Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,746 results · page 67 of 95
Dec 21, 2022Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product exposes sensitive data concerning the device.CVE-2022-3185 · Other software · Dataprobe · reported by ics-cert@hq.dhs.govMedium 5.3
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product exposes sensitive data concerning the device.
- Product
- iBoot-PDU FW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022 IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to sensitive information exposure by passing API keys to log files.CVE-2022-43887 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to sensitive information exposure by passing API keys to log files. If these keys contain sensitive information, it could lead to further attacks. IBM X-Force ID: 240450.
- Product
- Cognos Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 16, 2022In Pixel firmware, there is a possible exposure of sensitive memory due to a missing bounds check.CVE-2022-20599 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In Pixel firmware, there is a possible exposure of sensitive memory due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-242332706References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 12, 2022An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process InteCVE-2022-41272 · Network & remote access · SAP · reported by cna@sap.comCritical 9.9
An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process Integration (PI) - version 7.50 and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data across the entire system. This allows the attacker to have full read access to user data, make limited modifications to user data, and degrade the performance of the system, leading to a high impact on confidentiality and a limited impact on the availability and integrity of the application.
- Product
- NetWeaver Process Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Dec 12, 2022An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50.CVE-2022-41271 · Network & remote access · SAP · reported by cna@sap.comCritical 9.4
An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50. This user can make use of an open naming and directory API to access services that could perform unauthorized operations. The vulnerability affects local users and data, leading to a considerable impact on confidentiality as well as availability and a limited impact on the integrity of the application. These operations can be used to: * Read any information * Modify sensitive information * Denial of Service attacks (DoS) * SQL Injection
- Product
- NetWeaver Process Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Dec 12, 2022WP CSV Exporter: Does not properly escape the fieldsCVE-2022-3605 · WordPress plugins & themes · reported by WPScanHigh 7.8
The WP CSV Exporter WordPress plugin before 1.3.7 does not properly escape the fields when exporting data as CSV, leading to a CSV injection vulnerability.
- Product
- WP CSV Exporter
- Fixed in
- 1.3.7
- What to do
- Update WP CSV Exporter to 1.3.7 or newer.
Dec 12, 2022In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them thrCVE-2022-46685 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log.
- Product
- Jenkins Gitea Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2022Exposure of Sensitive Information from an Unauthorized Actor vulnerability in Samsung DisplayManagerService prior to Android T(13) allows local attacker to acceCVE-2022-39914 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Exposure of Sensitive Information from an Unauthorized Actor vulnerability in Samsung DisplayManagerService prior to Android T(13) allows local attacker to access connected DLNA device information.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Dec 8, 2022Exposure of Sensitive Information to an Unauthorized Actor in Persona Manager prior to Android T(13) allows local attacker to access user profiles information.CVE-2022-39913 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.8
Exposure of Sensitive Information to an Unauthorized Actor in Persona Manager prior to Android T(13) allows local attacker to access user profiles information.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Dec 8, 2022Exposure of Sensitive Information vulnerability in Samsung Settings prior to SMR Dec-2022 Release 1 allows local attackers to access the Network Access IdentifiCVE-2022-39904 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Exposure of Sensitive Information vulnerability in Samsung Settings prior to SMR Dec-2022 Release 1 allows local attackers to access the Network Access Identifier via log.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Dec 8, 2022Exposure of Sensitive Information vulnerability in kernel prior to SMR Dec-2022 Release 1 allows attackers to access the kernel address information via log.CVE-2022-39897 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.4
Exposure of Sensitive Information vulnerability in kernel prior to SMR Dec-2022 Release 1 allows attackers to access the kernel address information via log.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Dec 8, 2022Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls.CVE-2022-37918 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.1
Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15.0 and below.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Dec 8, 2022Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls.CVE-2022-37917 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.1
Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15.0 and below.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Dec 8, 2022Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls.CVE-2022-37916 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.1
Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15.0 and below.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Dec 7, 2022Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents.CVE-2022-4261 · Other software · Rapid7 · reported by cve@rapid7.comMedium 4.4
Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need some pre-existing mechanism to provide a malicious update, either through a social engineering effort, privileged access to replace downloaded updates in transit, or by performing an Attacker-in-the-Middle attack on the update service itself.
- Product
- Nexpose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rapid7.comdocs.rapid7.com
Dec 6, 2022An issue in Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom allows attackers to execute arbitrary commands during the GFM export process.CVE-2022-45026 · Other software · Markdown Preview Enhanced Project · reported by MITRECritical 9.8
An issue in Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom allows attackers to execute arbitrary commands during the GFM export process.
- Product
- Markdown Preview Enhanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2022RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has exposed a privileged token via a publCVE-2022-46383 · Other software · Rackn · reported by MITRECritical 9.8
RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has exposed a privileged token via a public API endpoint (Incorrect Access Control). The token can be used to escalate privileges within the Digital Rebar system and grant full administrative access.
