Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,372 results · page 78 of 148
Oct 17, 2022An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format.CVE-2022-3165 · Other software · Qemu · reported by Red HatMedium 6.5
An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service.
- Product
- Qemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comlists.fedoraproject.org
Oct 17, 2022Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formSetClientState.CVE-2022-42164 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formSetClientState.
- Product
- Ac10 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022In SitRilClient_OnResponse of SitRilSe.cpp, there is a possible out of bounds write due to a missing bounds check.CVE-2022-20397 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In SitRilClient_OnResponse of SitRilSe.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-223086933References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 14, 2022An attacker can take leverage on PerFact OpenVPN-Client versions 1.4.1.0 and prior to send the config command from any application running on the local host macCVE-2021-27406 · Other software · PerFact · reported by ics-cert@hq.dhs.govHigh 8.8
An attacker can take leverage on PerFact OpenVPN-Client versions 1.4.1.0 and prior to send the config command from any application running on the local host machine to force the back-end server into initializing a new open-VPN instance with arbitrary open-VPN configuration. This could result in the attacker achieving execution with privileges of a SYSTEM user.
- Product
- OpenVPN-Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022The BT Hfp Client module has a Use-After-Free (UAF) vulnerability.Successful exploitation of this vulnerability may result in arbitrary code execution.CVE-2022-38983 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
The BT Hfp Client module has a Use-After-Free (UAF) vulnerability.Successful exploitation of this vulnerability may result in arbitrary code execution.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 14, 2022Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with 5.10.6 and prior to 5.12.0 contains a debugging port misconfiguration.CVE-2022-28762 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.3
Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with 5.10.6 and prior to 5.12.0 contains a debugging port misconfiguration. When camera mode rendering context is enabled as part of the Zoom App Layers API by running certain Zoom Apps, a local debugging port is opened by the Zoom client. A local malicious user could use this debugging port to connect to and control the Zoom Apps running in the Zoom client.
- Product
- Zoom Client for Meetings for MacOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Oct 12, 2022FreeRDP is a free remote desktop protocol library and clients.CVE-2022-39283 · Other software · FreeRDP · reported by GitHubMedium 5.9
FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not affected. This issue has been patched in version 2.8.1. If you cannot upgrade do not use the `/video` switch.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022FreeRDP is a free remote desktop protocol library and clients.CVE-2022-39282 · Other software · FreeRDP · reported by GitHubLow 3.5
FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022Dell Client BIOS Versions prior to the remediated version contain an improper input validation vulnerability.CVE-2022-34391 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell Client BIOS Versions prior to the remediated version contain an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022Dell Client BIOS contains a Buffer Overflow vulnerability.CVE-2022-32491 · Other software · Dell · reported by security_alert@emc.comMedium 4.1
Dell Client BIOS contains a Buffer Overflow vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by manipulating an SMI to cause an arbitrary write during SMM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022The Triangle Microworks IEC 61850 Library (Any client or server using the C language library with a version number of 11.2.0 or earlier and any client or serverCVE-2022-38138 · Other software · Triangle Microworks · reported by ics-cert@hq.dhs.govHigh 7.5
The Triangle Microworks IEC 61850 Library (Any client or server using the C language library with a version number of 11.2.0 or earlier and any client or server using the C++, C#, or Java language library with a version number of 5.0.1 or earlier) and 60870-6 (ICCP/TASE.2) Library (Any client or server using a C++ language library with a version number of 4.4.3 or earlier) are vulnerable to access given to a small number of uninitialized pointers within their code. This could allow an attacker to target any client or server using the affected libraries to cause a denial-of-service condition.
- Product
- Library: IEC 61850
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022NuGet Client Elevation of Privilege VulnerabilityCVE-2022-41032 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
NuGet Client Elevation of Privilege Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comlists.fedoraproject.org
Oct 11, 2022Windows DHCP Client Information Disclosure VulnerabilityCVE-2022-38026 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows DHCP Client Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Oct 11, 2022Windows Group Policy Preference Client Elevation of Privilege VulnerabilityCVE-2022-37999 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Group Policy Preference Client Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Oct 11, 2022Windows Group Policy Preference Client Elevation of Privilege VulnerabilityCVE-2022-37994 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Group Policy Preference Client Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Oct 11, 2022Windows Group Policy Preference Client Elevation of Privilege VulnerabilityCVE-2022-37993 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Group Policy Preference Client Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Oct 11, 2022Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege VulnerabilityCVE-2022-37989 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Oct 11, 2022Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege VulnerabilityCVE-2022-37987 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Oct 11, 2022Windows DHCP Client Elevation of Privilege VulnerabilityCVE-2022-37980 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows DHCP Client Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 21H1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Oct 11, 2022Dell Hybrid Client below 1.8 version contains a gedit vulnerability.CVE-2022-34432 · Other software · Dell · reported by security_alert@emc.comHigh 7.3
Dell Hybrid Client below 1.8 version contains a gedit vulnerability. A guest attacker could potentially exploit this vulnerability, allowing deletion of user and some system files and folders.
