Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,366 results · page 69 of 148
Nov 1, 2023A vulnerability was found in insights-client.CVE-2023-3972 · Other software · Red Hat · reported by Red HatHigh 7.8
A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local user or attacker could create the /var/tmp/insights-client directory (owning the directory with read, write, and execute permissions) on the system. After the insights-client is registered by root, an attacker could then control the directory content that insights are using by putting malicious scripts into it and executing arbitrary code as root (trivially bypassing SELinux protections because insights processes are allowed to disable SELinux system-wide).
- Product
- Red Hat Enterprise Linux 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 31, 2023 Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call (RPC) of the InspectSetup service endpoint.CVE-2023-2622 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comLow 2.7
Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call (RPC) of the InspectSetup service endpoint. The low privilege client is then allowed to read arbitrary files that they do not have authorization to read.
- Product
- MACH System Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.compublisher.hitachienergy.com
Oct 31, 2023A Reflected Cross-Site Scripting (XSS) vulnerability in the Cloudmin Services Client under System Setting in Virtualmin 7.7 allows remote attackers to inject arCVE-2023-47096 · Other software · Virtualmin · reported by MITREMedium 5.4
A Reflected Cross-Site Scripting (XSS) vulnerability in the Cloudmin Services Client under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Cloudmin services master field.
- Product
- Virtualmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023The installer (aka openvpn-client-installer) in Securepoint SSL VPN Client before 2.0.40 allows local privilege escalation during installation or repair.CVE-2023-47101 · Other software · Securepoint · reported by MITREHigh 7.8
The installer (aka openvpn-client-installer) in Securepoint SSL VPN Client before 2.0.40 allows local privilege escalation during installation or repair.
- Product
- Openvpn-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyvisory.groupsourceforge.net
Oct 30, 2023In libaudioclient, there is a possible out of bounds write due to a use after free.CVE-2023-21355 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In libaudioclient, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 27, 2023SonicWall NetExtender Windows (32-bit and 64-bit) client 10.2.336 and earlier versions have a DLL Search Order Hijacking vulnerability in the start-up DLL compoCVE-2023-44220 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 7.3
SonicWall NetExtender Windows (32-bit and 64-bit) client 10.2.336 and earlier versions have a DLL Search Order Hijacking vulnerability in the start-up DLL component. Successful exploitation via a local attacker could result in command execution in the target system.
- Product
- NetExtender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.compsirt.global.sonicwall.com
Oct 27, 2023A local privilege escalation vulnerability in SonicWall Directory Services Connector Windows MSI client 4.1.21 and earlier versions allows a local low-privilegeCVE-2023-44219 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 7.8
A local privilege escalation vulnerability in SonicWall Directory Services Connector Windows MSI client 4.1.21 and earlier versions allows a local low-privileged user to gain system privileges through running the recovery feature.
- Product
- Directory Services Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.compsirt.global.sonicwall.com
Oct 26, 2023It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid forCVE-2023-31421 · Other software · Elastic · reported by security@elastic.coMedium 5.9
It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN values against that IP address and certificate validation fails, and therefore the connection is not blocked as expected.
- Product
- Beats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.coelastic.co
Oct 25, 2023TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl.CVE-2023-46551 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl.
- Product
- x2000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes.CVE-2023-46120 · Other software · rabbitmq · reported by GitHubMedium 4.9
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.
- Product
- rabbitmq-java-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI CVE-2023-46102 · Other software · Bosch Rexroth AG · reported by psirt@bosch.comHigh 8.8
The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI device. The protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric key, that can be retrieved reversing both the Android Client application and the server-side web application. This issue allows an attacker able to control a malicious MQTT broker on the same subnet network of the device, to craft malicious messages and send them to the HMI device, executing arbitrary commands on the device itself.
- Product
- ctrlX HMI Web Panel - WR21 (WR2107)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Oct 25, 2023The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication.CVE-2023-45851 · Other software · Bosch Rexroth AG · reported by psirt@bosch.comHigh 8.8
The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication. This issue allows an attacker to force the Android Client application to connect to a malicious MQTT broker, enabling it to send fake messages to the HMI device
- Product
- ctrlX HMI Web Panel - WR21 (WR2107)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Oct 25, 2023The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocol to retrieve sensitiCVE-2023-45321 · Other software · Bosch Rexroth AG · reported by psirt@bosch.comHigh 8.3
The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocol to retrieve sensitive information (ip address and credentials to connect to a remote MQTT broker entity) instead of HTTPS and this feature is not configurable by the user. Due to the lack of encryption of HTTP,this issue allows an attacker placed in the same subnet network of the HMI device to intercept username and password necessary to authenticate to the MQTT server responsible to implement the remote management protocol.
