Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,047 results · page 8 of 21
Dec 13, 2023A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 CVE-2022-27488 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.3
A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version 7.0.0 through 7.0.3, 6.4.0 through 6.4.6, 6.2.x, 6.0.x FortiRecorder version 6.4.0 through 6.4.2, 6.0.x, 2.7.x, 2.6.x, FortiNDR version 1.x.x allows a remote unauthenticated attacker to execute commands on the CLI via tricking an authenticated administrator to execute malicious GET requests.
- Product
- FortiVoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Dec 4, 2023Improper Access Control in Samsung Voice Recorder prior to versions 21.4.15.01 in Android 12 and Android 13, 21.4.50.17 in Android 14 allows physical attackers CVE-2023-42577 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.8
Improper Access Control in Samsung Voice Recorder prior to versions 21.4.15.01 in Android 12 and Android 13, 21.4.50.17 in Android 14 allows physical attackers to access Voice Recorder information on the lock screen.
- Product
- Samsung Voice Recorder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Nov 14, 2023Microsoft Send Customer Voice survey from Dynamics 365 Spoofing VulnerabilityCVE-2023-36007 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.6
Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability
- Product
- Send Customer Voice survey from Dynamics 365 app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 7, 2023Improper verification of intent by broadcast receiver vulnerability in Bixby Voice prior to version 3.3.35.12 allows attackers to access arbitrary data with BixCVE-2023-42543 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Improper verification of intent by broadcast receiver vulnerability in Bixby Voice prior to version 3.3.35.12 allows attackers to access arbitrary data with Bixby Voice privilege.
- Product
- Bixby Voice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Nov 1, 2023 Cross-site scripting (XSS) vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browseCVE-2023-1716 · Other software · Bitrix24 · reported by info@starlabs.sgCritical 9
Cross-site scripting (XSS) vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege.
- Product
- Bitrix24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstarlabs.sgstarlabs.sg
Oct 27, 2023Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting.CVE-2023-5443 · Other software · EDM Informatics · reported by iletisim@usom.gov.trHigh 7.5
Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting. This issue affects E-invoice: before 2.1.
- Product
- E-invoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Oct 4, 2023Common Voice is the web app for Mozilla Common Voice, a platform for collecting speech donations in order to create public domain datasets for training voice reCVE-2023-42808 · Computers, phones & browsers · Mozilla · reported by GitHubMedium 6.1
Common Voice is the web app for Mozilla Common Voice, a platform for collecting speech donations in order to create public domain datasets for training voice recognition-related tools. Version 1.88.2 is vulnerable to reflected Cross-Site Scripting given that user-controlled data flows to a path expression (path of a network request). This issue may lead to reflected Cross-Site Scripting (XSS) in the context of Common Voice’s server origin. As of time of publication, it is unknown whether any patches or workarounds exist.
- Product
- common-voice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023Vulnerability of mutex management in the bone voice ID trusted application (TA) module.CVE-2023-41306 · Other software · Huawei · reported by psirt@huawei.comLow 3.7
Vulnerability of mutex management in the bone voice ID trusted application (TA) module. Successful exploitation of this vulnerability may cause the bone voice ID feature to be unavailable.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Sep 14, 2023A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an unauthenticated attacker to perform a CrosCVE-2023-39286 · Email & office · Mitel · reported by MITREMedium 4.3
A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an unauthenticated attacker to perform a Cross Site Request Forgery (CSRF) attack due to insufficient request validation. A successful exploit could allow an attacker to provide a modified URL, potentially enabling them to modify system configuration settings.
- Product
- Connect Mobility Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an unauthenticated attacker to perform a CrosCVE-2023-39285 · Email & office · Mitel · reported by MITREMedium 4.3
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an unauthenticated attacker to perform a Cross Site Request Forgery (CSRF) attack due to insufficient request validation. A successful exploit could allow an attacker to provide a modified URL, potentially enabling them to modify system configuration settings.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2023WooCommerce PDF Invoice Builder: Unauthorized access of dataCVE-2023-4245 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscribers to view arbitrary invoices provided they can guess the order id and invoice id.
- Product
- WooCommerce PDF Invoice Builder
- Affected
- up to 1.2.89
- What to do
- Affects up to 1.2.89. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 31, 2023WooCommerce PDF Invoice Builder: Cross-Site Request ForgeryCVE-2023-4161 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can trick an admin into performing an action such as clicking on a link.