- Product
- Dell Hybrid Client (DHC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Dell Hybrid Client below 1.8 version contains a guest user profile corruption vulnerability.CVE-2022-34431 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell Hybrid Client below 1.8 version contains a guest user profile corruption vulnerability. A WMS privilege attacker could potentially exploit this vulnerability, leading to DHC system not being accessible.
- Product
- Dell Hybrid Client (DHC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Dell Hybrid Client below 1.8 version contains a Zip Bomb Vulnerability in UI.CVE-2022-34430 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell Hybrid Client below 1.8 version contains a Zip Bomb Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading to system files modification.
- Product
- Dell Hybrid Client (DHC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit.CVE-2022-33749 · Other software · Xapi · reported by security@xen.orgMedium 5.3
XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This causes XAPI to be unable to accept new requests for other (trusted) clients, and blocks XAPI from carrying out any tasks that require the opening of file descriptors.
- Product
- Xapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comxenbits.xen.org
Oct 10, 2022Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit.CVE-2022-39292 · Other software · abdolence · reported by GitHubHigh 7.5
Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. Debug logs expose sensitive URLs for Slack webhooks that contain private information. The problem is fixed in version 1.3.2 which redacts sensitive URLs for webhooks. As a workaround, people who use Slack webhooks may disable or filter debug logs.
- Product
- slack-morphism-rust
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editclient.php?id=.CVE-2022-42073 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editclient.php?id=.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022Insertion of Sensitive Information into Log in PushRegIdUpdateClient of SReminder prior to 8.2.01.13 allows attacker to access device IMEI.CVE-2022-39876 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.9
Insertion of Sensitive Information into Log in PushRegIdUpdateClient of SReminder prior to 8.2.01.13 allows attacker to access device IMEI.
- Product
- Reminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Oct 6, 2022IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration.CVE-2022-36774 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IBM X-Force ID: 233575.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 30, 2022Dell Hybrid Client below 1.8 version contains a Zip Slip Vulnerability in UI.CVE-2022-34429 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell Hybrid Client below 1.8 version contains a Zip Slip Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading to system files modification.
- Product
- Dell Hybrid Client (DHC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2022Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI.CVE-2022-34428 · Other software · Dell · reported by security_alert@emc.comMedium 5
Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adversary with WMS group admin access could potentially exploit this vulnerability, leading to temporary denial-of-service.
- Product
- Dell Hybrid Client (DHC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2022A vulnerability in the client forwarding code of multiple Cisco Access Points (APs) could allow an unauthenticated, adjacent attacker to inject packets from theCVE-2022-20728 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.7
A vulnerability in the client forwarding code of multiple Cisco Access Points (APs) could allow an unauthenticated, adjacent attacker to inject packets from the native VLAN to clients within nonnative VLANs on an affected device. This vulnerability is due to a logic error on the AP that forwards packets that are destined to a wireless client if they are received on the native VLAN. An attacker could exploit this vulnerability by obtaining access to the native VLAN and directing traffic directly to the client through their MAC/IP combination. A successful exploit could allow the attacker to bypass VLAN separation and potentially also bypass any Layer 3 protection mechanisms that are deployed.
- Product
- Cisco Aironet Access Point Software (IOS XE Controller)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Sep 30, 2022Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via JoplinCVE-2022-40277 · Other software · Joplinapp · reported by help@fluidattacks.comHigh 7.8
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.
- Product
- Joplin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Sep 30, 2022Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Gridea.CVE-2022-40274 · Other software · Gridea · reported by help@fluidattacks.comHigh 7.8
Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Gridea. This is possible because the application has the 'nodeIntegration' option enabled.
- Product
- Gridea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Sep 30, 2022Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-mCVE-2022-32540 · Other software · Bosch · reported by psirt@bosch.comMedium 5.9
Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This is only applicable for UDP encryption when target system contains cameras with platform CPP13 or CPP14 and firmware version 8.x.
