Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,626 results · page 68 of 93
Mar 29, 2023Kiwi TCMS is an open source test management system for both manual and automated testing.CVE-2023-27489 · Other software · kiwitcms · reported by GitHubHigh 7.6
Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS accepts SVG files uploaded by users which could potentially contain JavaScript code. If SVG images are viewed directly, i.e. not rendered in an HTML page, this JavaScript code could execute. This vulnerability has been fixed by configuring Kiwi TCMS to serve with the Content-Security-Policy HTTP header which blocks inline JavaScript in all modern browsers. This configuration change is provided in version 12.1 and users are advised to upgrade. Users unable to upgrade may set their Content-Security-Policy HTTP header manually.
- Product
- Kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023DataEase is an open source data visualization analysis tool.CVE-2023-28637 · Other software · dataease · reported by GitHubHigh 8
DataEase is an open source data visualization analysis tool. In Dataease users are normally allowed to modify data and the data sources are expected to properly sanitize data. The AWS redshift data source does not provide data sanitization which may lead to remote code execution. This vulnerability has been fixed in v1.18.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Apiman is a flexible and open source API Management platform.CVE-2023-28640 · Other software · apiman · reported by GitHubMedium 6.4
Apiman is a flexible and open source API Management platform. Due to a missing permissions check, an attacker with an authenticated Apiman Manager account may be able to gain access to API keys they do not have permission for if they correctly guess the URL, which includes Organisation ID, Client ID, and Client Version of the targeted non-permitted resource. While not trivial to exploit, it could be achieved by brute-forcing or guessing common names. Access to the non-permitted API Keys could allow use of other users' resources without their permission (depending on the specifics of configuration, such as whether an API key is the only form of security). Apiman 3.1.0.Final resolved this issue. Users are advised to upgrade. The only known workaround is to restrict account access.
- Product
- apiman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023GoCD is an open source continuous delivery server.CVE-2023-28630 · Other software · gocd · reported by GitHubMedium 4.2
GoCD is an open source continuous delivery server. In GoCD versions from 20.5.0 and below 23.1.0, if the server environment is not correctly configured by administrators to provide access to the relevant PostgreSQL or MySQL backup tools, the credentials for database access may be unintentionally leaked to admin alerts on the GoCD user interface. The vulnerability is triggered only if the GoCD server host is misconfigured to have backups enabled, but does not have access to the `pg_dump` or `mysqldump` utility tools to backup the configured database type (PostgreSQL or MySQL respectively). In such cases, failure to launch the expected backup utility reports the shell environment used to attempt to launch in the server admin alert, which includes the plaintext database password supplied to the configured tool. This vulnerability does not affect backups of the default on-disk H2 database that GoCD is configured to use. This issue has been addressed and fixed in GoCD 23.1.0. Users are advised to upgrade. Users unable to upgrade may disable backups, or administrators should ensure that the required `pg_dump` (PostgreSQL) or `mysqldump` (MySQL) binaries are available on the GoCD server w
- Product
- gocd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023GoCD is an open source continuous delivery server.CVE-2023-28629 · Other software · gocd · reported by GitHubMedium 5.4
GoCD is an open source continuous delivery server. GoCD versions before 23.1.0 are vulnerable to a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An attacker that has permissions to configure GoCD pipelines could include JavaScript elements within the label template, causing a XSS vulnerability to be triggered for any users viewing the Value Stream Map or Job Details for runs of the affected pipeline, potentially allowing them to perform arbitrary actions within the victim's browser context rather than their own. This issue has been fixed in GoCD 23.1.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- gocd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.gocd.orggithub.com
Mar 27, 2023Nextcloud server is an open source, personal cloud implementation.CVE-2023-25817 · Other software · nextcloud · reported by GitHubLow 3.5
Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deletable but only viewed or downloaded. This issue has been addressed andit is recommended that the Nextcloud Server is upgraded to 24.0.9. There are no known workarounds for this vulnerability.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Nextcloud server is an open source, personal cloud implementation.CVE-2023-25818 · Other software · nextcloud · reported by GitHubMedium 5.3
Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and then brute force the 62^21 combinations for the password reset token. As of commit `704eb3aa` password reset attempts are now throttled. Note that 62^21 combinations would significant compute resources to brute force. None the less it is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. There are no known workarounds for this vulnerability.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023TensorFlow is an Open Source Machine Learning Framework.CVE-2023-25661 · Other software · tensorflow · reported by GitHubMedium 6.5
TensorFlow is an Open Source Machine Learning Framework. In versions prior to 2.11.1 a malicious invalid input crashes a tensorflow model (Check Failed) and can be used to trigger a denial of service attack. A proof of concept can be constructed with the `Convolution3DTranspose` function. This Convolution3DTranspose layer is a very common API in modern neural networks. The ML models containing such vulnerable components could be deployed in ML applications or as cloud services. This failure could be potentially used to trigger a denial of service attack on ML cloud services. An attacker must have privilege to provide input to a `Convolution3DTranspose` call. This issue has been patched and users are advised to upgrade to version 2.11.1. There are no known workarounds for this vulnerability.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023Dataease is an open source data visualization and analysis tool.CVE-2023-28437 · Other software · dataease · reported by GitHubCritical 9.8
Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an end-to-end open source platform for machine learning.CVE-2023-27579 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an end-to-end open source platform for machine learning. Constructing a tflite model with a paramater `filter_input_channel` of less than 1 gives a FPE. This issue has been patched in version 2.12. TensorFlow will also cherrypick the fix commit on TensorFlow 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source machine learning platform.CVE-2023-25801 · Other software · tensorflow · reported by GitHubHigh 8
TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, `nn_ops.fractional_avg_pool_v2` and `nn_ops.fractional_max_pool_v2` require the first and fourth elements of their parameter `pooling_ratio` to be equal to 1.0, as pooling on batch and channel dimensions is not supported. A fix is included in TensorFlow 2.12.0 and 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source machine learning platform.CVE-2023-25676 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, `tf.raw_ops.ParallelConcat` segfaults with a nullptr dereference when given a parameter `shape` with rank that is not greater than zero. A fix is available in TensorFlow 2.12.0 and 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source machine learning platform.CVE-2023-25675 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, `tf.raw_ops.Bincount` segfaults when given a parameter `weights` that is neither the same shape as parameter `arr` nor a length-0 tensor. A fix is included in TensorFlow 2.12.0 and 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source machine learning platform.CVE-2023-25674 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source machine learning platform. Versions prior to 2.12.0 and 2.11.1 have a null pointer error in RandomShuffle with XLA enabled. A fix is included in TensorFlow 2.12.0 and 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source platform for machine learning.CVE-2023-25673 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 have a Floating Point Exception in TensorListSplit with XLA. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source platform for machine learning.CVE-2023-25672 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source platform for machine learning. The function `tf.raw_ops.LookupTableImportV2` cannot handle scalars in the `values` parameter and gives an NPE. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source platform for machine learning.CVE-2023-25671 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source platform for machine learning. There is out-of-bounds access due to mismatched integer type sizes. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source platform for machine learning.CVE-2023-25670 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 have a null point error in QuantizedMatMulWithBiasAndDequantize with MKL enabled. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source platform for machine learning.CVE-2023-25669 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, if the stride and window size are not positive for `tf.raw_ops.AvgPoolGrad`, it can give a floating point exception. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source platform for machine learning.CVE-2023-25668 · Other software · tensorflow · reported by GitHubCritical 9.8
TensorFlow is an open source platform for machine learning. Attackers using Tensorflow prior to 2.12.0 or 2.11.1 can access heap memory which is not in the control of user, leading to a crash or remote code execution. The fix will be included in TensorFlow version 2.12.0 and will also cherrypick this commit on TensorFlow version 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source platform for machine learning.CVE-2023-25667 · Other software · tensorflow · reported by GitHubMedium 6.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, integer overflow occurs when `2^31 <= num_frames * height * width * channels < 2^32`, for example Full HD screencast of at least 346 frames. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source platform for machine learning.CVE-2023-25666 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, there is a floating point exception in AudioSpectrogram. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source platform for machine learning.CVE-2023-25665 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when `SparseSparseMaximum` is given invalid sparse tensors as inputs, it can give a null pointer error. A fix is included in TensorFlow version 2.12 and version 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source platform for machine learning.CVE-2023-25664 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, there is a heap buffer overflow in TAvgPoolGrad. A fix is included in TensorFlow 2.12.0 and 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source platform for machine learning.CVE-2023-25663 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when `ctx->step_containter()` is a null ptr, the Lookup function will be executed with a null pointer. A fix is included in TensorFlow 2.12.0 and 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source platform for machine learning.CVE-2023-25662 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 are vulnerable to integer overflow in EditDistance. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source platform for machine learning.CVE-2023-25660 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter `summarize` of `tf.raw_ops.Print` is zero, the new method `SummarizeArray<bool>` will reference to a nullptr, leading to a seg fault. A fix is included in TensorFlow version 2.12 and version 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source platform for machine learning.CVE-2023-25659 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, if the parameter `indices` for `DynamicStitch` does not match the shape of the parameter `data`, it can trigger an stack OOB read. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023TensorFlow is an open source platform for machine learning.CVE-2023-25658 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, an out of bounds read is in GRUBlockCellGrad. A fix is included in TensorFlow 2.12.0 and 2.11.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023Dataease is an open source data visualization and analysis tool.CVE-2023-28435 · Other software · dataease · reported by GitHubMedium 6.5
Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has been fixed in version 1.18.5.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data.CVE-2023-28442 · Other software · GeoNode · reported by GitHubHigh 7.5
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Prior to versions 2.20.6, 2.19.6, and 2.18.7, anonymous users can obtain sensitive information about GeoNode configurations from the response of the `/geoserver/rest/about/status` Geoserver REST API endpoint. The Geoserver endpoint is secured by default, but the configuration of Geoserver for GeoNode opens a list of REST endpoints to support some of its public-facing services. The vulnerability impacts both GeoNode 3 and GeoNode 4 instances. Geoserver security configuration is provided by `geoserver-geonode-ext`. A patch for 2.20.7 has been released which blocks access to the affected endpoint. The patch has been backported to branches 2.20.6, 2.19.7, 2.19.6, and 2.18.7. All the published artifacts and Docker images have been updated accordingly. A more advanced patch has been applied to the master and development versions, which require some changes to GeoNode code. They will be available with the next 4.1.0 release. The patched configuration only has an effect on new deployments. For existing setups, the patch must be applied manually inside the Geoserver data dir
- Product
- geonode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.CVE-2023-28439 · Other software · ckeditor · reported by GitHubMedium 4.7
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `<textarea>` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism. A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin applies the `sandbox` attribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure the `config.iframe_attributes` option. Also starting from version 4.21.0, the Media Embed plugin regenerates the entire content of the embed widget by default. To change this behavior, configure the `config.embed_keepOriginalContent` option. Those wh
- Product
- ckeditor4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordckeditor.comckeditor.com
Mar 22, 2023Pimcore is an open source data and experience management platform.CVE-2023-28438 · Other software · pimcore · reported by GitHubMedium 6.2
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2023Pimcore is an open source data and experience management platform.CVE-2023-28429 · Other software · pimcore · reported by GitHubMedium 6.1
Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 10.5.19 or, as a workaround, apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and WebCVE-2023-28110 · Other software · jumpserver · reported by GitHubMedium 5.7
Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the execution of dangerous commands that may disrupt the Koko container environment and affect normal usage. The vulnerability has been fixed in v2.28.8.
- Product
- jumpserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023Pimcore is an open source data and experience management platform.CVE-2023-28108 · Other software · pimcore · reported by GitHubHigh 7.9
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and so relies on the auto-quoting being done by the DAO class. Users should update to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023Pimcore is an open source data and experience management platform.CVE-2023-28106 · Other software · pimcore · reported by GitHubMedium 6.1
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2023PJSIP is a free and open source multimedia communication library written in C.CVE-2023-27585 · Other software · pjsip · reported by GitHubHigh 7.5
PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to CVE-2022-24793. The difference is that this issue is in parsing the query record `parse_query()`, while the issue in CVE-2022-24793 is in `parse_rr()`. A patch is available as commit `d1c5e4d` in the `master` branch. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver implementation instead.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2023Combodo iTop is an open source, web-based IT service management platform.CVE-2022-39216 · Other software · Combodo · reported by GitHubHigh 7.4
Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, the reset password token is generated without any randomness parameter. This may lead to account takeover. The issue is fixed in versions 2.7.8 and 3.0.2-1.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2023Combodo iTop is an open source, web-based IT service management platform.CVE-2022-39214 · Other software · Combodo · reported by GitHubCritical 9.6
Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take over any account just by knowing the account's username. This issue is fixed in versions 2.7.8 and 3.0.2-1.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF).CVE-2023-25170 · Websites & servers · PrestaShop · reported by GitHubMedium 5
PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. The problem is fixed in version 8.0.1.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023NextAuth.js is an open source authentication solution for Next.js applications.CVE-2023-27490 · Other software · nextauthjs · reported by GitHubHigh 8.1
NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to **log in as the victim**, bypassing the CSRF protection. This is due to a partial failure during a compromised OAuth session where a session code is erroneously generated. This issue has been addressed in version 4.20.1. Users are advised to upgrade. Users unable to upgrade may using Advanced Initialization, manually check the callback request for state, pkce, and nonce against the provider configuration to prevent this issue. See the linked GHSA for details.
