Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,372 results · page 73 of 148
Jul 6, 2023A misconfiguration vulnerability exists in the urvpn_client functionality of Milesight UR32L v32.3.0.5.CVE-2023-23546 · Other software · Milesight · reported by talos-cna@cisco.comMedium 4.2
A misconfiguration vulnerability exists in the urvpn_client functionality of Milesight UR32L v32.3.0.5. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
- Product
- UR32L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 4, 2023Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client.CVE-2023-21639 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 30, 2023Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administratiCVE-2023-32612 · Other software · WAVLINK TECHNOLOGY Ltd. · reported by vultures@jpcert.or.jpHigh 7.2
Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with the root privilege.
- Product
- WL-WN531AX2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2023Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.CVE-2023-36539 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 5.3
Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.
- Product
- Zoom clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jun 28, 2023In executeSetClientTarget of ComposerCommandEngine.h, there is a possible out of bounds read due to a missing bounds check.CVE-2023-21170 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In executeSetClientTarget of ComposerCommandEngine.h, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-252764410
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 28, 2023A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, having any level of acceCVE-2023-2625 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comCritical 9
A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, having any level of access VIEWER to ADMIN. To exploit the vulnerability the attacker can inject shell commands through a particular field of the web user interface that will be executed by the system.
- Product
- TXpert Hub CoreTec 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jun 28, 2023A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could CVE-2023-20178 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.8
A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established. This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process. A successful exploit could allow the attacker to execute code with SYSTEM privileges.
- Product
- Cisco Secure Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Jun 27, 2023Catalyst Connect Zoho CRM Client Portal: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2023-0588 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin.
- Product
- Catalyst Connect Zoho CRM Client Portal
- Fixed in
- 2.1.0
- What to do
- Update Catalyst Connect Zoho CRM Client Portal to 2.1.0 or newer.
Jun 23, 2023Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side.CVE-2023-35173 · Other software · nextcloud · reported by GitHubMedium 5.7
Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side. By providing an invalid meta data file, an attacker can make previously dropped files inaccessible. It is recommended that the Nextcloud End-to-end encryption app is upgraded to version 1.12.4 that contains the fix.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2023Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.CVE-2023-34462 · Other software · netty · reported by GitHubMedium 6.5
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the `SniHandler` to allocate 16MB of heap. The `SniHandler` class is a handler that waits for the TLS handshake to configure a `SslHandler` according to the indicated server name by the `ClientHello` record. For this matter it allocates a `ByteBuf` using the value defined in the `ClientHello` record. Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the `SslClientHelloHandler`. This vulnerability has been fixed in version 4.1.94.Final.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2023Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials.CVE-2023-28094 · Other software · Pegasystems · reported by security@pega.comHigh 8.1
Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials.
- Product
- Pega Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Jun 22, 2023When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login.CVE-2023-28800 · Other software · Zscaler · reported by cve@zscaler.comHigh 8.1
When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Jun 22, 2023A URL parameter during login flow was vulnerable to injection.CVE-2023-28799 · Other software · Zscaler · reported by cve@zscaler.comHigh 8.2
A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would redirect the user after auth and send the authorization token to the redirected domain.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Jun 21, 2023IBM Spectrum Protect Backup-Archive Client 8.1.0.0 through 8.1.17.2 may allow a local user to escalate their privileges due to improper access controls.CVE-2023-28956 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.4
IBM Spectrum Protect Backup-Archive Client 8.1.0.0 through 8.1.17.2 may allow a local user to escalate their privileges due to improper access controls.
- Product
- Spectrum Protect Backup-Archive Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Jun 21, 2023If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequencCVE-2023-2911 · Other software · ISC · reported by security-officer@isc.orgHigh 7.5
If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
- Product
- BIND 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comkb.isc.org
Jun 20, 2023Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access contCVE-2023-1862 · Other software · Cloudflare · reported by cna@cloudflare.comHigh 7.3
Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access control policy on an IPC Named Pipe. This would have enabled an attacker to trigger WARP connect and disconnect commands, as well as obtaining network diagnostics and application configuration from the target's device. It is important to note that in order to exploit this, a set of requirements would need to be met, such as the target's device must've been reachable on port 445, allowed authentication with NULL sessions or otherwise having knowledge of the target's credentials.
