Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,755 results · page 71 of 96
May 4, 2022Information Exposure Through Query Strings in GET Request vulnerability in LMM API of Secomea GateManager allows system administrator to hijack connection.CVE-2022-25787 · Other software · Secomea · reported by VulnerabilityReporting@secomea.comHigh 7.5
Information Exposure Through Query Strings in GET Request vulnerability in LMM API of Secomea GateManager allows system administrator to hijack connection. This issue affects: Secomea GateManager all versions prior to 9.7.
- Product
- GateManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecomea.comsecomea.com
May 4, 2022Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own scope.CVE-2022-25780 · Other software · Secomea · reported by VulnerabilityReporting@secomea.comMedium 4.3
Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own scope.
- Product
- GateManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecomea.comsecomea.com
May 3, 2022A bug exists where an attacker can read the kernel log through exposed Zircon kernel addresses without the required capability ZX_RSRC_KIND_ROOT.CVE-2022-0882 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 5.3
A bug exists where an attacker can read the kernel log through exposed Zircon kernel addresses without the required capability ZX_RSRC_KIND_ROOT. It is recommended to upgrade the Fuchsia kernel to 4.1.1 or greater.
- Product
- Fuchsia Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.fuchsia.devbugs.fuchsia.dev
May 2, 2022Import and export users and customers: Does not sanitise and escaped imported CSV dataCVE-2022-1255 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues
- Product
- Import and export users and customers
- Fixed in
- 1.19.2.1
- What to do
- Update Import and export users and customers to 1.19.2.1 or newer.
May 2, 2022Multiple Version of TRUMPF TruTops products expose a service function without necessary authentication.CVE-2022-1300 · Other software · TRUMPF · reported by info@cert.vde.comCritical 9.8
Multiple Version of TRUMPF TruTops products expose a service function without necessary authentication. Execution of this function may result in unauthorized access to change of data or disruption of the whole service.
- Product
- TruTops Boost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
May 1, 2022All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application.CVE-2022-23923 · Other software · Jailed Project · reported by report@snyk.ioHigh 8.6
All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. Exported methods are stored in the application.remote object.
- Product
- Jailed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2022PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure.CVE-2021-42001 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comHigh 8
PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capable of exploiting this vulnerability may be able to successfully complete an MFA challenge via OTP.
- Product
- PingID Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.compingidentity.com
Apr 29, 2022Linux distributions using CAP_SYS_NICE for gnome-shell may be exposed to a privilege escalation issue.CVE-2021-3982 · Other software · Gnome · reported by Red HatMedium 5.5
Linux distributions using CAP_SYS_NICE for gnome-shell may be exposed to a privilege escalation issue. An attacker, with low privilege permissions, may take advantage of the way CAP_SYS_NICE is currently implemented and eventually load code to increase its process scheduler priority leading to possible DoS of other services running in the same machine.
- Product
- Gnome-shell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.gnome.orggitlab.gnome.org
Apr 29, 2022A hardcoded cryptographic key in Automation360 22 allows an attacker to decrypt exported RPA packages.CVE-2022-29856 · Other software · Automationanywhere · reported by MITREHigh 7.5
A hardcoded cryptographic key in Automation360 22 allows an attacker to decrypt exported RPA packages.
- Product
- Automation 360
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddolosgroup.ioautomationanywhere.com
Apr 28, 2022A vulnerability in Zoom On-Premise Meeting Connector Controller version 4.8.102.20220310 and On-Premise Meeting Connector MMR version 4.8.102.20220310 exposes pCVE-2022-22783 · Other software · Zoom Video Communications Inc · reported by security@zoom.usMedium 6.5
A vulnerability in Zoom On-Premise Meeting Connector Controller version 4.8.102.20220310 and On-Premise Meeting Connector MMR version 4.8.102.20220310 exposes process memory fragments to connected clients, which could be observed by a passive attacker.
- Product
- Zoom On-Premise Meeting Connector Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Apr 28, 2022In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possibleCVE-2022-29820 · Other software · JetBrains · reported by cve@jetbrains.comLow 3
In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible
- Product
- PyCharm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Apr 27, 2022A vulnerability in SonicOS SNMP service resulting exposure of Wireless Access Point sensitive information in cleartext.CVE-2022-22277 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comMedium 5.3
A vulnerability in SonicOS SNMP service resulting exposure of Wireless Access Point sensitive information in cleartext.
- Product
- SonicOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.compsirt.global.sonicwall.com
Apr 27, 2022A vulnerability in SonicOS SNMP service resulting exposure of sensitive information to an unauthorized user.CVE-2022-22276 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comMedium 5.3
A vulnerability in SonicOS SNMP service resulting exposure of sensitive information to an unauthorized user.
