Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
816 results · page 8 of 17
Mar 21, 2024Calendarista Basic Edition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27993 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.2.
- Product
- Calendarista Basic Edition
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Calendarista Basic Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2024Maintenance Page: Basic Information ExposureCVE-2024-1462 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Maintenance Page plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 1.0.8 via the REST API. This makes it possible for unauthenticated attackers to view post titles and content when the site is in maintenance mode.
- Product
- Maintenance Page
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Maintenance Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 28, 2024Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name.CVE-2023-49337 · Other software · Concretecms · reported by MITRELow 2.4
Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. (8.5 and earlier are unaffected.)
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Feb 12, 2024Basic Log Viewer: Cross-Site Request Forgery (CSRF)CVE-2024-24935 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WpSimpleTools Basic Log Viewer.This issue affects Basic Log Viewer: from n/a through 1.0.4.
- Product
- Basic Log Viewer
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Basic Log Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 23, 2024Silverstripe Admin provides a basic management interface for the Silverstripe Framework.CVE-2023-49783 · Other software · silverstripe · reported by GitHubMedium 4.3
Silverstripe Admin provides a basic management interface for the Silverstripe Framework. In versions on the 1.x branch prior to 1.13.19 and on the 2.x branch prior to 2.1.8, users who don't have edit or delete permissions for records exposed in a `ModelAdmin` can still edit or delete records using the CSV import form, provided they have create permissions. The likelihood of a user having create permissions but not having edit or delete permissions is low, but it is possible. Note that this doesn't affect any `ModelAdmin` which has had the import form disabled via the `showImportForm` public property. Versions 1.13.19 and 2.1.8 contain a patch for the issue. Those who have a custom implementation of `BulkLoader` should update their implementations to respect permissions when the return value of `getCheckPermissions()` is true. Those who use any `BulkLoader` in their own project logic, or maintain a module which uses it, should consider passing `true` to `setCheckPermissions()` if the data is provided by users.
- Product
- silverstripe-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsilverstripe.org
Jan 10, 2024An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authenticCVE-2023-29447 · Other software · PTC · reported by ot-cert@dragos.comMedium 5.7
An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication.
- Product
- Kepware KEPServerEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023A reflected XSS vulnerability was discovered in the Proforms Basic component for Joomla.CVE-2023-40655 · Other software · mooj.org · reported by security@joomla.orgMedium 6.1
A reflected XSS vulnerability was discovered in the Proforms Basic component for Joomla.
- Product
- Proforms Basic component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Dec 3, 2023Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.CVE-2023-49947 · Other software · Forgejo · reported by MITREHigh 7.5
Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.
- Product
- Forgejo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeberg.orgforgejo.org
Nov 30, 2023LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext andCVE-2023-46383 · Other software · Loytec · reported by MITREHigh 7.5
LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the password and gain full control of Loytec device configuration.
- Product
- L-inx Configurator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 29, 2023Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the shareSpeed parameter in the function fromSetWifiGuestBasic.CVE-2023-45484 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the shareSpeed parameter in the function fromSetWifiGuestBasic.
- Product
- Ac10 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023The Learning Module in ILIAS 7.25 (2023-09-12 release) allows an attacker (with basic user privileges) to achieve a high-impact Directory Traversal attack on coCVE-2023-45868 · Other software · Ilias · reported by MITREHigh 8.1
The Learning Module in ILIAS 7.25 (2023-09-12 release) allows an attacker (with basic user privileges) to achieve a high-impact Directory Traversal attack on confidentiality and availability. By exploiting this network-based vulnerability, the attacker can move specified directories, normally outside the documentRoot, to a publicly accessible location via the PHP function rename(). This results in a total loss of confidentiality, exposing sensitive resources, and potentially denying access to the affected component and the operating system's components. To exploit this, an attacker must manipulate a POST request during the creation of an exercise unit, by modifying the old_name and new_name parameters via directory traversal. However, it's essential to note that, when exploiting this vulnerability, the specified directory will be relocated from its original location, rendering all files obtained from there unavailable.
- Product
- Ilias
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrehmeinfosec.derehmeinfosec.de
Oct 10, 2023An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized coCVE-2023-36555 · Network & remote access · Fortinet · reported by psirt@fortinet.comLow 3.9
An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components.
- Product
- FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Oct 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in Laposta - Roel Bousardt Laposta Signup Basic plugin <= 1.4.1 versions.CVE-2023-41950 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Laposta - Roel Bousardt Laposta Signup Basic plugin <= 1.4.1 versions.
