Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

546new WordPress flaws this week

391,964entries in the database

4,746 results · page 63 of 95

Aug 30, 2023Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav bCVE-2023-31423 · Other software · Brocade · reported by sirt@brocade.comMedium 5.7
Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav before v2.3.0 and 2.2.2a. Notes: To access the logs, the local attacker must have access to an already collected Brocade SANnav "supportsave" outputs.
Product
SANnav
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 27, 2023IBM InfoSphere Information Systems 11.7 could expose information about the host system and environment configuration.CVE-2023-24959 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM InfoSphere Information Systems 11.7 could expose information about the host system and environment configuration. IBM X-Force ID: 246332.
Product
InfoSphere Information Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 24, 2023A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, potentially exposing users to security risks.CVE-2023-4229 · Other software · Moxa · reported by psirt@moxa.comMedium 4.3
A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, potentially exposing users to security risks. This vulnerability may allow attackers to trick users into interacting with malicious content, leading to unintended actions or unauthorized data disclosures.
Product
ioLogik 4000 Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record moxa.com moxa.com
Aug 21, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cavo – Connecting for a Safer World BUTTERFLY BUTTON (Architecture flaw) allows lossCVE-2023-40735 · Other software · Cavo – Connecting for a Safer World · reported by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfeHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cavo – Connecting for a Safer World BUTTERFLY BUTTON (Architecture flaw) allows loss of plausible deniability and confidentiality.This issue affects BUTTERFLY BUTTON: As of 2023-08-21.
Product
BUTTERFLY BUTTON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record butterfly-button.web.app github.com
Aug 17, 2023Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla.CVE-2023-39974 · Other software · acymailing.com · reported by security@joomla.orgMedium 5.3
Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers in a specific list.
Product
AcyMailing Enterprise component for Joomla
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record extensions.joomla.org acymailing.com
Aug 16, 2023 Dell PowerScale OneFS, 8.2.x-9.5.x, contains a exposure of sensitive information to an unauthorized Actor vulnerability.CVE-2023-32495 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell PowerScale OneFS, 8.2.x-9.5.x, contains a exposure of sensitive information to an unauthorized Actor vulnerability. An authorized local attacker could potentially exploit this vulnerability, leading to escalation of privileges.
Product
PowerScale OneFS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameterCVE-2023-4343 · Other software · Broadcom · reported by cret@cert.orgHigh 7.5
Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameter
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissionsCVE-2023-4339 · Other software · Broadcom · reported by cret@cert.orgHigh 7.5
Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissions
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on WindowsCVE-2023-4328 · Other software · Broadcom · reported by cret@cert.orgMedium 5.5
Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Windows
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on LinuxCVE-2023-4327 · Other software · Broadcom · reported by cret@cert.orgMedium 5.5
Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023InfiniteWP Client: Sensitive Information ExposureCVE-2023-2916 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.
Product
InfiniteWP Client
Affected
up to 1.11.1
What to do
Affects up to 1.11.1. Update InfiniteWP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2023In getIntentForButton of ButtonManager.java, there is a possible way for an unprivileged application to start a non-exported or permission-protected activity duCVE-2023-21231 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In getIntentForButton of ButtonManager.java, there is a possible way for an unprivileged application to start a non-exported or permission-protected activity due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Aug 10, 2023Exposure of sensitive information to an unauthorized actor in BIOS firmware for some Intel(R) NUCs may allow a privilege user to potentially enable information CVE-2023-29500 · Other software · Intel · reported by secure@intel.comMedium 5.3
Exposure of sensitive information to an unauthorized actor in BIOS firmware for some Intel(R) NUCs may allow a privilege user to potentially enable information disclosure via local access.
Product
NUC 11 Performance KIT Nuc11pahi70z Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Aug 10, 2023Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authCVE-2022-40982 · Other software · Redhat · reported by secure@intel.comMedium 6.5
Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Product
Enterprise Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com access.redhat.com
Aug 10, 2023PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting (XSS) via all post parameters of "Export Requests" aside from "request_feed".CVE-2023-36313 · Websites & servers · Phpjabbers · reported by MITREMedium 6.1
PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting (XSS) via all post parameters of "Export Requests" aside from "request_feed".
Product
Document Creator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com phpjabbers.com
Aug 10, 2023An information leak in PHPJabbers Yacht Listing Script v1.0 allows attackers to export clients' credit card numbers from the Reservations module.CVE-2023-38830 · Websites & servers · Phpjabbers · reported by MITREHigh 7.5
An information leak in PHPJabbers Yacht Listing Script v1.0 allows attackers to export clients' credit card numbers from the Reservations module.
Product
Yacht Listing Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com phpjabbers.com
Aug 9, 2023A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directlyCVE-2022-48604 · Other software · ScienceLogic · reported by contact@securifera.comHigh 8.8
A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
Product
SL 1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securifera.com securifera.com
Aug 9, 2023A command injection vulnerability exists in the “dash export” feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directlCVE-2022-48581 · Other software · ScienceLogic · reported by contact@securifera.comHigh 8.8
