-32555 · Other software · Unisys · reported by MITREHigh 8.8
Unisys Data Exchange Management Studio before 6.0.IC2 and 7.x before 7.0.IC1 doesn't have an Anti-CSRF token to authenticate the POST request. Thus, a cross-site request forgery attack could occur.
- Product
- Data Exchange Management Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublic.support.unisys.comunisys.com
Sep 12, 2022Dean Oakley's Photospace Gallery plugin <= 2.3.5 at: Broken Access ControlCVE-2022-38135 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings.
- Product
- Dean Oakley's Photospace Gallery plugin <= 2.3.5 at
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update Dean Oakley's Photospace Gallery plugin <= 2.3.5 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 7, 2022Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.CVE-2022-36079 · Other software · parse-community · reported by GitHubHigh 8.6
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields (keys used internally by Parse Server, prefixed by `_`) and protected fields (user defined) can be used as query constraints. Internal and protected fields are removed by Parse Server and are only returned to the client using a valid master key. However, using query constraints, these fields can be guessed by enumerating until Parse Server, prior to versions 4.10.14 or 5.2.5, returns a response object. The patch available in versions 4.10.14 and 5.2.5 requires the maser key to use internal and protected fields as query constraints. As a workaround, implement a Parse Cloud Trigger `beforeFind` and manually remove the query constraints.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress.CVE-2022-36387 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress.
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 6, 2022Broken Access Control vulnerability in Beaver Builder plugin <= 2.5.4.3 at WordPress.CVE-2022-36425 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Broken Access Control vulnerability in Beaver Builder plugin <= 2.5.4.3 at WordPress.
- Affected
- up to 2.5.4.3
- What to do
- Affects up to 2.5.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 6, 2022Broken Link Checker: Deserialization of untrusted inputCVE-2022-2438 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.11.16. This makes it possible for authenticated attackers with administrative privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- Broken Link Checker
- Affected
- up to 1.11.16
- What to do
- Affects up to 1.11.16. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 2, 2022Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome).CVE-2022-31176 · Other software · grafana · reported by GitHubHigh 8.3
Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to [disable HTTP remote rendering](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#plugingrafana-image-renderer).
- Product
- grafana-image-renderer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2022Improper validation of backend id in PCM routing process can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapdragCVE-2022-22080 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Improper validation of backend id in PCM routing process can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Sep 2, 2022In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.CVE-2022-38054 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.
- Product
- Apache Airflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Sep 1, 2022A flaw was found in vDPA with VDUSE backend.CVE-2022-2308 · Computers, phones & browsers · Linux · reported by Red HatMedium 6.5
A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could cause undefined behavior or data leaks in Virtio drivers.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Aug 29, 2022HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm.CVE-2022-37177 · Other software · Hirevue · reported by MITREHigh 7.5
HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. NOTE: this is disputed by the vendor for multiple reasons, e.g., it is inconsistent with CVE ID assignment rules for cloud services, and no product with version V1.0 exists. Furthermore, the rail-fence cipher has been removed, and TLS 1.2 is now used for encryption.
- Product
- Hiring Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and token request is checked CVE-2020-26938 · Other software · Oauth2-server Project · reported by MITREHigh 7.2
In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and token request is checked against an incorrect URI pattern ("[a-zA-Z][a-zA-Z0-9+.-]+:") before making a redirection. This allows a malicious client to pass an XSS payload through the redirect_uri parameter while making an authorization request. NOTE: this vulnerability is similar to CVE-2020-7741.
- Product
- Oauth2-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022WP Hide & Security Enhancer: Does not escape a parameter before outputting it back in an attribute of a backend pageCVE-2022-2538 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Hide & Security Enhancer WordPress plugin before 1.8 does not escape a parameter before outputting it back in an attribute of a backend page, leading to a Reflected Cross-Site Scripting
- Product
- WP Hide & Security Enhancer
- Fixed in
- 1.8
- What to do
- Update WP Hide & Security Enhancer to 1.8 or newer.
Aug 29, 2022Stop Spam Comments: Does not properly generate the Javascript access token for preventing abuse of comment sectionCVE-2022-1663 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request.
- Product
- Stop Spam Comments
- Affected
- up to 0.2.1.2
- What to do
- Affects up to 0.2.1.2. Update Stop Spam Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2022HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability.CVE-2022-27558 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.9
HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking.