- Fixed in
- 1.4.2
- What to do
- Update the plugin to 1.4.2 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 3, 2023Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 version , which could allow a local attacker with basic privileges to execute a malicious payload throuCVE-2023-32670 · Other software · BuddyBoss · reported by cve-coordination@incibe.esCritical 9
Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 version , which could allow a local attacker with basic privileges to execute a malicious payload through the "[name]=image.jpg" parameter, allowing to assign a persistent javascript payload that would be triggered when the associated image is loaded.
- Product
- BuddyBoss
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the security parameter in the formWifiBasicSet functionCVE-2023-44020 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the security parameter in the formWifiBasicSet function.
- Product
- ac10u
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saphira Saphira Connect allows Reflected XSS.CVE-2023-4663 · Network & remote access · Saphira · reported by iletisim@usom.gov.trMedium 6.1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saphira Saphira Connect allows Reflected XSS. This issue affects Saphira Connect: before 9.
- Product
- Saphira Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Aug 30, 2023Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function 'formWifiBasicSet.'CVE-2023-40844 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function 'formWifiBasicSet.'
- Product
- ac6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter security_5g at url /goform/WifiBasicSet.CVE-2023-41555 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter security_5g at url /goform/WifiBasicSet.
- Product
- ac7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the security parameter in the formWifiBasicSet function.CVE-2023-39828 · Network & remote access · tenda · reported by MITREHigh 7.5
Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the security parameter in the formWifiBasicSet function.
- Product
- a18
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.CVE-2023-34476 · Other software · mooj.org · reported by security@joomla.orgCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.
- Product
- Proforms Basic component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Jul 6, 2023A stored cross-site scripting (XSS) vulnerability in the Basic Website Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts orCVE-2023-37136 · Other software · Eyoucms · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Basic Website Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023A stored cross-site scripting (XSS) vulnerability in the Basic Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML viCVE-2023-37134 · Other software · Eyoucms · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Basic Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023A stack overflow in the Edit_BasicSSID_5G function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.CVE-2023-34934 · Other software · h3c · reported by MITREHigh 7.5
A stack overflow in the Edit_BasicSSID_5G function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- magic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023A stack overflow in the Edit_BasicSSID function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.CVE-2023-34928 · Other software · h3c · reported by MITREHigh 7.5
A stack overflow in the Edit_BasicSSID function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- magic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2023There is a storage type cross site scripting (XSS) vulnerability in the filing number of the Basic Information tab on the backend management page of EyouCMS v1.CVE-2023-36093 · Other software · Eyoucms · reported by MITREMedium 5.4
There is a storage type cross site scripting (XSS) vulnerability in the filing number of the Basic Information tab on the backend management page of EyouCMS v1.6.3
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication.CVE-2023-29168 · Other software · PTC · reported by ics-cert@hq.dhs.govLow 3.7
The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication.
- Product
- Vuforia Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function.CVE-2023-33672 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function.
- Product
- Ac8 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.CVE-2023-33642 · Other software · H3c · reported by MITREHigh 7.2
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.
- Product
- Magic R300-2100m Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.CVE-2023-33638 · Other software · H3c · reported by MITREHigh 7.2
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.
- Product
- Magic R300-2100m Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation isCVE-2023-0779 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.7
At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Damir Calusic WP Basic Elements plugin <= 5.2.15 versions.CVE-2022-47139 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Damir Calusic WP Basic Elements plugin <= 5.2.15 versions.
- Affected
- up to 5.2.15
- What to do
- Affects up to 5.2.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 22, 2023The iBoot device’s basic discovery protocol assists in initial device configuration.CVE-2022-47320 · Other software · Dataprobe, Inc. · reported by ics-cert@hq.dhs.govHigh 8.1
The iBoot device’s basic discovery protocol assists in initial device configuration. The discovery protocol shows basic information about devices on the network and allows users to perform configuration changes.
- Product
- Dataprobe iBoot-PDU FW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Use of weak credentials exists in Seiko Solutions SkyBridge and SkySpider series, which may allow a remote unauthenticated attacker to decrypt password for the CVE-2023-25184 · Other software · Seiko Solutions Inc. · reported by vultures@jpcert.or.jpHigh 7.5
Use of weak credentials exists in Seiko Solutions SkyBridge and SkySpider series, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product. Affected products and versions are as follows: SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier, and SkySpider MB-R210 firmware Ver. 1.01.00 and earlier.