- Product
- SonicOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.compsirt.global.sonicwall.com
Apr 27, 2022In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export.CVE-2021-34588 · Other software · Bender / ebee · reported by info@cert.vde.comHigh 8.6
In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. The key is set at user login. It is empty after reboot .
- Product
- CC612
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Apr 25, 2022myCred: Does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX actionCVE-2022-1092 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blog
- Product
- myCred
- Fixed in
- 2.4.3.1
- What to do
- Update myCred to 2.4.3.1 or newer.
Apr 25, 2022myCred: Does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX actionCVE-2022-0363 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.
- Product
- myCred
- Fixed in
- 2.4.3.1
- What to do
- Update myCred to 2.4.3.1 or newer.
Apr 21, 2022A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source.CVE-2022-23711 · Other software · Elastic · reported by security@elastic.coMedium 5.3
A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide a way to keep a pulse on the health and performance of your Elasticsearch cluster. Authentication with a vulnerable Kibana instance is not required to view the exposed information. The Elastic Stack monitoring exposure only impacts users that have set any of the optional monitoring.ui.elasticsearch.* settings in order to configure Kibana as a remote UI for Elastic Stack Monitoring. The same vulnerability in Kibana could expose other non-sensitive application-internal information in the page source.
- Product
- kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.codiscuss.elastic.co
Apr 20, 2022A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain access to the protected resource.CVE-2022-27179 · Other software · Red Lion · reported by ics-cert@hq.dhs.govMedium 4.6
A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain access to the protected resource. If the same passwords were used for other resources, further such assets may be compromised.
- Product
- DA50N
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2022Sensitive Information Exposure in E4J s.r.l.CVE-2022-27863 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Sensitive Information Exposure in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to get the booking data by guessing / brute-forcing easy predictable booking IDs via search POST requests.
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 19, 2022The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API routeCVE-2022-1186 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API route, in versions up to an including 1.1.5.
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 19, 2022Real-time image information exposure is caused by insufficient authentication for activated RTSP port.CVE-2021-26627 · Other software · EDrhyme Co.,Ltd · reported by vuln@krcert.or.krHigh 7.5
Real-time image information exposure is caused by insufficient authentication for activated RTSP port. This vulnerability could allow to remote attackers to send the RTSP requests using ffplay command and lead to leakage a live image.
- Product
- QCP 200W
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Apr 19, 2022Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used.CVE-2022-29315 · Other software · Invicti · reported by MITREHigh 8.8
Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used.
- Product
- Acunetix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthe-it-wonders.blogspot.comthe-it-wonders.blogspot.com
Apr 18, 2022A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data.CVE-2021-3503 · Other software · Redhat · reported by Red HatMedium 4.3
A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.
- Product
- Wildfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Apr 15, 2022Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5.CVE-2022-1365 · Other software · lquixada · reported by security@huntr.devMedium 6.5
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5.
- Product
- lquixada/cross-fetch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115CVE-2022-27849 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115
- Affected
- up to 20220115
- What to do
- Affects up to 20220115. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 13, 2022An out-of-bounds read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously craftedCVE-2022-27524 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.1
An out-of-bounds read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafted DWG file as an Input. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- DWG Trueview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Apr 13, 2022A buffer over-read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafted DWCVE-2022-27523 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.1
A buffer over-read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafted DWG file as an Input. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- DWG Trueview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Apr 12, 2022Visual Form Builder: Is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV fileCVE-2022-0142 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.
- Product
- Visual Form Builder
- Fixed in
- 3.0.8
- What to do
- Update Visual Form Builder to 3.0.8 or newer.
Full record and what to do →NVD recordwpscan.comfortiguard.com
Apr 12, 2022Visual Form Builder: Does not perform access control on entry form exportCVE-2022-0140 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.
- Product
- Visual Form Builder
- Fixed in
- 3.0.6
- What to do
- Update Visual Form Builder to 3.0.6 or newer.
Full record and what to do →NVD recordwpscan.comfortiguard.com
Apr 11, 2022Information exposure vulnerability in ril property setting prior to SMR April-2022 Release 1 allows access to EF_RUIMID value without permission.CVE-2022-27822 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.6
Information exposure vulnerability in ril property setting prior to SMR April-2022 Release 1 allows access to EF_RUIMID value without permission.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 11, 2022Information exposure vulnerability in Samsung DeX Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without CVE-2022-27576 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Information exposure vulnerability in Samsung DeX Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without permission
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 11, 2022Information exposure vulnerability in One UI Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without permiCVE-2022-27575 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Information exposure vulnerability in One UI Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without permission.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 11, 2022Export All URLs: Does not have CSRF in placeCVE-2022-0914 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages (including private and draft) into an arbitrary CSV file, which the attacker can then download and retrieve the list of titles for example
- Product
- Export All URLs
- Fixed in
- 4.3
- What to do
- Update Export All URLs to 4.3 or newer.