- Product
- BVMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Sep 30, 2022Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the requCVE-2022-21826 · Network & remote access · Ivanti · reported by support@hackerone.comMedium 5.4
Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Sep 29, 2022IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs.CVE-2022-39168 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. IBM X-Force ID: 235422.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 29, 2022matrix-nio is a Python Matrix client library, designed according to sans I/O principles.CVE-2022-39254 · Other software · poljar · reported by GitHubHigh 8.6
matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they accept it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.20 fixes the issue.
- Product
- matrix-nio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2022matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library.CVE-2022-39252 · Other software · matrix-org · reported by GitHubHigh 8.6
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When the user receives a forwarded room key, the software accepts it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.6 fixes this issue.
- Product
- matrix-rust-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2022Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript.CVE-2022-39250 · Other software · matrix-org · reported by GitHubHigh 8.6
Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a c
- Product
- matrix-js-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake.CVE-2022-39173 · Other software · Wolfssl · reported by MITREHigh 7.5
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required to contain a list of duplicate cipher suites to trigger the buffer overflow. In total, two Client Hellos have to be sent: one in the resumed session, and a second one as a response to a Hello Retry Request message.
- Product
- Wolfssl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 28, 2022nheko is a desktop client for the Matrix communication application.CVE-2022-39264 · Other software · Nheko-Reborn · reported by GitHubHigh 8.6
nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu.
- Product
- nheko
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript.CVE-2022-39251 · Other software · matrix-org · reported by GitHubHigh 8.6
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. Starting with version 19.7.0, matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.
- Product
- matrix-js-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript.CVE-2022-39249 · Other software · matrix-org · reported by GitHubHigh 7.5
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-js-sdk implementing a too permissive key forwarding strategy on the receiving end. Starting with version 19.7.0, the default policy for accepting key forwards has been made more strict in the matrix-js-sdk. matrix-js-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately, for example, by showing a warning for such messages. This attack requires coordination between a malicious homeserver and an attacker, and those who trust your homeservers do not need a workaround.
- Product
- matrix-js-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript.CVE-2022-39236 · Other software · matrix-org · reported by GitHubMedium 4.3
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This is patched in matrix-js-sdk v19.7.0. Redacting applicable events, waiting for the sync processor to store data, and restarting the client are possible workarounds. Alternatively, redacting the applicable events and clearing all storage will fix the further perceived issues. Downgrading to an unaffected version, noting that such a version may be subject to other vulnerabilities, will additionally resolve the issue.
- Product
- matrix-js-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_edit.php.CVE-2022-40484 · Other software · Wedding Planner Project · reported by MITRECritical 9.8
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_edit.php.
- Product
- Wedding Planner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_assign.php.CVE-2022-40402 · Other software · Wedding Planner Project · reported by MITREHigh 8.8
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_assign.php.
- Product
- Wedding Planner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022OAuth client Single Sign On: Does not have authorisation and CSRFCVE-2022-3119 · WordPress plugins & themes · reported by WPScanHigh 7.5
The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know the correct email address
- Product
- OAuth client Single Sign On
- Fixed in
- 3.0.4
- What to do
- Update OAuth client Single Sign On to 3.0.4 or newer.
Sep 23, 2022Besu is a Java-based Ethereum client.CVE-2022-36025 · Other software · hyperledger · reported by GitHubCritical 9.1
Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations (including DELEGATECALL) results in incorrect gas being passed into called contracts and incorrect gas being returned after call execution. Where the amount of gas makes a difference in the success or failure, or if the gas is a negative 64 bit value, the execution will result in a different state root than expected, resulting in a consensus failure in networks with multiple EVM implementations. In networks with a single EVM implementation this can be used to execute with significantly more gas than then transaction requested, possibly exceeding gas limitations. This issue is patched in version 22.7.1. As a workaround, reverting to version 22.1.3 or earlier will prevent incorrect execution.
- Product
- besu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default.CVE-2021-45035 · Other software · Velneo · reported by cve-coordination@incibe.esMedium 6.3
Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.
- Product
- Velneo vClient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoc.velneo.comvelneo.es
Sep 23, 2022Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function fromDhcpListClient with a combined parameter "list*" ("%s%d","liCVE-2022-40869 · Network & remote access · Tendacn · reported by MITRECritical 9.8
Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function fromDhcpListClient with a combined parameter "list*" ("%s%d","list").
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disCVE-2022-33683 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.9
Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middle attacks, which could leak authentication data, configuration data, and any other data sent by these clients. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack. This issue affects Apache Pulsar Broker and Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.
- Product
- Apache Pulsar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.