- Product
- SkyBridge MB-A200, SkyBridge BASIC MB-A130, and SkySpider MB-R210
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Improper following of a certificate's chain of trust exists in SkyBridge MB-A200 firmware Ver.CVE-2023-23901 · Other software · Seiko Solutions Inc. · reported by vultures@jpcert.or.jpMedium 6.5
Improper following of a certificate's chain of trust exists in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier, which may allow a remote unauthenticated attacker to eavesdrop on or alter the communication sent to the WebUI of the product.
- Product
- SkyBridge MB-A200 and SkyBridge BASIC MB-A130
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Missing authentication for critical function exists in Seiko Solutions SkyBridge series, which may allow a remote attacker to obtain or alter the setting informCVE-2023-22441 · Other software · Seiko Solutions Inc. · reported by vultures@jpcert.or.jpHigh 8.6
Missing authentication for critical function exists in Seiko Solutions SkyBridge series, which may allow a remote attacker to obtain or alter the setting information of the product or execute some critical functions without authentication, e.g., rebooting the product. Affected products and versions are as follows: SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier
- Product
- SkyBridge MB-A200 and SkyBridge BASIC MB-A130
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2023H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.CVE-2023-29907 · Other software · H3c · reported by MITREMedium 4.9
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.
- Product
- Magic R200 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2023H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.CVE-2023-29906 · Other software · H3c · reported by MITREMedium 4.9
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.
- Product
- Magic R200 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup (Software Installation Program) - version 9.0, resulting in a privilCVE-2023-29187 · Network & remote access · SAP · reported by cna@sap.comMedium 6.7
A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup (Software Installation Program) - version 9.0, resulting in a privilege escalation running code as administrator of the very same Windows PC. A successful attack depends on various preconditions beyond the attackers control.
- Product
- SapSetup (Software Installation Program)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Apr 10, 2023An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar fiCVE-2023-28765 · Network & remote access · SAP · reported by cna@sap.comCritical 9.8
An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application.
- Product
- BusinessObjects Business Intelligence Platform (Promotion Management)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Apr 6, 2023Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the formWifiBasicSet function.CVE-2023-25217 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the formWifiBasicSet function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
- Product
- Ac5 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.CVE-2020-20913 · Other software · Mingsoft · reported by MITRECritical 9.8
SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.
- Product
- Mcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2023Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-buildCVE-2023-28677 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comCritical 9.8
Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowing attackers able to configure Freestyle projects to prepare a crafted configuration that injects Pipeline script code into the (unsandboxed) Pipeline resulting from a convertion by Jenkins Convert To Pipeline Plugin.
- Product
- Jenkins Convert To Pipeline Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Virames Vira-Investing allows Cross-Site Scripting (XSS).CVE-2023-1013 · Other software · Virames · reported by iletisim@usom.gov.trMedium 6.1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Virames Vira-Investing allows Cross-Site Scripting (XSS). This issue affects Vira-Investing: before 1.0.84.86.
- Product
- Vira-Investing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Mar 7, 2023Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in UBIT Information Technologies Student Information Management SystCVE-2021-44197 · Other software · UBIT Information Technologies · reported by iletisim@usom.gov.trMedium 6.1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in UBIT Information Technologies Student Information Management System. This issue affects Student Information Management System: before 20211126.
- Product
- Student Information Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Mar 7, 2023Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in UBIT Information Technologies Student Information Management SystCVE-2021-44196 · Other software · UBIT Information Technologies · reported by iletisim@usom.gov.trMedium 6.1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in UBIT Information Technologies Student Information Management System. This issue affects Student Information Management System: before 20211126.
- Product
- Student Information Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Mar 1, 2023Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey1 parameter at /goform/WifiBasicSet.CVE-2023-24127 · Other software · Heimgardtechnologies · reported by MITREMedium 6.5
Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey1 parameter at /goform/WifiBasicSet.
- Product
- Eagle 1200ac Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey4_5g parameter at /goform/WifiBasicSet.CVE-2023-24126 · Other software · Heimgardtechnologies · reported by MITREMedium 6.5
Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey4_5g parameter at /goform/WifiBasicSet.
- Product
- Eagle 1200ac Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey2_5g parameter at /goform/WifiBasicSet.CVE-2023-24125 · Other software · Heimgardtechnologies · reported by MITREMedium 6.5
Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey2_5g parameter at /goform/WifiBasicSet.
- Product
- Eagle 1200ac Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet.CVE-2023-24124 · Other software · Heimgardtechnologies · reported by MITREMedium 6.5
Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet.
- Product
- Eagle 1200ac Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepauth parameter at /goform/WifiBasicSet.CVE-2023-24123 · Other software · Heimgardtechnologies · reported by MITREMedium 6.5
Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepauth parameter at /goform/WifiBasicSet.
- Product
- Eagle 1200ac Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.