Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,626 results · page 81 of 93
Oct 29, 2021DSpace is an open source turnkey repository application.CVE-2021-41189 · Other software · DSpace · reported by GitHubHigh 7.2
DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a workaround, users of 7.0 may temporarily disable the ability for community or collection administrators to manage permissions or workflows settings.
- Product
- DSpace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2021Roblox-Purchasing-Hub is an open source Roblox product purchasing hub.CVE-2021-41191 · Other software · Redon-Tech · reported by GitHubHigh 7.5
Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone's API URL to get product files without an API key. This issue is fixed in version 1.0.2. As a workaround, add `@require_apikey` in `BOT/lib/cogs/website.py` under the route for `/v1/products`.
- Product
- Roblox-Purchasing-Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2021Shopware is open source e-commerce software.CVE-2021-41188 · Other software · shopware · reported by GitHubMedium 5.7
Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the `.htaccess` file will protect against cross-site scripting in this case. There is also a config for those using nginx as a server. The plugin and the configs can be found on the GitHub Security Advisory page for this vulnerability.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Oct 22, 2021TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a cross-site scripting (XSS) vulnerability in the content parameter of the Rubric BlocCVE-2020-36499 · Other software · Taotesting · reported by MITREMedium 5.4
TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a cross-site scripting (XSS) vulnerability in the content parameter of the Rubric Block (Add) module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the rubric name value.
- Product
- TAO Assessment Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 22, 2021TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a HTML injection vulnerability in the userFirstName parameter of the user account inpuCVE-2020-23050 · Other software · Taotesting · reported by MITREHigh 8
TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a HTML injection vulnerability in the userFirstName parameter of the user account input field. This vulnerability allows attackers to execute phishing attacks, external redirects, and arbitrary code.
- Product
- TAO Assessment Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgvulnerability-lab.com
Oct 22, 2021eLabFTW is an open source electronic lab notebook manager for research teams.CVE-2021-41171 · Other software · elabftw · reported by GitHubMedium 5.9
eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing brute force login protection, as recommended by Owasp with Device Cookies. This mechanism will not impact users and will effectively thwart any brute-force attempts at guessing passwords. The only correct way to address this is to upgrade to version 4.1.0. Adding rate limitation upstream of the eLabFTW service is of course a valid option, with or without upgrading.
- Product
- elabftw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2021Rasa is an open source machine learning framework to automate text-and voice-based conversations.CVE-2021-41127 · Other software · RasaHQ · reported by GitHubHigh 7.3
Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exists in the functionality that loads a trained model `tar.gz` file which allows a malicious actor to craft a `model.tar.gz` file which can overwrite or replace bot files in the bot directory. The vulnerability is fixed in Rasa 2.8.10. For users unable to update ensure that users do not upload untrusted model files, and restrict CLI or API endpoint access where a malicious actor could target a deployed Rasa instance.
- Product
- rasa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2021qutebrowser is an open source keyboard-focused browser with a minimal GUI.CVE-2021-41146 · Other software · qutebrowser · reported by GitHubHigh 8.8
qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a `qutebrowserurl:` URL handler. With certain applications, opening a specially crafted `qutebrowserurl:...` URL can lead to execution of qutebrowser commands, which in turn allows arbitrary code execution via commands such as `:spawn` or `:debug-pyeval`. Only Windows installs where qutebrowser is registered as URL handler are affected. The issue has been fixed in qutebrowser v2.4.0. The fix also adds additional hardening for potential similar issues on Linux (by adding the new --untrusted-args flag to the .desktop file), though no such vulnerabilities are known.
- Product
- qutebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2021Discourse is an open source platform for community discussion.CVE-2021-41163 · Other software · discourse · reported by GitHubCritical 10
Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in subscribe_url values. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. To workaround the issue without updating, requests with a path starting /webhooks/aws path could be blocked at an upstream proxy.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2021modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises.CVE-2021-41167 · Other software · nicolas-van · reported by GitHubHigh 7.5
modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround.
- Product
- modern-async
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2021Combodo iTop is an open source web based IT Service Management tool.CVE-2021-32664 · Other software · Combodo · reported by GitHubHigh 8.1
Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2021iTop is an open source web based IT Service Management tool.CVE-2021-32663 · Other software · Combodo · reported by GitHubHigh 8.7
iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2021Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration.CVE-2021-41155 · Other software · Enalean · reported by GitHubHigh 8.8
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not sanitize properly user inputs when constructing the SQL query to browse and search revisions in the CVS repositories. The following versions contain the fix: Tuleap Community Edition 11.17.99.146, Tuleap Enterprise Edition 11.17-5, Tuleap Enterprise Edition 11.16-7.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2021Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration.CVE-2021-41154 · Other software · Enalean · reported by GitHubHigh 8.8
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions an attacker with read access to a "SVN core" repository could execute arbitrary SQL queries. The following versions contain the fix: Tuleap Community Edition 11.17.99.144, Tuleap Enterprise Edition 11.17-5, Tuleap Enterprise Edition 11.16-7.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2021anuko/timetracker is an, open source time tracking system.CVE-2021-41156 · Other software · anuko · reported by GitHubMedium 6.8
anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browser_today hidden control on a few pages to collect the today's date from user browsers. Because of not checking this parameter for sanity in versions prior to 1.19.30.5601, it was possible to craft an html form with malicious JavaScript, use social engineering to convince logged on users to execute a POST from such form, and have the attacker-supplied JavaScript to be executed in user's browser. This has been patched in version 1.19.30.5600. Upgrade is recommended. If it is not practical, introduce ttValidDbDateFormatDate function as in the latest version and add a call to it within the access checks block.