- Product
- WooCommerce PDF Invoice Builder
- Affected
- up to 1.2.90
- What to do
- Affects up to 1.2.90. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 31, 2023WooCommerce PDF Invoice Builder: Stored Cross-Site ScriptingCVE-2023-4160 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.90 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- WooCommerce PDF Invoice Builder
- Affected
- up to 1.2.90
- What to do
- Affects up to 1.2.90. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 31, 2023WooCommerce PDF Invoice Builder: Cross-Site Request ForgeryCVE-2023-3764 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.90. This is due to missing or incorrect nonce validation on the Save function. This makes it possible for unauthenticated attackers to make changes to invoices via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WooCommerce PDF Invoice Builder
- Affected
- up to 1.2.90
- What to do
- Affects up to 1.2.90. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 31, 2023WooCommerce PDF Invoice Builder: SQL InjectionCVE-2023-3677 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to, and including, 1.2.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for subscribers or higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WooCommerce PDF Invoice Builder
- Affected
- up to 1.2.89
- What to do
- Affects up to 1.2.89. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 25, 2023A vulnerability in the Connect Mobility Router component of MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated privileges CVE-2023-39291 · Email & office · Mitel · reported by MITREMedium 4.9
A vulnerability in the Connect Mobility Router component of MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to improper configuration. A successful exploit could allow an attacker to view system information.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2023A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through R19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated privCVE-2023-39290 · Email & office · Mitel · reported by MITREMedium 4.9
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through R19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to improper configuration. A successful exploit could allow an attacker to view system information.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2023A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to conduct an accCVE-2023-39289 · Email & office · Mitel · reported by MITREHigh 7.5
A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to conduct an account enumeration attack due to improper configuration. A successful exploit could allow an attacker to access system information.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2023A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated priviCVE-2023-39288 · Email & office · Mitel · reported by MITREMedium 5.5
A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated privileges and internal network access to conduct a command argument injection due to insufficient parameter sanitization. A successful exploit could allow an attacker to access network information and to generate excessive network traffic.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2023A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated priviCVE-2023-39287 · Email & office · Mitel · reported by MITREMedium 5.5
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated privileges and internal network access to conduct a command argument injection due to insufficient parameter sanitization. A successful exploit could allow an attacker to access network information and to generate excessive network traffic.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023A Command Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to execute aCVE-2023-39293 · Email & office · mitel · reported by MITRECritical 9.8
A Command Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to execute arbitrary commands within the context of the system.
- Product
- mivoice_office_400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023A SQL Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to access sensitCVE-2023-39292 · Email & office · mitel · reported by MITRECritical 9.8
A SQL Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to access sensitive information and execute arbitrary database and management operations.
- Product
- mivoice_office_400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated attacker with internal network access to CVE-2023-32748 · Email & office · Mitel · reported by MITRECritical 9.8
The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2023Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.CVE-2022-40510 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jul 25, 2023An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8.CVE-2022-46902 · Other software · Vocera · reported by MITREHigh 7.5
An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is a Path Traversal for an Unzip operation. The Vocera Report Console contains a websocket function that allows for the restoration of the database from a ZIP archive that expects a SQL import file. During the unzip operation, the code takes file paths from the ZIP archive and writes them to a Vocera temporary directory. Unfortunately, the code does not properly check if the file paths include directory traversal payloads that would escape the intended destination.
- Product
- Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstryker.comstryker.com
Jul 25, 2023An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8.CVE-2022-46901 · Other software · Vocera · reported by MITREHigh 7.5
An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is an Access Control Violation for Database Operations. The Vocera Report Console contains a websocket interface that allows for the unauthenticated execution of various tasks and database functions. This includes system tasks, and backing up, loading, and clearing of the database.
- Product
- Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstryker.comstryker.com
Jul 25, 2023An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8.CVE-2022-46900 · Other software · Vocera · reported by MITREMedium 6.5
An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Path Traversal in the Task Exec filename. The Vocera Report Console contains various jobs that are executed on the server at specified intervals, e.g., backup, etc. An authenticated user has the ability to modify these entries and set the executable path and parameters.
- Product
- Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstryker.comstryker.com
Jul 25, 2023An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8.CVE-2022-46899 · Other software · Vocera · reported by MITREHigh 7.5
An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Arbitrary File Upload. The BaseController class, that each of the service controllers derives from, allows for the upload of arbitrary files. If the HTTP request is a multipart/form-data POST request, any parameters with a filename entry will have their content written to a file in the Vocera upload-staging directory with the specified filename in the parameter.
- Product
- Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstryker.comstryker.com
Jul 25, 2023An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8.CVE-2022-46898 · Other software · Vocera · reported by MITRECritical 9.8
An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Path Traversal via the "restore SQL data" filename. The Vocera Report Console contains a websocket function that allows for the restoration of the database from a ZIP archive that expects a SQL import file. The filename provided is not properly sanitized and allows for the inclusion of a path-traversal payload that can be used to escape the intended Vocera restoration directory. An attacker could exploit this vulnerability to point to a crafted ZIP archive that contains SQL commands that could be executed against the database.