- Product
- HCL iNotes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 29, 2022The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's migCVE-2022-3019 · Other software · tooljet · reported by security@huntr.devHigh 8.8
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one).
- Product
- tooljet/tooljet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2022Kensite CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities via the name and oldname parameters at /framework/mod/db/DBMapper.xml.CVE-2022-36529 · Other software · Kensite CMS Project · reported by MITREHigh 8.8
Kensite CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities via the name and oldname parameters at /framework/mod/db/DBMapper.xml.
- Product
- Kensite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress.CVE-2022-35726 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress.
- Affected
- up to 1.3.4.5
- What to do
- Affects up to 1.3.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 19, 2022Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request.CVE-2022-34624 · Other software · Mealie · reported by MITREMedium 5.9
Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request.
- Product
- Mealie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgainsec.comgainsec.com
Aug 19, 2022In Jellyfin before 10.8, stored XSS allows theft of an admin access token.CVE-2022-35910 · Other software · Jellyfin · reported by MITREMedium 5.4
In Jellyfin before 10.8, stored XSS allows theft of an admin access token.
- Product
- Jellyfin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comgithub.com
Aug 18, 2022Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.CVE-2022-35540 · Other software · Dotnetcore · reported by MITRECritical 9.8
Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.
- Product
- Agileconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend reCVE-2022-38150 · Other software · Varnish Cache Project · reported by MITREHigh 7.5
In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend responses. An attack uses a crafted reason phrase of the backend response status line. This is fixed in 7.0.3 and 7.1.1.
- Product
- Varnish Cache
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Aug 5, 2022JumpDEMAND Inc: Broken AuthenticationCVE-2022-36296 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Broken Authentication vulnerability in JumpDEMAND Inc. ActiveDEMAND plugin <= 0.2.27 at WordPress allows unauthenticated post update/create/delete.
- Product
- JumpDEMAND Inc
- Affected
- up to 0.2.27
- What to do
- Affects up to 0.2.27. Update JumpDEMAND Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 2, 2022In Quest KACE Systems Management Appliance (SMA) through 12.0, predictable token generation occurs when appliance linking is enabled.CVE-2022-29808 · Other software · Quest · reported by MITREHigh 7.5
In Quest KACE Systems Management Appliance (SMA) through 12.0, predictable token generation occurs when appliance linking is enabled.
- Product
- Kace Systems Management Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.quest.comsupport.quest.com
Aug 1, 2022IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies.CVE-2022-34307 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 229436.
- Product
- CICS TX Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 1, 2022Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to CVE-2022-1561 · Other software · KrakenD · reported by cve-coordination@incibe.esMedium 4
Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend might be vulnerable.
- Product
- Lura Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordincibe-cert.eskrakend.io
Jul 28, 2022Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a Broken or Risky Cryptographic Algorithm.CVE-2022-30320 · Other software · Honeywell · reported by MITREMedium 4.3
Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a Broken or Risky Cryptographic Algorithm. According to FSCT-2022-0063, there is a Saia Burgess Controls (SBC) PCD S-Bus weak credential hashing scheme issue. The affected components are characterized as: S-Bus (5050/UDP) authentication. The potential impact is: Authentication bypass. The Saia Burgess Controls (SBC) PCD controllers utilize the S-Bus protocol (5050/UDP) for a variety of engineering purposes. It is possible to configure a password in order to restrict access to sensitive engineering functionality. Authentication is done by using the S-Bus 'write byte' message to a specific address and supplying a hashed version of the password. The hashing algorithm used is based on CRC-16 and as such not cryptographically secure. An insecure hashing algorithm is used. An attacker capable of passively observing traffic can intercept the hashed credentials and trivially find collisions allowing for authentication without having to bruteforce a keyspace defined by the actual strength of the password. This allows the attacker access to sensitive engineering functionality such as uploading/downloading control logic and manipulating
- Product
- Saia Pg5 Controls Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with access to the local host (client machine) to obtain a login access token.CVE-2022-22412 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.6
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with access to the local host (client machine) to obtain a login access token. IBM X-Force ID: 223019.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 22, 2022Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.CVE-2022-27235 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 21, 2022YIKES Inc: Broken Access ControlCVE-2022-28666 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin <= 1.7.7 at WordPress leading to &yikes-the-content-toggle option update.
- Product
- YIKES Inc
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update YIKES Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 21, 2022An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application.CVE-2022-32430 · Other software · Talelin · reported by MITREHigh 7.5
An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application.