- Product
- WARP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevelopers.cloudflare.comgithub.com
Jun 19, 2023A buffer overflow in Nintendo Mario Kart Wii RMCP01, RMCE01, RMCJ01, and RMCK01 can be exploited by a game client to execute arbitrary code on a client's machinCVE-2023-35856 · Other software · Nintendo · reported by MITRECritical 9.8
A buffer overflow in Nintendo Mario Kart Wii RMCP01, RMCE01, RMCJ01, and RMCK01 can be exploited by a game client to execute arbitrary code on a client's machine via a crafted packet.
- Product
- Mario Kart WII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2023A buffer overflow in Counter-Strike through 8684 allows a game server to execute arbitrary code on a remote client's machine by modifying the lservercfgfile conCVE-2023-35855 · Other software · Valvesoftware · reported by MITRECritical 9.8
A buffer overflow in Counter-Strike through 8684 allows a game server to execute arbitrary code on a remote client's machine by modifying the lservercfgfile console variable.
- Product
- Counter-strike
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2023An issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ.CVE-2023-35789 · Other software · Rabbitmq-c Project · reported by MITREMedium 5.5
An issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line (e.g., for amqp-publish or amqp-consume) and are thus visible to local attackers by listing a process and its arguments.
- Product
- Rabbitmq-c
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2023The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for CVE-2022-4149 · Other software · Netskope · reported by psirt@netskope.comHigh 7
The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for a standard user. The files are created and written with a SYSTEM account except one file (logplaceholder) which inherits permission giving all users full access control list. Netskope client restricts access to this file by allowing only read permissions as a standard user. Whenever the Netskope client service restarts, it deletes the logplaceholder and recreates, creating a race condition, which can be exploited by a malicious local user to create the file and set ACL permissions on the file. Once the file is created by a malicious user with proper ACL permissions, all files within C:\Users\Public\netSkope\ becomes modifiable by the unprivileged user. By using Windows pseudo-symlink, these files can be pointed to other places in the system and thus malicious users will be able to elevate privileges.
- Product
- Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetskope.comnetskope.com
Jun 15, 2023The Netskope client service running with NT\SYSTEM privileges accepts network connections from localhost to start various services and execute commands.CVE-2023-2270 · Other software · Netskope · reported by psirt@netskope.comHigh 7
The Netskope client service running with NT\SYSTEM privileges accepts network connections from localhost to start various services and execute commands. The connection handling function of Netskope client before R100 in this service utilized a relative path to download and unzip configuration files on the machine. This relative path provided a way for local users to write arbitrary files at a location which is accessible to only higher privileged users. This can be exploited by local users to execute code with NT\SYSTEM privileges on the end machine.
- Product
- Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetskope.comnetskope.com
Jun 14, 2023NuGet Client Remote Code Execution VulnerabilityCVE-2023-29337 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
NuGet Client Remote Code Execution Vulnerability
- Product
- NuGet 6.2.3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 13, 2023Remote Desktop Client Remote Code Execution VulnerabilityCVE-2023-29362 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Desktop Client Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 13, 2023Exposure of resource to wrong sphere in Zoom for Windows and Zoom for MacOS clients before 5.14.10 may allow an authenticated user to potentially enable informCVE-2023-34114 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.4
Exposure of resource to wrong sphere in Zoom for Windows and Zoom for MacOS clients before 5.14.10 may allow an authenticated user to potentially enable information disclosure via network access.
- Product
- Zoom for Windows Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jun 13, 2023Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially CVE-2023-34121 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 4.1
Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via network access.
- Product
- Zoom for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jun 13, 2023Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an authenticated user to poCVE-2023-34120 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 8.7
Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via local access. Users may potentially utilize higher level system privileges maintained by the Zoom client to spawn processes with escalated privileges.
