Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
552 results · page 7 of 12
Nov 1, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /appointments/manage_appointment.phCVE-2022-43125 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /appointments/manage_appointment.php.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manage_user.CVE-2022-43124 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manage_user.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8.CVE-2022-39837 · Other software · Genivi · reported by MITREMedium 5.5
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a NULL pointer dereference,
- Product
- Diagnostic LOG And Trace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgsec-consult.com
Oct 25, 2022An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8.CVE-2022-39836 · Other software · Genivi · reported by MITREMedium 5.5
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte.
- Product
- Diagnostic LOG And Trace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgsec-consult.com
Oct 14, 2022Online Diagnostic Lab Management System version 1.0 remote exploit that bypasses login with SQL injection and then uploads a shell.CVE-2022-42064 · Other software · Online Diagnostic Lab Management System Project · reported by MITRECritical 9.8
Online Diagnostic Lab Management System version 1.0 remote exploit that bypasses login with SQL injection and then uploads a shell.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 13, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/createOrder.php.CVE-2022-41534 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/createOrder.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/editProductImage.phpCVE-2022-41533 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editcategory.php?id=.CVE-2022-42074 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editcategory.php?id=.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editclient.php?id=.CVE-2022-42073 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editclient.php?id=.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /diagnostic/edittest.php.CVE-2022-41513 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /diagnostic/edittest.php.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022An arbitrary file upload vulnerability in the component /php_action/editFile.php of Online Diagnostic Lab Management System v1.0 allows attackers to execute arbCVE-2022-41512 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
An arbitrary file upload vulnerability in the component /php_action/editFile.php of Online Diagnostic Lab Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the ip parameter in the setDiagnosisCfg function.CVE-2022-41526 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the ip parameter in the setDiagnosisCfg function.
- Product
- Nr1800x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbrief-nymphea-813.notion.sitebrief-nymphea-813.notion.site
Sep 15, 2022TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setdiagnosicfg function.CVE-2022-38534 · Other software · Totolink · reported by MITREHigh 7.2
TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setdiagnosicfg function.
- Product
- A720r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the condition is met, setnumCVE-2022-37130 · Other software · Dlink · reported by MITRECritical 9.8
In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the condition is met, setnum will be spliced into v10 by snprintf, and the system will be executed, resulting in a command injection vulnerability
- Product
- Dir-816 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2022An issue was discovered in Online Diagnostic Lab Management System 1.0, There is a SQL injection vulnerability via "dob" parameter in "/classes/Users.php?f=saveCVE-2022-37152 · Other software · Online Diagnostic Lab Management System Project · reported by MITRECritical 9.8
An issue was discovered in Online Diagnostic Lab Management System 1.0, There is a SQL injection vulnerability via "dob" parameter in "/classes/Users.php?f=save_client"
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Aug 26, 2022There is an unauthorized access vulnerability in Online Diagnostic Lab Management System 1.0.CVE-2022-37151 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.5
There is an unauthorized access vulnerability in Online Diagnostic Lab Management System 1.0.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Aug 26, 2022An issue was discovered in Online Diagnostic Lab Management System 1.0.CVE-2022-37150 · Other software · Online Diagnostic Lab Management System Project · reported by MITREMedium 5.4
An issue was discovered in Online Diagnostic Lab Management System 1.0. There is a stored XSS vulnerability via firstname, address, middlename, lastname , gender, email, contact parameters.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Aug 25, 2022TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the ip parameter at the function setDiagnosisCfg.CVE-2022-37083 · Other software · Totolink · reported by MITREHigh 7.8
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the ip parameter at the function setDiagnosisCfg.
- Product
- A7000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ip parameter in the function setDiagnosisCfg.CVE-2022-37075 · Other software · Totolink · reported by MITREHigh 7.8
TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ip parameter in the function setDiagnosisCfg.