- Product
- Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstryker.comstryker.com
Jul 25, 2023Plaintext Storage of a Password vulnerability in Infodrom Software E-Invoice Approval System allows Read Sensitive Strings Within an Executable.CVE-2023-35067 · Other software · Infodrom Software · reported by iletisim@usom.gov.trHigh 7.5
Plaintext Storage of a Password vulnerability in Infodrom Software E-Invoice Approval System allows Read Sensitive Strings Within an Executable. This issue affects E-Invoice Approval System: before v.20230701.
- Product
- E-Invoice Approval System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jul 25, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infodrom Software E-Invoice Approval System allows SQL InjCVE-2023-35066 · Other software · Infodrom Software · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infodrom Software E-Invoice Approval System allows SQL Injection. This issue affects E-Invoice Approval System: before v.20230701.
- Product
- E-Invoice Approval System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
May 25, 2023Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbitrary code via the description or content CVE-2023-25439 · Other software · Squarepiginteractive · reported by MITREMedium 6.1
Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbitrary code via the description or content fields to the expenses, tasks, and customer details.
- Product
- Fusioninvoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
May 24, 2023A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker withCVE-2023-31458 · Email & office · Mitel · reported by MITRECritical 9.8
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2, 22.24.1500.0 could allow an unauthenticated attacker to conduct a refleCVE-2023-25599 · Email & office · Mitel · reported by MITREHigh 7.4
A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2, 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the test_presenter.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with internaCVE-2023-31460 · Email & office · Mitel · reported by MITREHigh 7.2
A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with internal network access to conduct a command injection attack due to insufficient restriction on URL parameters.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker withCVE-2023-31459 · Email & office · Mitel · reported by MITREHigh 8.8
A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attackCVE-2023-31457 · Email & office · Mitel · reported by MITRECritical 9.8
A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could allow an unauthenticCVE-2023-25598 · Email & office · Mitel · reported by MITREMedium 6.1
A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the home.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023KIWIZ Invoices Certification & PDF System: Does not validate the path of files to be downloadedCVE-2023-2180 · WordPress plugins & themes · reported by WPScanHigh 7.5
The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization (assuming they can upload a file on the server)
- Product
- KIWIZ Invoices Certification & PDF System
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update KIWIZ Invoices Certification & PDF System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2023Microsoft Dynamics 365 Customer Voice Cross-Site Scripting VulnerabilityCVE-2023-28313 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Microsoft Dynamics 365 Customer Voice Cross-Site Scripting Vulnerability
- Product
- Send Customer Voice survey from Dynamics 365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 13, 2023The Akuvox E11 libvoice library provides unauthenticated access to the camera capture for image and video.CVE-2023-0349 · Other software · Akuvox · reported by ics-cert@hq.dhs.govHigh 7.5
The Akuvox E11 libvoice library provides unauthenticated access to the camera capture for image and video. This could allow an attacker to view and record image and video from the camera.
- Product
- E11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce plugin <= 3.2.5 leading to popup dismiss.CVE-2022-47148 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce plugin <= 3.2.5 leading to popup dismiss.
- Fixed in
- 3.2.6
- What to do
- Update the plugin to 3.2.6 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 11, 2023Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id.CVE-2022-33246 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Feb 7, 2023Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php.CVE-2023-23011 · Other software · Invoiceplane · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php.
- Product
- Invoiceplane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Feb 6, 2023ResponsiveVoice Text To Speech: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0070 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- ResponsiveVoice Text To Speech
- Fixed in
- 1.7.7
- What to do
- Update ResponsiveVoice Text To Speech to 1.7.7 or newer.
Jan 2, 2023Web Invoice: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4372 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well
- Product
- Web Invoice
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Web Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Web Invoice: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4371 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well
- Product
- Web Invoice
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Web Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 27, 2022A vulnerability was found in FreeBPX voicemail.CVE-2021-4283 · Other software · FreeBPX · reported by VulDBLow 2.4
A vulnerability was found in FreeBPX voicemail. It has been rated as problematic. Affected by this issue is some unknown functionality of the file views/ssettings.php of the component Settings Handler. The manipulation of the argument key leads to cross site scripting. The attack may be launched remotely. Upgrading to version 14.0.6.25 is able to address this issue. The name of the patch is ffce4882016076acd16fe0f676246905aa3cb2f3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216872.
- Product
- voicemail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability was found in FreePBX voicemail.CVE-2021-4282 · Other software · FreePBX · reported by VulDBLow 3.5
A vulnerability was found in FreePBX voicemail. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file page.voicemail.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 14.0.6.25 is able to address this issue. The name of the patch is 12e1469ef9208eda9d8955206e78345949236ee6. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216871.
- Product
- voicemail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2022In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissions bypass.CVE-2022-20525 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-229742768
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.