Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,626 results · page 77 of 93
Mar 17, 2022`gradio` is an open source framework for building interactive machine learning models and demos.CVE-2022-24770 · Other software · gradio-app · reported by GitHubHigh 8.8
`gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging functionality which saves input/output data into a CSV file on the developer's computer. This can allow a user to save arbitrary text into the CSV file, such as commands. If a program like MS Excel opens such a file, then it automatically runs these commands, which could lead to arbitrary commands running on the user's computer. The problem has been patched as of `2.8.11`, which escapes the saved csv with single quotes. As a workaround, avoid opening csv files generated by `gradio` with Excel or similar spreadsheet programs.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2022wire-server provides back end services for Wire, an open source messenger.CVE-2022-23610 · Other software · wireapp · reported by GitHubCritical 9.1
wire-server provides back end services for Wire, an open source messenger. In versions of wire-server prior to the 2022-01-27 release, it was possible to craft DSA Signatures to bypass SAML SSO and impersonate any Wire user with SAML credentials. In teams with SAML, but without SCIM, it was possible to create new accounts with fake SAML credentials. Under certain conditions that can be established by an attacker, an upstream library for parsing, rendering, signing, and validating SAML XML data was accepting public keys as trusted that were provided by the attacker in the signature. As a consequence, the attacker could login as any user in any Wire team with SAML SSO enabled. If SCIM was not enabled, the attacker could also create new users with new SAML NameIDs. In order to exploit this vulnerability, the attacker needs to know the SSO login code (distributed to all team members with SAML credentials and visible in the Team Management app), the SAML EntityID identifying the IdP (a URL not considered sensitive, but usually hard to guess, also visible in Team Management), and the SAML NameID of the user (usually an email address or a nick). The issue has been fixed in wire-server `20
- Product
- wire-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2022CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.CVE-2022-24729 · Other software · ckeditor · reported by GitHubMedium 6.5
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.
- Product
- ckeditor4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordckeditor.comgithub.com
Mar 16, 2022CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.CVE-2022-24728 · Other software · ckeditor · reported by GitHubMedium 5.4
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.
- Product
- ckeditor4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordckeditor.comgithub.com
Mar 16, 2022Zulip is an open source group chat application.CVE-2022-24751 · Other software · zulip · reported by GitHubMedium 5.4
Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow continued access by the deactivated user. A patch is available in version 4.11 on the 4.x branch and version 5.0-rc1 on the 5.x branch. Upgrading to a fixed version will, as a side effect, deactivate any cached sessions that may have been leaked through this bug. There are currently no known workarounds.
- Product
- zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Bareos is open source software for backup, archiving, and recovery of data for operating systems.CVE-2022-24756 · Other software · bareos · reported by GitHubHigh 7.5
Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, a failed PAM authentication will leak a small amount of memory. An attacker that is able to use the PAM Console (i.e. by knowing the shared secret or via the WebUI) can flood the Director with failing login attempts which will eventually lead to an out-of-memory condition in which the Director will not work anymore. Bareos Director versions 21.1.0, 20.0.6 and 19.2.12 contain a Bugfix for this problem. Users who are unable to upgrade may disable PAM authentication as a workaround.
- Product
- bareos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Bareos is open source software for backup, archiving, and recovery of data for operating systems.CVE-2022-24755 · Other software · bareos · reported by GitHubHigh 8.1
Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, it will skip authorization checks completely. Expired accounts and accounts with expired passwords can still login. This problem will affect users that have PAM enabled. Currently there is no authorization (e.g. check for expired or disabled accounts), but only plain authentication (i.e. check if username and password match). Bareos Director versions 21.1.0, 20.0.6 and 19.2.12 implement the authorization check that was previously missing. The only workaround is to make sure that authentication fails if the user is not authorized.
- Product
- bareos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Sylius is an open source eCommerce platform.CVE-2022-24749 · Other software · Sylius · reported by GitHubMedium 6.1
Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the IMG tag. The problem applies both to the files opened on the admin panel and shop pages. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. As a workaround, require a library that adds on-upload file sanitization and overwrite the service before writing the file to the filesystem. The GitHub Security Advisory contains more specific information about the workaround.
- Product
- Sylius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Sylius is an open source eCommerce platform.CVE-2022-24743 · Other software · Sylius · reported by GitHubHigh 7.1
Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue is fixed in versions 1.10.11 and 1.11.2. As a workaround, overwrite the `Sylius\Bundle\ApiBundle\CommandHandler\ResetPasswordHandler` class with code provided by the maintainers and register it in a container. More information about this workaround is available in the GitHub Security Advisory.