- Product
- next-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordauthjs.devdanielfett.de
Mar 9, 2023metersphere is an open source continuous testing platform.CVE-2023-25814 · Other software · metersphere · reported by GitHubHigh 7.1
metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file through UI operations is able to append a path to their submission query which will be read by the system and displayed to the user. This allows a users of the system to read arbitrary files on the filesystem of the server so long as the server process itself has permission to read the requested files. This issue has been addressed in version 2.7.1. All users are advised to upgrade. There are no known workarounds for this issue.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023metersphere is an open source continuous testing platform.CVE-2023-25573 · Other software · metersphere · reported by GitHubHigh 8.6
metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This issue has been addressed in version 1.20.20 lts and 2.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023homeassistant is an open source home automation tool.CVE-2023-27482 · Other software · home-assistant · reported by GitHubCritical 10
homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. This impacts all Home Assistant installation types that use the Supervisor 2023.01.1 or older. Installation types, like Home Assistant Container (for example Docker), or Home Assistant Core manually in a Python environment, are not affected. The issue has been mitigated and closed in Supervisor version 2023.03.1, which has been rolled out to all affected installations via the auto-update feature of the Supervisor. This rollout has been completed at the time of publication of this advisory. Home Assistant Core 2023.3.0 included mitigation for this vulnerability. Upgrading to at least that version is thus advised. In case one is not able to upgrade the Home Assistant Supervisor or the Home Assistant Core application at this time, it is advised to not expose your Home Assistant instance to the internet.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023thmmniii/fbs-core is an open source feedback system for students.CVE-2023-27485 · Other software · thm-mni-ii · reported by GitHubMedium 4.3
thmmniii/fbs-core is an open source feedback system for students. In versions prior to 1.5.3 when querying `subresults`, it is possible to query `subresults` from other users due to insufficient authorisation. This is only possible for logged-in users and it is not possible to associate the subresults with a specific user. This bug was fixed in commit `f1ae67d8bb2`and released with version 1.5.3. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- feedbacksystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023libmemcached-awesome is an open source C/C++ client library and tools for the memcached server.CVE-2023-27478 · Other software · awesomized · reported by GitHubMedium 6.5
libmemcached-awesome is an open source C/C++ client library and tools for the memcached server. `libmemcached` could return data for a previously requested key, if that previous request timed out due to a low `POLL_TIMEOUT`. This issue has been addressed in version 1.1.4. Users are advised to upgrade. There are several ways to workaround or lower the probability of this bug affecting a given deployment. 1: use a reasonably high `POLL_TIMEOUT` setting, like the default. 2: use separate libmemcached connections for unrelated data. 3: do not re-use libmemcached connections in an unknown state.
- Product
- libmemcached
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023 quickentity-editor-next is an open source, system local, video game asset editor.CVE-2023-27472 · Other software · atampy25 · reported by GitHubHigh 8.2
quickentity-editor-next is an open source, system local, video game asset editor. In affected versions HTML tags in entity names are not sanitised (XSS vulnerability). Allows arbitrary code execution within the browser sandbox, among other things, simply from loading a file containing a script tag in any entity name. This issue has been patched in version 1.28.1 of the application. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- quickentity-editor-next
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2023Discourse is an open source platform for community discussion.CVE-2023-25819 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the `tests-passed` or `beta` branches >= 3.1.0.beta2. The issue is patched in the latest `beta` and `tests-passed` version of Discourse.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2023RSSHub is an open source and extensible RSS feed generator.CVE-2023-26491 · Other software · DIYgod · reported by GitHubMedium 5.4
RSSHub is an open source and extensible RSS feed generator. When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. This vulnerability was fixed in version c910c4d28717fb860fbe064736641f379fab2c91. Please upgrade to this or a later version, there are no known workarounds.
- Product
- RSSHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.