Apr 11, 2022Export All URLs: Does not sanitise and escape the CSV filename before outputting it back in the pageCVE-2022-0892 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Export All URLs
- Fixed in
- 4.2
- What to do
- Update Export All URLs to 4.2 or newer.
Apr 11, 2022settings of the iQ Block Country: Can be exported or imported using its backup functionalityCVE-2022-0246 · WordPress plugins & themes · reported by WPScanMedium 4.9
The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to "Zip Slip" vulnerability.
- Product
- settings of the iQ Block Country
- Fixed in
- 1.2.13
- What to do
- Update settings of the iQ Block Country to 1.2.13 or newer.
Apr 10, 2022XSS vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0.CVE-2022-1291 · Other software · hhurz · reported by security@huntr.devMedium 5.4
XSS vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. Transmitting cookies to third-party servers. Sending data from secure sessions to third-party servers
- Product
- hhurz/tableexport.jquery.plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2022Microprogram’s parking lot management system is vulnerable to sensitive information exposure.CVE-2022-25594 · Other software · Microprogram · reported by twcert@cert.org.twMedium 5.3
Microprogram’s parking lot management system is vulnerable to sensitive information exposure. An unauthorized remote attacker can input specific URLs to acquire partial system configuration information.
- Product
- parking lot management system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 6, 2022An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2.CVE-2021-43205 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 4.3
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2.9 and below may allow an unauthenticated attacker to access the confighandler webserver via external binaries.
- Product
- Fortinet FortiClientLinux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Apr 5, 2022An intent redirection issue was doscovered in Sina Weibo Android SDK 4.2.7 (com.sina.weibo.sdk.share.WbShareTransActivity), any unexported Activities could be sCVE-2020-23349 · Other software · Weibo · reported by MITREHigh 7.5
An intent redirection issue was doscovered in Sina Weibo Android SDK 4.2.7 (com.sina.weibo.sdk.share.WbShareTransActivity), any unexported Activities could be started by the com.sina.weibo.sdk.share.WbShareTransActivity.
- Product
- Android Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive iCVE-2022-1120 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.8
Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Softing OPC UA C++ SDK (Software Development Kit) versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, whicCVE-2021-32994 · Other software · Softing · reported by ics-cert@hq.dhs.govHigh 7.5
Softing OPC UA C++ SDK (Software Development Kit) versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, which may allow an attacker to crash the software by sending a variety of specially crafted packets to access several unexpected memory locations.
- Product
- OPC UA C++ SDK (Software Development Kit)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Booking Package: Requires a token for exporting the ical representation of it's booking calendarCVE-2022-0709 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.
- Product
- Booking Package
- Fixed in
- 1.5.29
- What to do
- Update Booking Package to 1.5.29 or newer.
Apr 4, 2022Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, thrCVE-2022-1026 · Other software · Kyocera · reported by cve@rapid7.comHigh 8.6
Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.
- Product
- Multifunction Printer Net Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkyoceradocumentsolutions.comrapid7.com
Apr 1, 2022The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of sCVE-2021-33018 · Other software · Philips · reported by ics-cert@hq.dhs.govHigh 7.5
The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of sensitive information.
- Product
- Vue PACS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability.CVE-2022-23158 · Other software · Dell · reported by security_alert@emc.comMedium 6
Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A local authenticated user with standard privilege could potentially exploit this vulnerability and provide incorrect port information and get connected to valid WMS server
- Product
- Dell Wyse Device Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability.CVE-2022-23157 · Other software · Dell · reported by security_alert@emc.comMedium 4.4
Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A authenticated malicious user could potentially exploit this vulnerability in order to view sensitive information from the WMS Server.
- Product
- Dell Wyse Device Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) toCVE-2022-21947 · Other software · SUSE · reported by meissner@suse.deHigh 8.3
A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V.
- Product
- Rancher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.combugzilla.suse.com
Mar 30, 2022In WindowManager, there is a possible way to start non-exported and protected activities due to a missing permission check.CVE-2021-39749 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In WindowManager, there is a possible way to start non-exported and protected activities due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-205996115
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 29, 2022Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerExport.ashx/Calendar.CVE-2022-26836 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9.8
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerExport.ashx/Calendar. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2022CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/article_db, via the fieldS[] and orderby paramCVE-2021-43701 · Other software · Cszcms · reported by MITREMedium 6.5
CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/article_db, via the fieldS[] and orderby parameters.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.