- Product
- Sylius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Sylius is an open source eCommerce platform.CVE-2022-24742 · Other software · Sylius · reported by GitHubMedium 5
Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect to login page even browser back button is pressed. Another possibility is to set more strict cache policies for restricted content.
- Product
- Sylius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Sylius is an open source eCommerce platform.CVE-2022-24733 · Other software · Sylius · reported by GitHubMedium 6.1
Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. Every response from app should have an X-Frame-Options header set to: ``sameorigin``. To achieve that, add a new `subscriber` in the app.
- Product
- Sylius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Parse Server is an open source http web server backend.CVE-2022-24760 · Other software · parse-community · reported by GitHubCritical 10
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows. Users are advised to upgrade as soon as possible. The only known workaround is to manually patch your installation with code referenced at the source GHSA-p6h4-93qp-jhcm.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022PJSIP is a free and open source multimedia communication library written in C language.CVE-2022-24754 · Other software · pjsip · reported by GitHubHigh 8.5
PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). This issue has been patched in the master branch of the PJSIP repository and will be included with the next release. Users unable to upgrade need to check that the hashed digest data length must be equal to `PJSIP_MD5STRLEN` before passing to PJSIP.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022UltraVNC is a free and open source remote pc access software.CVE-2022-24750 · Other software · ultravnc · reported by GitHubHigh 8.8
UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM plugin module, which allows a local authenticated user to achieve local privilege escalation (LPE) on a vulnerable system. The vulnerability has been fixed to allow loading of plugins from the installed directory. Affected users should upgrade their UltraVNC to 1.3.8.1. Users unable to upgrade should not install and run UltraVNC server as a service. It is advisable to create a scheduled task on a low privilege account to launch WinVNC.exe instead. There are no known workarounds if winvnc needs to be started as a service.
- Product
- UltraVNC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2022Nextcloud server is an open source, self hosted cloud style services platform.CVE-2022-24741 · Other software · nextcloud · reported by GitHubLow 3.5
Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading specially crafted files which will cause the server to allocate too much memory / CPU. It is recommended that the Nextcloud Server is upgraded to 21.0.8 , 22.2.4 or 23.0.1. Users unable to upgrade should disable preview generation with the `'enable_previews'` config flag.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2022MyBB is a free and open source forum software.CVE-2022-24734 · Other software · mybb · reported by GitHubHigh 7.2
MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed on on _Change Settings_ pages. This results in a Remote Code Execution (RCE) vulnerability. The vulnerable module requires Admin CP access with the `Can manage settings?` permission. MyBB's Settings module, which allows administrators to add, edit, and delete non-default settings, stores setting data in an options code string ($options_code; mybb_settings.optionscode database column) that identifies the setting type and its options, separated by a new line character (\n). In MyBB 1.2.0, support for setting type php was added, for which the remaining part of the options code is PHP code executed on Change Settings pages (reserved for plugins and internal use). MyBB 1.8.30 resolves this issue. There are no known workarounds.
- Product
- mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Mar 9, 2022Maddy Mail Server is an open source SMTP compatible email server.CVE-2022-24732 · Other software · foxcpp · reported by GitHubMedium 6.3
Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing filtering mechanisms.
- Product
- maddy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2022Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.CVE-2022-24716 · Other software · Icinga · reported by GitHubHigh 7.5
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
- Product
- icingaweb2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 8, 2022Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.CVE-2022-24715 · Other software · Icinga · reported by GitHubHigh 8.5
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2. Users unable to upgrade should limit access to the Icinga Web 2 configuration.
- Product
- icingaweb2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 8, 2022Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.CVE-2022-24714 · Other software · Icinga · reported by GitHubMedium 5.3
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may still have access to a collection of content. Note that this only applies if a role has implicitly permitted access to hosts, due to permitted access to at least one of their services. If access to a host is permitted by other means, no sensible information has been disclosed to unauthorized users. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2.
- Product
- icingaweb2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2022Zulip is an open source team chat app.CVE-2022-23656 · Other software · zulip · reported by GitHubMedium 4.6
Zulip is an open source team chat app. The `main` development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account and send messages to a topic with several participants; a victim who then opens an overflow tooltip including this full name on the recent topics page could trigger execution of JavaScript code controlled by the attacker. Users running a Zulip server from the main branch should upgrade from main (2022-03-01 or later) again to deploy this fix.