- Product
- Zoom for Windows Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jun 13, 2023Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability.CVE-2023-28603 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.7
Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions.
- Product
- Zoom VDI Windows Meeting Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jun 13, 2023Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability.CVE-2023-28602 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usLow 2.8
Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may potentially downgrade Zoom Client components to previous versions.
- Product
- Zoom for Windows Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jun 13, 2023Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability.CVE-2023-28601 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 8.3
Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability. A malicious user may alter protected Zoom Client memory buffer potentially causing integrity issues within the Zoom Client.
- Product
- Zoom for Windows Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jun 13, 2023Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability.CVE-2023-28600 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 5.2
Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. A malicious user may be able to delete/replace Zoom Client files potentially causing a loss of integrity and availability to the Zoom Client.
- Product
- Zoom for macOS Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jun 13, 2023Zoom clients prior to 5.13.10 contain an HTML injection vulnerability.CVE-2023-28599 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 4.3
Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their display name potentially leading a victim to a malicious website during meeting creation.
- Product
- Zoom for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jun 13, 2023Zoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability.CVE-2023-28598 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.5
Zoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could result in a Zoom application crash.
- Product
- Zoom for Linux clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jun 13, 2023An incorrect default permission [CWE-276] vulnerability in FortiClient (Windows) versions 7.0.0 through 7.0.6 and 6.4.0 through 6.4.8 and FortiConverter (WindowCVE-2022-33877 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7
An incorrect default permission [CWE-276] vulnerability in FortiClient (Windows) versions 7.0.0 through 7.0.6 and 6.4.0 through 6.4.8 and FortiConverter (Windows) versions 6.2.0 through 6.2.1, 7.0.0 and all versions of 6.0.0 may allow a local authenticated attacker to tamper with files in the installation folder, if FortiClient or FortiConverter is installed in an insecure folder.
- Product
- FortiConverter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Jun 9, 2023gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin`CVE-2023-32732 · Computers, phones & browsers · Google · reported by cve-coordination@google.comMedium 5.3
gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309 https://www.google.com/url
- Product
- gRPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Jun 6, 2023Memory corruption due to use after free in Core when multiple DCI clients register and deregister.CVE-2022-33263 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory corruption due to use after free in Core when multiple DCI clients register and deregister.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 6, 2023Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications.CVE-2022-33226 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
May 31, 2023 Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client.CVE-2023-25539 · Other software · Dell · reported by security_alert@emc.comHigh 8.4
Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. This is a high severity vulnerability as the exploitation allows an attacker to take complete control of a system, so Dell recommends customers to upgrade at the earliest opportunity.
- Product
- NetWorker NVE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023ROZCOM client CWE-798: Use of Hard-coded CredentialsCVE-2023-31184 · Other software · ROZCOM · reported by cna@cyber.gov.ilMedium 6.2
ROZCOM client CWE-798: Use of Hard-coded Credentials
- Product
- client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023A user can supply malicious HTML and JavaScript code that will be executed in the client browserCVE-2023-23956 · Other software · Broadcom · reported by secure@symantec.comMedium 5.4
A user can supply malicious HTML and JavaScript code that will be executed in the client browser
- Product
- Symantec Siteminder Webagent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsupport.broadcom.com
May 26, 2023A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memorCVE-2023-2283 · Other software · Libssh · reported by Red HatMedium 6.5
A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
- Product
- Libssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comaccess.redhat.com
May 25, 2023Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applicatioCVE-2023-2480 · Other software · M-Files · reported by security@m-files.comHigh 7.5
Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications
- Product
- M-Files Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordempower.m-files.comproduct.m-files.com
May 24, 2023The client in OpenText Archive Center Administration through 21.2 allows XXE attacks.CVE-2022-41221 · Other software · Opentext · reported by MITREHigh 7.1
The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client (Versions 16.2.3, 21.2, and older versions) could upload XML files to the application that it did not sufficiently validate. As a result, attackers could craft XML files that, when processed by the application, would cause a negative security impact such as data exfiltration or localized denial of service against the application instance and system of the user running it.