A command injection vulnerability exists in the “dash export” feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.
Product
SL 1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securifera.com securifera.com
Aug 8, 2023Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access.CVE-2023-39214 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.6
Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access.
Product
Zoom SDK's
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 5, 2023Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.TCVE-2023-39508 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The "Run Task" feature is considered dangerous and it has been removed entirely in Airflow 2.6.0 This issue affects Apache Airflow: before 2.6.0.
Product
Apache Airflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org github.com
Aug 3, 2023WP Ultimate CSV Importer: Sensitive Information ExposureCVE-2023-4139 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and including, 7.9.8. This makes it possible for unauthenticated attackers to list and view exported files.
Product
WP Ultimate CSV Importer
Affected
up to 7.9.8
What to do
Affects up to 7.9.8. Update WP Ultimate CSV Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 3, 2023The Unica application exposes an API which accepts arbitrary XML input.CVE-2023-37497 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.
Product
HCL Unica Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jul 31, 2023LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.CVE-2023-36984 · Other software · Lavalite · reported by MITREHigh 7.5
LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.
Product
Lavalite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 31, 2023LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.CVE-2023-36983 · Other software · Lavalite · reported by MITREHigh 7.5
LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.
Product
Lavalite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 31, 2023In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed.CVE-2023-38750 · Email & office · Zimbra · reported by MITREHigh 7.5
In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed.
Product
Zimbra
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wiki.zimbra.com wiki.zimbra.com
Jul 26, 2023Video Conferencing with Zoom: Sensitive Information ExposureCVE-2023-3947 · WordPress plugins & themes · reported by WordfenceLow 3.7
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This makes it possible for unauthenticated attackers to decrypt and view the meeting id and password.
Product
Video Conferencing with Zoom
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Video Conferencing with Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 25, 2023GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap use after free via the function add_pe_exported_sym() at /gdb/coff-pe-read.c.CVE-2023-39129 · Other software · gnu · reported by MITREMedium 5.5
GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap use after free via the function add_pe_exported_sym() at /gdb/coff-pe-read.c.
Product
gdb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sourceware.org sourceware.org
Jul 25, 2023Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.CVE-2023-34189 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could use general users to delete and update the process, which only the admin can operate occurrences. Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8109 to solve it.
Product
Apache InLong
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Jul 21, 2023Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4.CVE-2023-3819 · Other software · pimcore · reported by security@huntr.devMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4.
Product
pimcore/pimcore
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Jul 20, 2023The web interface on multiple Samsung Harman AMX N-Series devices allows directory listing for the /tmp/ directory, without authentication, exposing sensitive iCVE-2023-38523 · Computers, phones & browsers · samsung · reported by MITREMedium 5.3
The web interface on multiple Samsung Harman AMX N-Series devices allows directory listing for the /tmp/ directory, without authentication, exposing sensitive information such as the command history and screenshot of the file being processed. This affects N-Series N1115 Wallplate Video Encoder before 1.15.61, N-Series N1x22A Video Encoder/Decoder before 1.15.61, N-Series N1x33A Video Encoder/Decoder before 1.15.61, N-Series N1x33 Video Encoder/Decoder before 1.15.61, N-Series N2x35 Video Encoder/Decoder before 1.15.61, N-Series N2x35A Video Encoder/Decoder before 1.15.61, N-Series N2xx2 Video Encoder/Decoder before 1.15.61, N-Series N2xx2A Video Encoder/Decoder before 1.15.61, N-Series N3000 Video Encoder/Decoder before 2.12.105, and N-Series N4321 Audio Transceiver before 1.00.06.
Product
harman_amx_n_series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.harmanpro.com help.harmanpro.com
Jul 20, 2023 Dell Hybrid Client version 2.0 contains a Sensitive Data Exposure vulnerability.CVE-2023-32476 · Other software · Dell · reported by security_alert@emc.comMedium 6.4
Dell Hybrid Client version 2.0 contains a Sensitive Data Exposure vulnerability. An unauthenticated malicious user on the device can access hard coded secrets in javascript files.
Product
Dell Hybrid Client (DHC)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jul 18, 2023Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to condCVE-2023-26026 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks. IBM X-Force ID: 247896.
Product
Planning Analytics Cartridge for Cloud Pak for Data
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Jul 18, 2023Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to condCVE-2023-26023 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks. IBM X-Force ID: 247896.
Product
Sterling Connect:Express for UNIX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Jul 17, 2023Export and Import Users and Customers: Unauthorized modification of dataCVE-2023-3459 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with shop manager-level permissions to change user passwords and potentially take over administrator accounts.
Product
Export and Import Users and Customers
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2023 Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind CVE-2023-34036 · Other software · Spring · reported by security@vmware.comMedium 5.3
Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server. For the application to be affected, it needs to satisfy the following requirements: * It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses. * The application infrastructure does not guard against clients submitting (X-)Forwarded… headers.