- Product
- zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022Rundeck is an open source automation service with a web console, command line tools and a WebAPI.CVE-2021-41112 · Other software · rundeck · reported by GitHubHigh 8.1
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing calendars could cause Scheduled Jobs to execute, or not execute on desired calendar days. Severity depends on trust level of authenticated users and impact of running or not running scheduled jobs on days governed by calendar definitions. Version 3.4.5 contains a patch for this issue. There are currently no known workarounds.
- Product
- rundeck
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022Rundeck is an open source automation service with a web console, command line tools and a WebAPI.CVE-2021-41111 · Other software · rundeck · reported by GitHubMedium 6.4
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user with authorization to read webhooks in one project can craft a request to reveal Webhook definitions and tokens in another project. The user could use the revealed webhook tokens to trigger webhooks. Severity depends on trust level of authenticated users and whether any webhooks exist that trigger sensitive actions. There are patches for this vulnerability in versions 3.4.5 and 3.3.15. There are currently no known workarounds.
- Product
- rundeck
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022Anuko Time Tracker is an open source, web-based time tracking application written in PHP.CVE-2022-24708 · Other software · anuko · reported by GitHubMedium 6.5
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with elements of JavaScript. Such script could then be executed in user browser on subsequent requests on pages where primary group name was displayed. This is vulnerability has been fixed in version 1.20.0.5646. Users who are unable to upgrade may modify ttUser.class.php to use an additional call to htmlspecialchars when printing group name.
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022Anuko Time Tracker is an open source, web-based time tracking application written in PHP.CVE-2022-24707 · Other software · anuko · reported by GitHubHigh 7.4
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was happening because the Puncher plugin was reusing code from other places and was relying on an unsanitized date parameter in POST requests. Because the parameter was not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue has been resolved in in version 1.20.0.5642. Users unable to upgrade are advised to add their own checks to input.
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 22, 2022Envoy is an open source edge and service proxy, designed for cloud-native applications.CVE-2022-23606 · Other software · envoyproxy · reported by GitHubMedium 4.4
Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Envoy is an open source edge and service proxy, designed for cloud-native applications.CVE-2022-21657 · Other software · envoyproxy · reported by GitHubMedium 6.8
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage (id-kp-serverAuth and id-kp-clientAuth, respectively). This means that a peer may present an e-mail certificate (e.g. id-kp-emailProtection), either as a leaf certificate or as a CA in the chain, and it will be accepted for TLS. This is particularly bad when combined with the issue described in pull request #630, in that it allows a Web PKI CA that is intended only for use with S/MIME, and thus exempted from audit or supervision, to issue TLS certificates that will be accepted by Envoy. As a result Envoy will trust upstream certificates that should not be trusted. There are no known workarounds to this issue. Users are advised to upgrade.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Envoy is an open source edge and service proxy, designed for cloud-native applications.CVE-2022-21656 · Other software · envoyproxy · reported by GitHubHigh 7.4
Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default certificate validation routines has a "type confusion" bug when processing subjectAltNames. This processing allows, for example, an rfc822Name or uniformResourceIndicator to be authenticated as a domain name. This confusion allows for the bypassing of nameConstraints, as processed by the underlying OpenSSL/BoringSSL implementation, exposing the possibility of impersonation of arbitrary servers. As a result Envoy will trust upstream certificates that should not be trusted.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Envoy is an open source edge and service proxy, designed for cloud-native applications.CVE-2022-21655 · Other software · envoyproxy · reported by GitHubHigh 7.5
Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Envoy is an open source edge and service proxy, designed for cloud-native applications.CVE-2022-21654 · Other software · envoyproxy · reported by GitHubHigh 7.4
Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Envoy is an open source edge and service proxy, designed for cloud-native applications.CVE-2021-43826 · Other software · envoyproxy · reported by GitHubHigh 7.5
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling <envoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_config>` and the downstream connection disconnects while the the upstream connection or http/2 stream is still being established. There are no workarounds for this issue. Users are advised to upgrade.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Envoy is an open source edge and service proxy, designed for cloud-native applications.CVE-2021-43825 · Other software · envoyproxy · reported by GitHubMedium 6.1
Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of request or response data. Envoy tracks the amount of buffered request and response data and aborts the request if the amount of buffered data is over the limit by sending 413 or 500 responses. However when the buffer overflows while response is processed by the filter chain the operation may not be aborted correctly and result in accessing a freed memory block. If this happens Envoy will crash resulting in a denial of service.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Envoy is an open source edge and service proxy, designed for cloud-native applications.CVE-2021-43824 · Other software · envoyproxy · reported by GitHubHigh 7.5
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use regex in the JWT filter. Users are advised to upgrade.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, CVE-2022-23608 · Other software · pjsip · reported by GitHubHigh 8.1
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set to be registered in the hash table multiple times (with different hash keys) leading to undefined behavior such as dialog list collision which eventually leading to endless loop. A patch is available in commit db3235953baa56d2fb0e276ca510fefca751643f which will be included in the next release. There are no known workarounds for this issue.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Feb 16, 2022Wasmtime is an open source runtime for WebAssembly & WASI.CVE-2022-23636 · Other software · bytecodealliance · reported by GitHubMedium 5.1
Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` global will result in an invalid drop of a `VMExternRef` via an uninitialized pointer. A number of conditions listed in the GitHub Security Advisory must be true in order for an instance to be vulnerable to this issue. Maintainers believe that the effective impact of this bug is relatively small because the usage of `externref` is still uncommon and without a resource limiter configured on the `Store`, which is not the default configuration, it is only possible to trigger the bug from an error returned by `mprotect` or `VirtualAlloc`. Note that on Linux with the `uffd` feature enabled, it is only possible to trigger the bug from a resource limiter as the call to `mprotect` is skipped. The bug has been fixed in 0.34.1 and 0.33.1 and users are encouraged to upgrade as soon as possible. If it is not possible to upgrade to version 0.34.1 or 0.33.1 of the `wasmtime` crate, it is recommend that support for the reference types proposal be
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022Adobe Commerce and Magento Open Source Improper Input Validation VulnerabilityCVE-2022-24086 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.
- Product
- Commerce and Magento Open Source
- On CISA’s list since
- Feb 15, 2022 (federal fix deadline Mar 1, 2022)
- What to do
- Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloghelpx.adobe.comhelpx.adobe.com
Feb 15, 2022Discourse is an open source discussion platform.CVE-2022-23641 · Other software · discourse · reported by GitHubMedium 6.5
Discourse is an open source discussion platform. In versions prior to 2.8.1 in the `stable` branch, 2.9.0.beta2 in the `beta` branch, and 2.9.0.beta2 in the `tests-passed` branch, users can trigger a Denial of Service attack by posting a streaming URL. Parsing Oneboxes in the background job trigger an infinite loop, which cause memory leaks. This issue is patched in version 2.8.1 of the `stable` branch, 2.9.0.beta2 of the `beta` branch, and 2.9.0.beta2 of the `tests-passed` branch. As a workaround, disable onebox in admin panel completely or specify allow list of domains that will be oneboxed.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022OPA is an open source, general-purpose policy engine.CVE-2022-23628 · Other software · open-policy-agent · reported by GitHubMedium 6.3
OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree (AST) that contains synthetic nodes could change the logic of some statements by reordering array literals. Example of policies impacted are those that parse and compare web paths. **All of these** three conditions have to be met to create an adverse effect: 1. An AST of Rego had to be **created programmatically** such that it ends up containing terms without a location (such as wildcard variables). 2. The AST had to be **pretty-printed** using the `github.com/open-policy-agent/opa/format` package. 3. The result of the pretty-printing had to be **parsed and evaluated again** via an OPA instance using the bundles, or the Golang packages. If any of these three conditions are not met, you are not affected. Notably, all three would be true if using **optimized bundles**, i.e. bundles created with `opa build -O=1` or higher. In that case, the optimizer would fulfil condition (1.), the result of that would be pretty-printed when writing the bundle to disk, fulfilling (2.). When the bundle was then used, we'd satisfy (3.). As a workaround users may disable optimization w
- Product
- opa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2022xrdp is an open source remote desktop protocol (RDP) server.CVE-2022-23613 · Other software · neutrinolabs · reported by GitHubHigh 7.8
xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability has been patched in version 0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Twig is an open source template language for PHP.CVE-2022-23614 · Other software · twigphp · reported by GitHubHigh 8.8
Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.