- Product
- Archive Center Administration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.withsecure.comlabs.withsecure.com
May 24, 2023The Introduction Client in Briar through 1.5.3 does not implement out-of-band verification for the public keys of introducees.CVE-2023-33983 · Other software · Briarproject · reported by MITREHigh 7.4
The Introduction Client in Briar through 1.5.3 does not implement out-of-band verification for the public keys of introducees. An introducer can launch man-in-the-middle attacks against later private communication between two introduced parties.
- Product
- Briar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where the affected product isCVE-2023-25953 · Other software · WORKS MOBILE Japan Corp. · reported by vultures@jpcert.or.jpCritical 9.8
Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where the affected product is installed to inject arbitrary code while processing the product execution. Since a full disk access privilege is required to execute LINE WORKS Drive Explorer, the attacker may be able to read and/or write to arbitrary files without the access privileges.
- Product
- Drive Explorer for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpline.worksmobile.com
May 22, 2023Client-side enforcement of server-side security issue exists in T&D Corporation and ESPEC MIC CORP.CVE-2023-22654 · Other software · T&D Corporation and ESPEC MIC CORP. · reported by vultures@jpcert.or.jpMedium 5.4
Client-side enforcement of server-side security issue exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may lead to an arbitrary script execution on a logged-in user's web browser. Affected products and versions are as follows: T&D Corporation data logger products (TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware versions, and WS-2 all firmware versions), and ESPEC MIC CORP. data logger products (RT-12N/RS-12N all firmware versions, RT-22BN all firmware versions, and TEU-12N all firmware versions).
- Product
- T&D Corporation and ESPEC MIC CORP. data logger products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmonitoring.especmic.co.jp
May 17, 2023react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP.CVE-2023-26044 · Other software · reactphp · reported by GitHubMedium 5.3
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. Previous versions of ReactPHP's HTTP server component contain a potential DoS vulnerability that can cause high CPU load when processing large HTTP request bodies. This vulnerability has little to no impact on the default configuration, but can be exploited when explicitly using the RequestBodyBufferMiddleware with very large settings. This might lead to consuming large amounts of CPU time for processing requests and significantly delay or slow down the processing of legitimate user requests. This issue has been addressed in release 1.9.0. Users are advised to upgrade. Users unable to upgrade may keep the request body limited using RequestBodyBufferMiddleware with a sensible value which should mitigate the issue. An infrastructure or DevOps workaround could be to place a reverse proxy in front of the ReactPHP HTTP server to filter out any excessive HTTP request bodies.
- Product
- http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023In davinci 0.3.0-rc after logging in, the user can connect to the mysql malicious server by controlling the data source to read arbitrary files on the client siCVE-2023-31847 · Other software · Davinci Project · reported by MITREMedium 6.5
In davinci 0.3.0-rc after logging in, the user can connect to the mysql malicious server by controlling the data source to read arbitrary files on the client side.
- Product
- Davinci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side.CVE-2023-29927 · Other software · Sage · reported by MITREMedium 4.3
Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users, particularly those on a workstation setup in the "Windows Peer-to-Peer Network" or "Client Server Network" Sage 300 configurations, could recover the SQL connection strings being used by Sage 300 and interact directly with the underlying database(s) to create, update, and delete all company records, bypassing the program’s role-based access controls.
- Product
- Sage 300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcontrolgap.comcontrolgap.com
May 16, 2023Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Synology Router ManagerCVE-2023-32955 · Network & remote access · Synology · reported by security@synology.comHigh 8.1
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows man-in-the-middle attackers to execute arbitrary commands via unspecified vectors.
- Product
- Synology Router Manager (SRM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
May 12, 2023Planet is software that provides satellite data.CVE-2023-32303 · Other software · planetlabs · reported by GitHubMedium 5.2
Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in version 2.0.1. As a workaround, set the secret file permissions to only user read/write by hand.
- Product
- planet-client-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.