- Product
- A7000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a stack overflow via the function setDiagnosisCfg.CVE-2022-36484 · Other software · Totolink · reported by MITREHigh 7.8
TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a stack overflow via the function setDiagnosisCfg.
- Product
- N350rt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the ip parameter in the function setDiagnosisCfg.CVE-2022-36481 · Other software · Totolink · reported by MITREHigh 7.8
TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the ip parameter in the function setDiagnosisCfg.
- Product
- N350rt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a stack overflow via the ip parameter in the function setDiagnosisCfg.CVE-2022-36466 · Other software · Totolink · reported by MITREHigh 7.8
TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a stack overflow via the ip parameter in the function setDiagnosisCfg.
- Product
- A3700r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2022Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityCVE-2022-34713 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.
- Product
- Windows
- On CISA’s list since
- Aug 9, 2022 (federal fix deadline Aug 30, 2022)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.commsrc.microsoft.com
Jul 26, 2022Use after free in Web UI Diagnostics in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UCVE-2022-1641 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Web UI Diagnostics in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interaction.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Jul 19, 2022Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics).CVE-2022-21566 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.9-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- Product
- Applications Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2022Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function.CVE-2022-33098 · Other software · Magnolia-cms · reported by MITREMedium 6.1
Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted SVG document, with JavaScript, for a profile picture.
- Product
- Magnolia CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdocs.magnolia-cms.com
Jun 23, 2022The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 and earlier was found to be vulnerable to command injection through its diagnostics web interCVE-2022-32534 · Other software · Bosch · reported by psirt@bosch.comHigh 8.8
The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 and earlier was found to be vulnerable to command injection through its diagnostics web interface. This allows execution of shell commands.
- Product
- PRA-ES8P2S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jun 16, 2022An issue in dlt_config_file_parser.c of dlt-daemon v2.18.8 allows attackers to cause a double free via crafted TCP packets.CVE-2022-31291 · Other software · Genivi · reported by MITREHigh 7.5
An issue in dlt_config_file_parser.c of dlt-daemon v2.18.8 allows attackers to cause a double free via crafted TCP packets.
- Product
- Diagnostic LOG And Trace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jun 2, 2022TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to contrCVE-2021-42875 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to control the ipDoamin.
- Product
- Ex1200t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtotolink.netgithub.com
Jun 1, 2022Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityCVE-2022-30190 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
- Product
- Windows
- On CISA’s list since
- Jun 14, 2022 (federal fix deadline Jul 5, 2022)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.compacketstormsecurity.com
May 10, 2022TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the ipdoamin parameter in /setting/setDiagnosisCfg.CVE-2022-28908 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the ipdoamin parameter in /setting/setDiagnosisCfg.
- Product
- N600r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path inCVE-2022-27657 · Network & remote access · SAP SE · reported by cna@sap.comLow 2.7
A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path information in SAP Focused Run (Simple Diagnostics Agent 1.0) - version 1.0.
- Product
- SAP Focused Run (Simple Diagnostics Agent)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 10, 2022Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages.CVE-2022-25922 · Other software · Power Line Communications · reported by ics-cert@hq.dhs.govMedium 6.1
Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is no authentication or authorization for these functions.
- Product
- PLC4TRUCKS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhosCVE-2022-24396 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhost on http port 3005. Due to lack of authentication checks, an attacker could access administrative or other privileged functionalities and read, modify, or delete sensitive information and configurations.
- Product
- SAP Focused Run (Simple Diagnostics Agent)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 10, 2022The System Diagnosis service of MyASUS before 3.1.2.0 allows privilege escalation.CVE-2022-22814 · Network & remote access · Asus · reported by MITRECritical 9.8
The System Diagnosis service of MyASUS before 3.1.2.0 allows privilege escalation.
- Product
- Myasus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted via a random port 90CVE-2022-22547 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.5
Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted via a random port 9000-65535. This allows information gathering which could be used exploit future open-source security exploits.