- Product
- Twig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022fleet is an open source device management, built on osquery.CVE-2022-23600 · Other software · fleetdm · reported by GitHubMedium 5.3
fleet is an open source device management, built on osquery. Versions prior to 4.9.1 expose a limited ability to spoof SAML authentication with missing audience verification. This impacts deployments using SAML SSO in two specific cases: 1. A malicious or compromised Service Provider (SP) could reuse the SAML response to log into Fleet as a user -- only if the user has an account with the same email in Fleet, _and_ the user signs into the malicious SP via SAML SSO from the same Identity Provider (IdP) configured with Fleet. 2. A user with an account in Fleet could reuse a SAML response intended for another SP to log into Fleet. This is only a concern if the user is blocked from Fleet in the IdP, but continues to have an account in Fleet. If the user is blocked from the IdP entirely, this cannot be exploited. Fleet 4.9.1 resolves this issue. Users unable to upgrade should: Reduce the length of sessions on your IdP to reduce the window for malicious re-use, Limit the amount of SAML Service Providers/Applications used by user accounts with access to Fleet, and When removing access to Fleet in the IdP, delete the Fleet user from Fleet as well.
- Product
- fleet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23595 · Other software · tensorflow · reported by GitHubMedium 5.3
Tensorflow is an Open Source Machine Learning Framework. When building an XLA compilation cache, if default settings are used, TensorFlow triggers a null pointer dereference. In the default scenario, all devices are allowed, so `flr->config_proto` is `nullptr`. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23594 · Other software · tensorflow · reported by GitHubHigh 8.8
Tensorflow is an Open Source Machine Learning Framework. The TFG dialect of TensorFlow (MLIR) makes several assumptions about the incoming `GraphDef` before converting it to the MLIR-based dialect. If an attacker changes the `SavedModel` format on disk to invalidate these assumptions and the `GraphDef` is then converted to MLIR-based IR then they can cause a crash in the Python interpreter. Under certain scenarios, heap OOB read/writes are possible. These issues have been discovered via fuzzing and it is possible that more weaknesses exist. We will patch them as they are discovered.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23593 · Other software · tensorflow · reported by GitHubMedium 5.9
Tensorflow is an Open Source Machine Learning Framework. The `simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes. If all shapes are scalar, then `maxRank` is 0, so we build an empty `SmallVector`. The fix will be included in TensorFlow 2.8.0. This is the only affected version.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23592 · Other software · tensorflow · reported by GitHubHigh 8.1
Tensorflow is an Open Source Machine Learning Framework. TensorFlow's type inference can cause a heap out of bounds read as the bounds checking is done in a `DCHECK` (which is a no-op during production). An attacker can control the `input_idx` variable such that `ix` would be larger than the number of values in `node_t.args`. The fix will be included in TensorFlow 2.8.0. This is the only affected version.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23591 · Other software · tensorflow · reported by GitHubHigh 7.5
Tensorflow is an Open Source Machine Learning Framework. The `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a `GraphDef` containing a fragment such as the following can be consumed when loading a `SavedModel`. This would result in a stack overflow during execution as resolving each `NodeDef` means resolving the function itself and its nodes. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23590 · Other software · tensorflow · reported by GitHubMedium 5.9
Tensorflow is an Open Source Machine Learning Framework. A `GraphDef` from a TensorFlow `SavedModel` can be maliciously altered to cause a TensorFlow process to crash due to encountering a `StatusOr` value that is an error and forcibly extracting the value from it. We have patched the issue in multiple GitHub commits and these will be included in TensorFlow 2.8.0 and TensorFlow 2.7.1, as both are affected.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23589 · Other software · tensorflow · reported by GitHubMedium 6.5
Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, Grappler component of TensorFlow can trigger a null pointer dereference. There are 2 places where this can occur, for the same malicious alteration of a `SavedModel` file (fixing the first one would trigger the same dereference in the second place). First, during constant folding, the `GraphDef` might not have the required nodes for the binary operation. If a node is missing, the correposning `mul_*child` would be null, and the dereference in the subsequent line would be incorrect. We have a similar issue during `IsIdentityConsumingSwitch`. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23588 · Other software · tensorflow · reported by GitHubMedium 6.5
Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that Grappler optimizer would attempt to build a tensor using a reference `dtype`. This would result in a crash due to a `CHECK`-fail in the `Tensor` constructor as reference types are not allowed. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23587 · Other software · tensorflow · reported by GitHubHigh 8.8
Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during cost estimation for crop and resize. Since the cropping parameters are user controlled, a malicious person can trigger undefined behavior. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.