Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,626 results · page 76 of 93
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29202 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.ragged.constant` does not fully validate the input arguments. This results in a denial of service by consuming all available memory. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29201 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.QuantizedConv2D` does not fully validate the input arguments. In this case, references get bound to `nullptr` for each argument that is empty. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29207 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid. In graph mode, it would have been impossible to perform these API calls, but migration to TF 2.x eager mode opened up this vulnerability. If the resource handle is empty, then a reference is bound to a null pointer inside TensorFlow codebase (various codepaths). This is undefined behavior. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29200 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LSTMBlockCell` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code does not validate the ranks of any of the arguments to this API call. This results in `CHECK`-failures when the elements of the tensor are accessed. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29199 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LoadAndRemapMatrix does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `initializing_values` is a vector but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29198 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SparseTensorToCSRSparseMatrix` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `dense_shape` is a vector and `indices` is a matrix (as part of requirements for sparse tensors) but there is no validation for this. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29197 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegmentJoin` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `num_segments` is a scalar but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29196 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.Conv3DBackpropFilterV2` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code does not validate that the `filter_sizes` argument is a vector. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29195 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.StagePeek` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `index` is a scalar but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29193 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.TensorSummaryV2` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29194 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.DeleteSessionTensor` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29192 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.QuantizeAndDequantizeV4Grad` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29191 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.GetSessionTensor` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Rundeck is an open source automation service with a web console, command line tools and a WebAPI.CVE-2022-29186 · Other software · rundeck · reported by GitHubCritical 9.1
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the id_rsa.pub public key of the keypair was copied to authorized_keys files on remote host, those hosts would allow access to anyone with the exposed private credentials. This misconfiguration only impacts Rundeck Docker instances of PagerDuty® Process Automation On Prem (formerly Rundeck) version 4.0 and earlier, not Debian, RPM or .WAR. Additionally, the id_rsa.pub file would have to be copied from the Docker image filesystem contents without overwriting it and used to configure SSH access on a host. A patch on Rundeck's `main` branch has removed the pre-generated SSH key pair, but it does not remove exposed keys that have been configured. To patch, users must run a script on hosts in their environment to search for exposed keys and rotate them. Two workarounds are available: Do not use any pre-existing public key file from the rundeck docker images to allow SSH access by adding it to authorized_keys files and, if you have copied the public key file included in the docker image, remove i
- Product
- rundeck
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Nokogiri is an open source XML and HTML library for Ruby.CVE-2022-29181 · Other software · sparklemotion · reported by GitHubHigh 8.2
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.
- Product
- nokogiri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads.CVE-2022-29179 · Other software · cilium · reported by GitHubHigh 7.5
Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Prior to versions 1.9.16, 1.10.11, and 1.11.15, if an attacker is able to perform a container escape of a container running as root on a host where Cilium is installed, the attacker can escalate privileges to cluster admin by using Cilium's Kubernetes service account. The problem has been fixed and the patch is available in versions 1.9.16, 1.10.11, and 1.11.5. There are no known workarounds available.
- Product
- cilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads.CVE-2022-29178 · Other software · cilium · reported by GitHubHigh 8.8
Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Cilium prior to versions 1.9.16, 1.10.11, and 1.11.15 contains an incorrect default permissions vulnerability. Operating Systems with users belonging to the group ID 1000 can access the API of Cilium via Unix domain socket available on the host where Cilium is running. This could allow malicious users to compromise integrity as well as system availability on that host. The problem has been fixed and the patch is available in versions 1.9.16, 1.10.11, and 1.11.5. A potential workaround is to modify Cilium's DaemonSet to run with a certain command, which can be found in the GitHub Security Advisory for this vulnerability.
- Product
- cilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM).CVE-2022-24831 · Other software · OpenClinica · reported by GitHubHigh 8.3
OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). Versions prior to 3.16.1 are vulnerable to SQL injection due to the use of string concatenation to create SQL queries instead of prepared statements. No known workarounds exist. This issue has been patched in 3.16.1, 3.15.9, 3.14.1, and 3.13.1 and users are advised to upgrade.