- Product
- Digital Rebar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rackn.iorackn.com
Dec 5, 2022WP CSV Exporter: Does not properly sanitise and escape some parameters before using them in a SQL statementCVE-2022-3249 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP CSV Exporter WordPress plugin before 1.3.7 does not properly sanitise and escape some parameters before using them in a SQL statement, allowing high privilege users such as admin to perform SQL injection attacks
- Product
- WP CSV Exporter
- Fixed in
- 1.3.7
- What to do
- Update WP CSV Exporter to 1.3.7 or newer.
Dec 1, 2022Telenia Software s.r.l TVox before v22.0.17 was discovered to contain a remote code execution (RCE) vulnerability in the component action_export_control.php.CVE-2022-43333 · Other software · Teleniasoftware · reported by MITRECritical 9.8
Telenia Software s.r.l TVox before v22.0.17 was discovered to contain a remote code execution (RCE) vulnerability in the component action_export_control.php.
- Product
- Tvox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordswascan.comswascan.com
Nov 29, 2022Prometheus Exporter Toolkit is a utility package to build exporters.CVE-2022-46146 · Other software · prometheus · reported by GitHubMedium 6.2
Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.
- Product
- exporter-toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Nov 28, 2022Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list: Does not validate dataCVE-2022-3603 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could lead to CSV injection.
- Product
- Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list
- Fixed in
- 2.0.69
- What to do
- Update Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list to 2.0.69 or newer.
Nov 28, 2022Awesome Support: Does not ensure that the exported tickets archive to be downloaded belongs to the user making the requestCVE-2022-3511 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Awesome Support WordPress plugin before 6.1.2 does not ensure that the exported tickets archive to be downloaded belongs to the user making the request, allowing a low privileged user, such as subscriber to download arbitrary exported tickets via an IDOR vector
- Product
- Awesome Support
- Fixed in
- 6.1.2
- What to do
- Update Awesome Support to 6.1.2 or newer.
Nov 24, 2022Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php CVE-2022-4136 · Other software · qmpaas · reported by security@huntr.devCritical 9.8
Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method.
- Product
- qmpaas/leadshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022Information Exposure Through Log Files vulnerability discovered in Foundry when logs were captured using an underlying library known as Build2.CVE-2022-27895 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 4.2
Information Exposure Through Log Files vulnerability discovered in Foundry when logs were captured using an underlying library known as Build2. This issue was present in versions earlier than 1.785.0. Upgrade to Build2 version 1.785.0 or greater.
- Product
- Foundry Build2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2022The Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576) is affected by a password exposure vulnerability.CVE-2022-40845 · Network & remote access · Tenda · reported by MITREMedium 6.5
The Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576) is affected by a password exposure vulnerability. When combined with the improper authorization/improper session management vulnerability, an attacker with access to the router may be able to expose sensitive information which they're not explicitly authorized to have.
- Product
- W15e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2022In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled.CVE-2022-42978 · Websites & servers · Atlassian · reported by MITREHigh 7.5
In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. An unauthenticated attacker could access files on the remote system.
- Product
- Confluence Data Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 14, 2022The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it.CVE-2022-42977 · Websites & servers · Atlassian · reported by MITREHigh 7.5
The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it. During export, the HTTP request has a fileName parameter that accepts any file on the system (e.g., an SSH private key) to be downloaded.
- Product
- Confluence Data Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 14, 2022The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van OorCVE-2022-40735 · Other software · Diffie-hellman KEY Exchange Project · reported by MITREHigh 7.5
The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that "(appropriately) short exponents" can be used when there are adequate subgroup constraints, and these short exponents can lead to less expensive calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation about numbers that are not public keys. The specific situations in which calculation expense would constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an availability concern because of server-side resource consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001 together.
- Product
- Diffie-hellman KEY Exchange
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddheatattack.gitlab.iogist.github.com
Nov 14, 2022The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.6 is susceptible to a local information exposure vulnerability.CVE-2022-28764 · Other software · Zoom Video Communications Inc · reported by security@zoom.usLow 3.3
The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.6 is susceptible to a local information exposure vulnerability. A failure to clear data from a local SQL database after a meeting ends and the usage of an insufficiently secure per-device key encrypting that database results in a local malicious user being able to obtain meeting information such as in-meeting chat for the previous meeting attended from that local user account.
- Product
- Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Nov 14, 2022Information Exposure Through Log Files vulnerability discovered in Foundry Code-Workbooks where the endpoint backing that console was generating service log recCVE-2022-27896 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 4.2
Information Exposure Through Log Files vulnerability discovered in Foundry Code-Workbooks where the endpoint backing that console was generating service log records of any Python code being run. These service logs included the Foundry token that represents the Code-Workbooks Python console. Upgrade to Code-Workbooks version 4.461.0. This issue affects Palantir Foundry Code-Workbooks version 4.144 to version 4.460.0 and is resolved in 4.461.0.
- Product
- Foundry Code-Workbooks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022Sensitive information exposure vulnerability in FmmBaseModel in Galaxy Buds Pro Manage prior to version 4.1.22092751 allows local attackers with log access permCVE-2022-39893 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Sensitive information exposure vulnerability in FmmBaseModel in Galaxy Buds Pro Manage prior to version 4.1.22092751 allows local attackers with log access permission to get device identifier data through device log.