Product
Spring HATEOAS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record spring.io spring.io
Jul 14, 2023rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OCVE-2023-38337 · Other software · Rswag Project · reported by MITREHigh 7.5
rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OpenAPI (or Swagger) specification file of a project.
Product
Rswag
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 13, 2023An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker.CVE-2023-30565 · Other software · Becton Dickinson & Co · reported by cybersecurity@bd.comLow 3.5
An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker.
Product
CQI Reporter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bd.com bd.com
Jul 12, 2023ELECOM wireless LAN routers are vulnerable to sensitive information exposure, which allows a network-adjacent unauthorized attacker to obtain sensitive informatCVE-2023-37563 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.5
ELECOM wireless LAN routers are vulnerable to sensitive information exposure, which allows a network-adjacent unauthorized attacker to obtain sensitive information. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier, WRC-1167GEBK-S v1.03 and earlier, WRC-1167FEBK-S v1.04 and earlier, WRC-1167GHBK3-A v1.24 and earlier, WRC-1167FEBK-A v1.18 and earlier, WRC-F1167ACF2 all versions, WRC-600GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-1467GHBK-A all versions, WRC-1467GHBK-S all versions, WRC-1900GHBK-A all versions, and WRC-1900GHBK-S all versions.
Product
WRC-1167GHBK-S
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp elecom.co.jp
Jul 12, 2023Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics allows authenticated attacker to read administrator passCVE-2023-34134 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comMedium 6.5
Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics allows authenticated attacker to read administrator password hash via a web service call. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Product
GMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.global.sonicwall.com sonicwall.com
Jul 12, 2023Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics enables an unauthenticated attacker to access restrictedCVE-2023-34131 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comMedium 5.3
Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics enables an unauthenticated attacker to access restricted web pages. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Product
GMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.global.sonicwall.com sonicwall.com
Jul 10, 2023Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive informationCVE-2023-3270 · Other software · SICK AG · reported by psirt@sick.deHigh 8.6
Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the system.
Product
ICR890-4
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sick.com sick.com
Jul 10, 2023Export All URLs: Does not sanitise and escape a parameter before outputting them back in the pageCVE-2023-3118 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Export All URLs
Fixed in
4.6
What to do
Update Export All URLs to 4.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA.CVE-2023-35887 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks. This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10
Product
Apache MINA SSHD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Jul 10, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel.This issue affects Apache Camel: from 3.X thCVE-2023-34442 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 3.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel.This issue affects Apache Camel: from 3.X through <=3.14.8, from 3.18.X through <=3.18.7, from 3.20.X through <= 3.20.5, from 4.X through <= 4.0.0-M3. Users should upgrade to 3.14.9, 3.18.8, 3.20.6 or 3.21.0 and for users on Camel 4.x update to 4.0.0-M1
Product
Apache Camel JIRA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Jul 8, 2023Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.CVE-2023-3553 · Other software · nilsteampassnet · reported by security@huntr.devHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
Product
nilsteampassnet/teampass
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Jul 6, 2023A directory traversal vulnerability exists in the luci2-io file-export mib functionality of Milesight UR32L v32.3.0.5.CVE-2023-23547 · Other software · Milesight · reported by talos-cna@cisco.comMedium 6.5
A directory traversal vulnerability exists in the luci2-io file-export mib functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary file read. An attacker can send a network request to trigger this vulnerability.
Product
UR32L
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Jul 5, 2023Exposure of Sensitive Information vulnerability in getChipIds in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attackers to access the UWB CVE-2023-30662 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Exposure of Sensitive Information vulnerability in getChipIds in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attackers to access the UWB chipset Identifier.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 5, 2023Exposure of Sensitive Information vulnerability in getChipInfos in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attackers to access the UWCVE-2023-30661 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Exposure of Sensitive Information vulnerability in getChipInfos in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attackers to access the UWB chipset Identifier.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 5, 2023Exposure of Sensitive Information vulnerability in getDefaultChipId in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attackers to access thCVE-2023-30660 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Exposure of Sensitive Information vulnerability in getDefaultChipId in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attackers to access the UWB chipset Identifier.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 5, 2023PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow an attacker to gain root access by running a crafted binary leveraging an exported functioCVE-2023-27197 · Other software · Paxtechnology · reported by MITREMedium 6.7
PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow an attacker to gain root access by running a crafted binary leveraging an exported function from a shared library. The attacker must have shell access to the device in order to exploit this vulnerability.
Product
PAX A930 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com wr3nchsr.github.io

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.