- Product
- OpenClinica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM).CVE-2022-24830 · Other software · OpenClinica · reported by GitHubMedium 6.5
OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). OpenClinica prior to version 3.16 is vulnerable to path traversal in multiple endpoints, leading to arbitrary file read/write, and potential remote code execution. There are no known workarounds. This issue has been patched and users are recommended to upgrade.
- Product
- OpenClinica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.CVE-2022-29164 · Other software · argoproj · reported by GitHubHigh 7.1
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker emails the deep-link to the artifact to their victim. The victim opens the link, the script starts running. As the script has access to the Argo Server API (as the victim), so may read information about the victim’s workflows, or create and delete workflows. Note the attacker must be an insider: they must have access to the same cluster as the victim and must already be able to run their own workflows. The attacker must have an understanding of the victim’s system. We have seen no evidence of this in the wild. We urge all users to upgrade to the fixed versions.
- Product
- argo-workflows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications.CVE-2022-24899 · Other software · contao · reported by GitHubHigh 7.2
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Shopware is an open source e-commerce software platform.CVE-2022-24892 · Other software · shopware · reported by GitHubMedium 6.4
Shopware is an open source e-commerce software platform. Starting with version 5.0.4 and before version 5.7.9, multiple tokens for password reset can be requested. All tokens can be used to change the password. This makes it possible for an attacker to take over the victim's account if they somehow gain access to the victims email account and find an unused password reset token in the emails. This issue is fixed in version 5.7.9.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Apr 28, 2022Shopware is an open source e-commerce software platform.CVE-2022-24879 · Other software · shopware · reported by GitHubHigh 7.5
Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery (CSRF) token validation. Under certain circumstances, the CSRF tokens were not generated anew and not validated correctly. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Apr 28, 2022Shopware is an open source e-commerce software platform.CVE-2022-24873 · Other software · shopware · reported by GitHubMedium 5.4
Shopware is an open source e-commerce software platform. Prior to version 5.7.9, Shopware is vulnerable to non-stored cross-site scripting in the storefront. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Apr 27, 2022ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library.CVE-2022-24891 · Other software · ESAPI · reported by GitHubMedium 5.4
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause "javascript:" URLs to fail to be correctly sanitized. This issue is patched in ESAPI 2.3.0.0. As a workaround, manually edit the **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression. More information about remediation of the vulnerability, including the workaround, is available in the maintainers' release notes and security bulletin.
- Product
- esapi-java-legacy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2022ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library.CVE-2022-23457 · Other software · OWASP ESAPI · reported by GitHubHigh 7.5
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.
- Product
- org.owasp.esapi:esapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2022PJSIP is a free and open source multimedia communication library written in C.CVE-2022-24792 · Other software · pjsip · reported by GitHubHigh 7.5
PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects applications on a 32-bit systems that use PJSIP versions 2.12 and prior to play/read invalid WAV files. The vulnerability occurs when reading WAV file data chunks with length greater than 31-bit integers. The vulnerability does not affect 64-bit apps and should not affect apps that only plays trusted WAV files. A patch is available on the `master` branch of the `pjsip/project` GitHub repository. As a workaround, apps can reject a WAV file received from an unknown source or validate the file first.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022The CVEProject/cve-services is an open source project used to operate the CVE services api.CVE-2022-24875 · Other software · CVEProject · reported by GitHubMedium 5.3
The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code would erroneously log user secrets. This has been resolved in commit `46d98f2b` and should be available in subsequent versions of the software. Users of the software are advised to manually apply the `46d98f2b` commit or to update when a new version becomes available. As a workaround users should inspect their logs and remove logged secrets as appropriate.
- Product
- cve-services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2022HumHub is an Open Source Enterprise Social Network.CVE-2022-24865 · Other software · humhub · reported by GitHubMedium 6.5
HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other users' data. This issue has been resolved by commit `eb83de20`. It is recommended that the HumHub is upgraded to 1.11.0, 1.10.4 or 1.9.4. There are no known workarounds for this issue.