- Product
- Lin-cms-spring-boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows attackers to access the core log file and perform session hijacking via a crafted session token.CVE-2022-34536 · Other software · DW · reported by MITREHigh 7.5
Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows attackers to access the core log file and perform session hijacking via a crafted session token.
- Product
- Megapix Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 19, 2022Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recovery token to elevate privileges via path CVE-2022-2192 · Other software · HYPR · reported by security@hypr.comHigh 7.5
Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recovery token to elevate privileges via path tampering in the Magic Link page. This issue affects: HYPR Server versions later than 6.10; version 6.15.1 and prior versions.
- Product
- HYPR Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2022A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below, Fortinet FortiTokeniOS version 5.2.0 and below, FCVE-2021-22131 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 6.4
A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below, Fortinet FortiTokeniOS version 5.2.0 and below, Fortinet FortiTokenWinApp version 4.0.3 and below allows attacker to retrieve information disclosed via man-in-the-middle attacks.
- Product
- Fortinet FortiTokenAndroid, Fortinet FortiTokeniOS, Fortinet FortiTokenWinApp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Jul 18, 2022In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler.CVE-2022-32387 · Other software · Kentico · reported by MITREHigh 7.5
In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler.
- Product
- Xperience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevnet.kentico.comdevnet.kentico.com
Jul 17, 2022In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because CVE-2020-16093 · Other software · Lemonldap-ng · reported by MITREHigh 7.5
In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used.
- Product
- Lemonldap\
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.ow2.orglemonldap-ng.org
Jul 17, 2022OAuth Single Sign On: Doesn't validate that OAuth access token requests are legitimateCVE-2022-2133 · WordPress plugins & themes · reported by WPScanMedium 5.3
The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.
- Product
- OAuth Single Sign On
- Fixed in
- 6.22.6
- What to do
- Update OAuth Single Sign On to 6.22.6 or newer.
Jul 14, 2022Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via request_token.php.CVE-2022-34094 · Other software · Softwarepublico · reported by MITREMedium 6.1
Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via request_token.php.
- Product
- I3geo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2022Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via access_token.php.CVE-2022-34093 · Other software · Softwarepublico · reported by MITREMedium 6.1
Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via access_token.php.
- Product
- I3geo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2022A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used for the SSH connection between Easergy ProCVE-2022-34757 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 6.7
A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used for the SSH connection between Easergy Pro software and the device, which may allow an attacker to observe protected communication details. Affected Products: Easergy P5 (V01.401.102 and prior)
- Product
- Easergy P5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jul 12, 2022SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would otherwise be restricted.CVE-2022-35228 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would otherwise be restricted. This can be achieved only when a legitimate user accesses the application and a local compromise occurs, like sniffing or social engineering. On successful exploitation, the attacker can completely compromise the application.
- Product
- SAP BusinessObjects Business Intelligence Platform (Central management Console)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jul 10, 2022The varijkapil13/Sphere_ImageBackend repository through 2019-10-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafelCVE-2022-31561 · Other software · Sphere Imagebackend Project · reported by MITRECritical 9.3
The varijkapil13/Sphere_ImageBackend repository through 2019-10-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Sphere Imagebackend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2022Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch conteCVE-2022-2353 · Other software · microweber · reported by security@huntr.devMedium 6.1
Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2022A privilege escalation flaw was found in the token exchange feature of keycloak.CVE-2022-1245 · Other software · Redhat · reported by Red HatCritical 9.8
A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.
- Product
- Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2022The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.CVE-2022-25047 · Other software · Control-webpanel · reported by MITREMedium 5.9
The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.
- Product
- Webpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portalCVE-2022-33738 · Other software · Openvpn · reported by security@openvpn.netHigh 7.5
OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal
- Product
- Openvpn Access Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenvpn.netopenvpn.net
Jul 5, 2022network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code label was moved in a way allowing for SCVE-2022-33743 · Computers, phones & browsers · Linux · reported by security@xen.orgHigh 7.8
network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further processing to nevertheless be freed.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comxenbits.xen.org
Jul 5, 2022In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint.CVE-2022-30290 · Other software · Citeum · reported by MITREHigh 7.5
In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker can abuse the identified vulnerability in order to arbitrarily change their registered e-mail address as well as their API key, even though such action is not possible through the interface, legitimately.
- Product
- Opencti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comenisa.europa.eu
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.