- Product
- Simple Diagnostics Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 10, 2022It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDiagnosticServlet has directory traversal vulnerability at the "/api/apCVE-2021-42853 · Other software · Aternity · reported by cve_disclosure@tech.gov.sgCritical 9.1
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDiagnosticServlet has directory traversal vulnerability at the "/api/appInternals/1.0/agent/diagnostic/logs" API. The affected endpoint does not have any input validation of the user's input that allows a malicious payload to be injected.
- Product
- SteelCentral AppInternals Dynamic Sampling Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaternity.force.comaternity.force.com
Feb 11, 2022An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSRFCVE-2021-46366 · Other software · Magnolia-cms · reported by MITREHigh 8.8
An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSRF) in order to brute force and exfiltrate users' credentials.
- Product
- Magnolia CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.magnolia-cms.comgithub.com
Feb 11, 2022An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file.CVE-2021-46365 · Other software · Magnolia-cms · reported by MITREHigh 7.8
An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file.
- Product
- Magnolia CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.magnolia-cms.comgithub.com
Feb 11, 2022A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file.CVE-2021-46364 · Other software · Magnolia-cms · reported by MITREHigh 7.8
A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file.
- Product
- Magnolia CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.magnolia-cms.comgithub.com
Feb 11, 2022An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files.CVE-2021-46363 · Other software · Magnolia-cms · reported by MITREHigh 7.8
An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported files with Microsoft Excel.
- Product
- Magnolia CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.magnolia-cms.comgithub.com
Feb 11, 2022A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute CVE-2021-46362 · Other software · Magnolia-cms · reported by MITRECritical 9.8
A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter.
- Product
- Magnolia CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.magnolia-cms.comgithub.com
Feb 11, 2022An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeCVE-2021-46361 · Other software · Magnolia-cms · reported by MITRECritical 9.8
An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload.
- Product
- Magnolia CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.magnolia-cms.comgithub.com
Feb 9, 2022Solution Manager (Diagnostics Root Cause Analysis Tools) - version 720, allows an administrator to execute code on all connected Diagnostics Agents and browse fCVE-2022-22544 · Network & remote access · SAP SE · reported by cna@sap.comCritical 9.1
Solution Manager (Diagnostics Root Cause Analysis Tools) - version 720, allows an administrator to execute code on all connected Diagnostics Agents and browse files on their systems. An attacker could thereby control the managed systems. It is considered that this is a missing segregation of duty for the SAP Solution Manager administrator. Impacts of unauthorized execution of commands can lead to sensitive information disclosure, loss of system integrity and denial of service.
- Product
- SAP Solution Manager (Diagnostics Root Cause Analysis Tools)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jan 27, 2022Single Connect does not perform an authorization check when using the "sc-diagnostic-ui" module.CVE-2021-44794 · Other software · Kron · reported by iletisim@usom.gov.trMedium 5.3
Single Connect does not perform an authorization check when using the "sc-diagnostic-ui" module. A remote attacker could exploit this vulnerability to access the device information page. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information.
- Product
- Single Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jan 11, 2022Remote Desktop Licensing Diagnoser Information Disclosure VulnerabilityCVE-2022-21964 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 11, 2022Microsoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege VulnerabilityCVE-2022-21871 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Microsoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Dec 22, 2021An OS command injection vulnerability exists in the Web Manager Diagnostics: Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4.CVE-2021-21883 · Other software · Lantronix · reported by talos-cna@cisco.comCritical 9.9
An OS command injection vulnerability exists in the Web Manager Diagnostics: Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- Product
- Premierwave 2050 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Dec 22, 2021An OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix PremierWave 2050 8.9.0.0R4.CVE-2021-21872 · Other software · Lantronix · reported by talos-cna@cisco.comCritical 9.9
An OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- Product
- Premierwave 2050 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Nov 30, 2021IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics.CVE-2021-39000 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics. IBM X-Force ID: 213215.
- Product
- MQ Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.