- Product
- humhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2022fleetdm/fleet is an open source device management, built on osquery.CVE-2022-24841 · Other software · fleetdm · reported by GitHubMedium 6.5
fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by this authorization bypass issue. Fleet instances without teams, or with teams but without restricted team accounts are not affected. In affected versions a team admin can erroneously add themselves as admin, maintainer or observer on other teams. Users are advised to upgrade to version 4.13. There are no known workarounds for this issue.
- Product
- fleet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2022http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0.CVE-2022-24863 · Other software · swaggo · reported by GitHubHigh 7.5
http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the "GET" method as a workaround.
- Product
- http-swagger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2022PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files.CVE-2022-24859 · Other software · py-pdf · reported by GitHubMedium 6.2
PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.
- Product
- PyPDF2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory.CVE-2022-24851 · Other software · LDAPAccountManager · reported by GitHubHigh 8.1
LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an edit profile functionality, the parameters on this page are not properly sanitized and hence leads to stored XSS attacks. An authenticated user can store XSS payloads in the profiles, which gets triggered when any other user try to access the edit profile page. The pdf editor tool has an edit pdf profile functionality, the logoFile parameter in it is not properly sanitized and an user can enter relative paths like ../../../../../../../../../../../../../usr/share/icons/hicolor/48x48/apps/gvim.png via tools like burpsuite. Later when a pdf is exported using the edited profile the pdf icon has the image on that path(if image is present). Both issues require an attacker to be able to login to LAM admin interface. The issue is fixed in version 7.9.1.
- Product
- lam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022Metabase is an open source business intelligence and analytics application.CVE-2022-24855 · Other software · metabase · reported by GitHubHigh 8.7
Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_internal` that can allow for cross site scripting (XSS) attacks, potentially leading to phishing attempts with malicious links that could lead to account takeover. Users are advised to either upgrade immediately, or block access in your firewall to `/_internal` endpoints for Metabase. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.
- Product
- metabase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022Metabase is an open source business intelligence and analytics application.CVE-2022-24854 · Other software · metabase · reported by GitHubHigh 8
Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach this database to a second database, and then it can query across all the tables. To be able to do that the attacker also needs to know the file path to the second database. Users are advised to upgrade as soon as possible. If you're unable to upgrade, you can modify your SQLIte connection strings to contain the url argument `?limit_attached=0`, which will disallow making connections to other SQLite databases. Only users making use of SQLite are affected.
- Product
- metabase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022Metabase is an open source business intelligence and analytics application.CVE-2022-24853 · Other software · metabase · reported by GitHubMedium 5.9
Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result in file access on windows, which allows enabling an `NTLM relay attack`, potentially allowing an attacker to receive the system password hash. If you use Windows and are on this version of Metabase, please upgrade immediately. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.
- Product
- metabase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022Discourse is an open source platform for community discussion.CVE-2022-24850 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has access to the category. As a result, a normal user is able to see whether a group has read/write permissions in the category even though the information should only be available to the users that can manage a category. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. There are no workarounds for this problem.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022Discourse is an open source platform for community discussion.CVE-2022-24824 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown the crawler view of the site instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. There are no known workarounds for this issue.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022A vulnerability in the encryption implementation of EBICS messages in the open source librairy ebics-java/ebics-java-client allows an attacker sniffing network CVE-2022-1279 · Other software · ebics-java · reported by vulnerability@ncsc.chMedium 6.5
A vulnerability in the encryption implementation of EBICS messages in the open source librairy ebics-java/ebics-java-client allows an attacker sniffing network traffic to decrypt EBICS payloads. This issue affects: ebics-java/ebics-java-client versions prior to 1.2.