- Product
- ctrlX HMI Web Panel - WR21 (WR2107)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Oct 25, 2023The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol to retrieve sensitivCVE-2023-45220 · Other software · Rexroth · reported by psirt@bosch.comHigh 8.8
The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol to retrieve sensitive information (ip address and credentials to connect to a remote MQTT broker entity) instead of HTTPS and this feature is not configurable by the user.
- Product
- ctrlX HMI Web Panel - WR21 (WR2107)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Oct 25, 2023The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client application, inducinCVE-2023-41372 · Other software · Rexroth · reported by psirt@bosch.comHigh 7.8
The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client application, inducing it to connect to an attacker - controlled malicious server.This is possible by forging a valid broadcast intent encrypted with a hardcoded RSA key pair
- Product
- ctrlX HMI Web Panel - WR21 (WR2107)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Oct 25, 2023The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.CVE-2023-39740 · Other software · Linecorp · reported by MITREHigh 8.2
The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- Onigiriya-musubee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Oct 25, 2023The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.CVE-2023-39739 · Other software · linecorp · reported by MITREHigh 8.2
The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- regina_sweets\&bakery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Oct 25, 2023The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.CVE-2023-39737 · Other software · linecorp · reported by MITREHigh 8.2
The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- matsuya
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Oct 25, 2023The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.CVE-2023-39736 · Other software · linecorp · reported by MITREHigh 8.2
The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- fukunaga_memberscard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Oct 25, 2023The leakage of the client secret in Uomasa_Saiji_news Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.CVE-2023-39735 · Other software · linecorp · reported by MITREHigh 8.2
The leakage of the client secret in Uomasa_Saiji_news Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- uomasa_saiji_new
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Oct 25, 2023The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadCVE-2023-39734 · Other software · Linecorp · reported by MITREHigh 8.2
The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- Trackdiner10/10 MC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Oct 25, 2023The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.CVE-2023-39733 · Other software · Linecorp · reported by MITREHigh 8.2
The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- Tonton-tei
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Oct 25, 2023The leakage of the client secret in Tokueimaru_waiting Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.CVE-2023-39732 · Other software · Linecorp · reported by MITREHigh 8.2
The leakage of the client secret in Tokueimaru_waiting Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- Tokueimaru Waiting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Oct 25, 2023A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition.CVE-2023-38041 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7
A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flow is initiated, an attacker can exploit this condition to gain unauthorized elevated privileges on the affected system.
- Product
- Secure Access Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
Oct 23, 2023Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library.CVE-2023-46127 · Other software · frappe · reported by GitHubMedium 5.4
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2023An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation.CVE-2023-28805 · Other software · Zscaler · reported by cve@zscaler.comMedium 6.7
An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation. This issue affects Client Connector: before 1.4.0.105
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Oct 23, 2023An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux ClientCVE-2023-28804 · Other software · Zscaler · reported by cve@zscaler.comHigh 8.2
An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before 1.4.0.105
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Oct 23, 2023An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypassCVE-2023-28803 · Other software · Zscaler · reported by cve@zscaler.comMedium 5.9
An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass. This issue affects Client Connector: before 3.9.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Oct 23, 2023Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk.CVE-2023-28797 · Other software · Zscaler · reported by cve@zscaler.comMedium 6.3
Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. A malicious user can replace the folder and execute code as a privileged user.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Oct 23, 2023Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection.CVE-2023-28796 · Other software · Zscaler · reported by cve@zscaler.comHigh 7.1
Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Oct 23, 2023Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process.CVE-2023-28795 · Other software · Zscaler · reported by cve@zscaler.comHigh 7.8
Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Oct 23, 2023Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection.CVE-2023-28793 · Other software · Zscaler · reported by cve@zscaler.comHigh 7.8
Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Oct 23, 2023Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable.CVE-2021-26738 · Other software · Zscaler · reported by cve@zscaler.comHigh 7.8
Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code with root privileges.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Oct 23, 2023The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients.CVE-2021-26737 · Other software · Zscaler · reported by cve@zscaler.comMedium 5.5
The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileges may be able to shutdown the Zscaler tunnel by exploiting a race condition.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Oct 23, 2023Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged CVE-2021-26736 · Other software · Zscaler · reported by cve@zscaler.comMedium 6.7
Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged path. A local adversary may be able to execute code with SYSTEM privileges.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Oct 23, 2023The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability.CVE-2021-26735 · Other software · Zscaler · reported by cve@zscaler.comMedium 6.7
The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to execute code with SYSTEM privileges.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Oct 23, 2023Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation.CVE-2021-26734 · Other software · Zscaler · reported by cve@zscaler.comMedium 4.4
Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local adversary may be able to delete folders in an elevated context.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Oct 23, 2023When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately.CVE-2023-45802 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.9
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpd.apache.orghttpd.apache.org
Oct 19, 2023The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.CVE-2023-39731 · Other software · Line · reported by MITREMedium 5.3
The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- Kaibutsunosato
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Oct 19, 2023The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery.CVE-2023-44385 · Other software · home-assistant · reported by GitHubHigh 8.6
The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistant installation. Combined with this security advisory, may result in full compromise and remote code execution (RCE). Version 2023.7 addresses this issue and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: GHSL-2023-161.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2023urllib3 is a user-friendly HTTP client library for Python.CVE-2023-45803 · Other software · urllib3 · reported by GitHubMedium 4.2
urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the
- Product
- urllib3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2023TSplus Remote Work 16.0.0.0 has weak permissions for .exe, .js, and .html files under the %PROGRAMFILES(X86)%\TSplus-RemoteWork\Clients\www folder.CVE-2023-27133 · Other software · Tsplus · reported by MITRECritical 9.8
TSplus Remote Work 16.0.0.0 has weak permissions for .exe, .js, and .html files under the %PROGRAMFILES(X86)%\TSplus-RemoteWork\Clients\www folder. This may enable privilege escalation if a different local user modifies a file. NOTE: CVE-2023-31067 and CVE-2023-31068 are only about the TSplus Remote Access product, not the TSplus Remote Work product.
- Product
- Tsplus Remote Work
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 16, 2023This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate itCVE-2023-5133 · WordPress plugins & themes · reported by WPScanHigh 7.5
This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
- Fixed in
- 2.3.4
- What to do
- Update the plugin to 2.3.4 or newer.
Oct 15, 2023A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client (with remote control access to a game server) to read arbitrary files from the CVE-2023-38312 · Other software · Valvesoftware · reported by MITREHigh 7.5
A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client (with remote control access to a game server) to read arbitrary files from the underlying server via the motdfile console variable.
- Product
- Counter-strike
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2023HP is aware of a potential security vulnerability in HP t430 and t638 Thin Client PCs.CVE-2023-5409 · Other software · HP Inc. · reported by hp-security-alert@hp.comMedium 6.8
HP is aware of a potential security vulnerability in HP t430 and t638 Thin Client PCs. These models may be susceptible to a physical attack, allowing an untrusted source to tamper with the system firmware using a publicly disclosed private key. HP is providing recommended guidance for customers to reduce exposure to the potential vulnerability.
- Product
- HP t430 and t638 Thin Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Oct 12, 2023Undici is an HTTP/1.1 client written from scratch for Node.js.CVE-2023-45143 · Other software · nodejs · reported by GitHubLow 3.9
Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2023An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674.CVE-2023-31192 · Other software · SoftEther VPN · reported by talos-cna@cisco.comMedium 5.3
An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
- Product
- SoftEther VPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comsoftether.org
Oct 12, 2023Lack of TLS certificate verification in log transmission of a financial module within LINE client for iOS prior to 13.16.0.CVE-2023-5554 · Other software · LINE Corporation · reported by dl_cve@linecorp.comMedium 4.8
Lack of TLS certificate verification in log transmission of a financial module within LINE client for iOS prior to 13.16.0.
- Product
- LINE client for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Oct 11, 2023A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.CVE-2023-39325 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.
- Product
- net/http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2023In lwis_transaction_client_cleanup of lwis_transaction.c, there is a possible way to corrupt memory due to a use after free.CVE-2023-35660 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In lwis_transaction_client_cleanup of lwis_transaction.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.