- Product
- Galaxy Buds Pro Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Nov 9, 2022An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to theCVE-2022-42966 · Other software · cleo · reported by reefs@jfrog.comMedium 5.9
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method
- Product
- cleo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
Nov 9, 2022An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply CVE-2022-42965 · Other software · snowflake-connector-python · reported by reefs@jfrog.comLow 3.7
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented get_file_transfer_type method
- Product
- snowflake-connector-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
Nov 9, 2022An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input toCVE-2022-42964 · Other software · pymatgen · reported by reefs@jfrog.comMedium 5.9
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method
- Product
- pymatgen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
Nov 8, 2022In navigateUpTo of Task.java, there is a possible way to launch an unexported intent handler due to a logic error in the code.CVE-2022-20441 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In navigateUpTo of Task.java, there is a possible way to launch an unexported intent handler due to a logic error in the code. This could lead to local escalation of privilege if the targeted app has an intent trampoline, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-238605611
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download.CVE-2022-40128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download.
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 7, 2022Import and export users and customers: Does not properly escape dataCVE-2022-3558 · WordPress plugins & themes · reported by WPScanHigh 8
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.
- Product
- Import and export users and customers
- Fixed in
- 1.20.5
- What to do
- Update Import and export users and customers to 1.20.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 6, 2022Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if thCVE-2022-44544 · Other software · Mahara · reported by MITRECritical 9.8
Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if the site is running on Ubuntu and the flag -dSAFER is not set with Ghostscript.
- Product
- Mahara
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netmahara.org
Nov 3, 2022 IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to uCVE-2022-42442 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to users with access to the container platform. IBM X-Force ID: 238214.
- Product
- Robotic Process Automation for Cloud Pak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Nov 3, 2022In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special charactersCVE-2022-44624 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Nov 2, 2022Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho Analyzer plugin exposes a service endpoint for templates which allowsCVE-2021-45448 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 7.1
Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user-supplied path to access resources that are out of bounds. The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system.
- Product
- Pentaho Business Analytics Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pentaho.comsupport.pentaho.com
Nov 2, 2022An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 through 7.0.6 and versioCVE-2022-35842 · Network & remote access · Fortinet · reported by psirt@fortinet.comLow 3.7
An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 through 7.0.6 and versions 6.4.0 through 6.4.9 may allow a remote unauthenticated attacker to gain information about LDAP and SAML settings configured in FortiOS.
- Product
- Fortinet FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Nov 2, 2022An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiClient for Mac versions 7.0.0 through 7.0.5 may allow a local authCVE-2022-33878 · Network & remote access · Fortinet · reported by psirt@fortinet.comLow 2.2
An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiClient for Mac versions 7.0.0 through 7.0.5 may allow a local authenticated attacker to obtain the SSL-VPN password in cleartext via running a logstream for the FortiTray process in the terminal.
- Product
- Fortinet FortiClientMac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Oct 31, 2022 The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then trCVE-2022-40294 · Websites & servers · PHP Point of Sale LLC · reported by vdp@themissinglink.com.auHigh 8.8
The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then triggered in exported data viewers.
- Product
- PHP Point of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Oct 31, 2022Customizer Export/Import: Unserializes the content of an imported fileCVE-2022-3380 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lead to PHP object injection issues when an admin imports (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Customizer Export/Import
- Fixed in
- 0.9.5
- What to do
- Update Customizer Export/Import to 0.9.5 or newer.
Oct 25, 2022A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5 could allow a local authenticated attacker to export out senCVE-2022-33180 · Other software · Broadcom · reported by sirt@brocade.comMedium 5.5
A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5 could allow a local authenticated attacker to export out sensitive files with “seccryptocfg”, “configupload”.
- Product
- Fabric Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.combroadcom.com
Oct 25, 2022The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () insCVE-2022-3644 · Other software · Pulpproject · reported by Red HatMedium 5.5
The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.
- Product
- Pulp Ansible
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022WP All Export Pro: Uses the contents of the cc_sql POST parameter directlyCVE-2022-3395 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP All Export Pro WordPress plugin before 1.7.9 uses the contents of the cc_sql POST parameter directly as a database query, allowing users which has been given permission to run exports to execute arbitrary SQL statements, leading to a SQL Injection vulnerability. By default only users with the Administrator role can perform exports, but this can be delegated to lower privileged users as well.
- Product
- WP All Export Pro
- Fixed in
- 1.7.9
- What to do
- Update WP All Export Pro to 1.7.9 or newer.
Oct 25, 2022WP All Export Pro: Does not limit some functionality during exports only to users with the Administrator roleCVE-2022-3394 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform exports to execute arbitrary code on the site. By default only administrators can run exports, but the privilege can be delegated to lower privileged users.
- Product
- WP All Export Pro
- Fixed in
- 1.7.9
- What to do
- Update WP All Export Pro to 1.7.9 or newer.
Oct 21, 2022A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to access a subset of aCVE-2022-41575 · Other software · Gradle · reported by MITREHigh 7.5
A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to access a subset of application data (e.g., cleartext credentials). This is fixed in 2022.3.3.
- Product
- Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gradle.comsecurity.gradle.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.