- Product
- ebics-java-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.CVE-2022-24847 · Other software · geoserver · reported by GitHubHigh 7.2
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can happen while configuring data stores with data sources located in JNDI, or while setting up the disk quota mechanism. In order to perform any of the above changes, the attack needs to have obtained admin rights and use either the GeoServer GUI, or its REST API. The lookups are going to be restricted in GeoServer 2.21.0, 2.20.4, 1.19.6. Users unable to upgrade should restrict access to the `geoserver/web` and `geoserver/rest` via a firewall and ensure that the GeoWebCache is not remotely accessible.
- Product
- geoserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022GeoTools is an open source Java library that provides tools for geospatial data.CVE-2022-24818 · Other software · geotools · reported by GitHubHigh 8.2
GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. Similar to the Log4J case, the vulnerability can be triggered if the JNDI names are user-provided, but requires admin-level login to be triggered. The lookups are now restricted in GeoTools 26.4, GeoTools 25.6, and GeoTools 24.6. Users unable to upgrade should ensure that any downstream application should not allow usage of remotely provided JNDI strings.
- Product
- geotools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022Nokogiri is an open source XML and HTML library for Ruby.CVE-2022-24836 · Other software · sparklemotion · reported by GitHubHigh 7.5
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.
- Product
- nokogiri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Apr 11, 2022PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data.CVE-2022-24833 · Other software · PrivateBin · reported by GitHubHigh 8.2
PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin < v1.4.0 a cross-site scripting (XSS) vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called ZeroBin. The issue is caused by the fact that SVGs can contain JavaScript. This can allow an attacker to execute code, if the user opens a paste with a specifically crafted SVG attachment, and interacts with the preview image and the instance isn't protected by an appropriate content security policy. Users are advised to either upgrade to version 1.4.0 or to ensure the content security policy of their instance is set correctly.
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022GoCD is an open source a continuous delivery server.CVE-2022-24832 · Other software · gocd · reported by GitHubHigh 8.2
GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it can allow an existing LDAP-authenticated GoCD user with malicious intent to construct and execute malicious queries, allowing them to deduce facts about other users or entries within the LDAP database (e.g alternate fields, usernames, hashed passwords etc) through brute force mechanisms. This only affects users who have a working LDAP authorization configuration enabled on their GoCD server, and only is exploitable by users authenticating using such an LDAP configuration. This issue has been fixed in GoCD 22.1.0, which is bundled with gocd-ldap-authentication-plugin v2.2.0-144.
- Product
- gocd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.gocd.orggithub.com
Apr 11, 2022Discourse is an open source platform for community discussion.CVE-2022-24804 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups. When a group with restricted visibility has been used to set the permissions of a category, the name of the group is leaked to any user that is able to see the category. To workaround the problem, a site administrator can remove groups with restricted visibility from any category's permissions setting.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2022PJSIP is a free and open source multimedia communication library written in C.CVE-2022-24793 · Other software · pjsip · reported by GitHubHigh 7.5
PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications that use PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver. This vulnerability is related to CVE-2023-27585. The difference is that this issue is in parsing the query record `parse_rr()`, while the issue in CVE-2023-27585 is in `parse_query()`. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver instead.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2022PJSIP is a free and open source multimedia communication library written in C.CVE-2022-24786 · Other software · pjsip · reported by GitHubCritical 9.8
PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2022PJSIP is a free and open source multimedia communication library written in the C language.CVE-2022-24763 · Other software · pjsip · reported by GitHubHigh 7.5
PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update. There are no known workarounds.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2022Discourse is an open source discussion platform.CVE-2022-24782 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior in the `beta` branch, and 2.9.0.beta3 and prior in the `tests-passed` branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to category settings, they may have category membership for a secure category. The name of this secure category is shown to the user in the export. The same thing occurs when the user's post has been moved to a secure category. A patch for this issue is available in the `main` branch of Discourse's GitHub repository and is anticipated to be part of future releases.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2022PJSIP is a free and open source multimedia communication library written in C.CVE-2022-24764 · Other software · pjsip · reported by GitHubHigh 7.5
PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.