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2021Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments.CVE-2021-41148 · Other software · Enalean · reported by GitHubHigh 8.8
Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with the ability to add one the CI widget to its personal dashboard could execute arbitrary SQL queries. Tuleap Community Edition 11.16.99.173, Tuleap Enterprise Edition 11.16-6, and Tuleap Enterprise Edition 11.15-8 contain a patch for this issue.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2021Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments.CVE-2021-41147 · Other software · Enalean · reported by GitHubHigh 7.2
Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with admin rights in one agile dashboard service can execute arbitrary SQL queries. Tuleap Community Edition 11.16.99.173, Tuleap Enterprise Edition 11.16-6, and Tuleap Enterprise Edition 11.15-8 contain a patch for this issue.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2021Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments.CVE-2021-41142 · Other software · Enalean · reported by GitHubMedium 5.4
Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. There is a cross-site scripting vulnerability in Tuleap Community Edition prior to 12.11.99.25 and Tuleap Enterprise Edition 12.11-2. A malicious user with the capability to add and remove attachment to an artifact could force a victim to execute uncontrolled code. Tuleap Community Edition 11.17.99.146 and Tuleap Enterprise Edition 12.11-2 contain a fix for the issue.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2021Anuko Time Tracker is an open source, web-based time tracking application written in PHP.CVE-2021-41139 · Other software · anuko · reported by GitHubHigh 8.1
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time Tracker, it is being passed on via the date parameter in URI. Because of not checking this parameter for sanity in versions prior to 1.19.30.5600, it was possible to craft the URI with malicious JavaScript, use social engineering to convince logged on user to click on such link, and have the attacker-supplied JavaScript to be executed in user's browser. This issue is patched in version 1.19.30.5600. As a workaround, one may introduce `ttValidDbDateFormatDate` function as in the latest version and add a call to it within the access checks block in time.php.
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2021Zulip is an open source team chat server.CVE-2021-41115 · Other software · zulip · reported by GitHubMedium 4.3
Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers" that automatically create links from messages that users send, detected via arbitrary regular expressions. Malicious organization administrators could subject the server to a denial-of-service via regular expression complexity attacks; most simply, by configuring a quadratic-time regular expression in a linkifier, and sending messages that exploited it. A regular expression attempted to parse the user-provided regexes to verify that they were safe from ReDoS -- this was both insufficient, as well as _itself_ subject to ReDoS if the organization administrator entered a sufficiently complex invalid regex. Affected users should [upgrade to the just-released Zulip 4.7](https://zulip.readthedocs.io/en/latest/production/upgrade-or-modify.html#upgrading-to-a-release), or [`main`](https://zulip.readthedocs.io/en/latest/production/upgrade-or-modify.html#upgrading-from-a-git-repository).
- Product
- zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2021Composer is an open source dependency manager for the PHP language.CVE-2021-41116 · Other software · composer · reported by GitHubHigh 8.2
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.
- Product
- composer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2021TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2021-41114 · Other software · TYPO3 · reported by GitHubMedium 4.8
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment. This vulnerability is the same as described in TYPO3-CORE-SA-2014-001 (CVE-2014-3941). A regression, introduced during TYPO3 v11 development, led to this situation. The already existing setting $GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern'] (used as an effective mitigation strategy in previous TYPO3 versions) was not evaluated anymore, and reintroduced the vulnerability.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2021TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2021-41113 · Other software · TYPO3 · reported by GitHubHigh 8.8
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the new TYPO3 v11 feature that allows users to create and share deep links in the backend user interface is vulnerable to cross-site-request-forgery. The impact is the same as described in TYPO3-CORE-SA-2020-006 (CVE-2020-11069). However, it is not limited to the same site context and does not require the attacker to be authenticated. In a worst case scenario, the attacker could create a new admin user account to compromise the system. To successfully carry out an attack, an attacker must trick his victim to access a compromised system. The victim must have an active session in the TYPO3 backend at that time. The following Same-Site cookie settings in $GLOBALS[TYPO3_CONF_VARS][BE][cookieSameSite] are required for an attack to be successful: SameSite=strict: malicious evil.example.org invoking TYPO3 application at good.example.org and SameSite=lax or none: malicious evil.com invoking TYPO3 application at example.org. Update your instance to TYPO3 version 11.5.0 which addresses the problem described.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Wire-server is the backing server for the open source wire secure messaging application.CVE-2021-41100 · Other software · wireapp · reported by GitHubHigh 7.4
Wire-server is the backing server for the open source wire secure messaging application. In affected versions it is possible to trigger email address change of a user with only the short-lived session token in the `Authorization` header. As the short-lived token is only meant as means of authentication by the client for less critical requests to the backend, the ability to change the email address with a short-lived token constitutes a privilege escalation attack. Since the attacker can change the password after setting the email address to one that they control, changing the email address can result in an account takeover by the attacker. Short-lived tokens can be requested from the backend by Wire clients using the long lived tokens, after which the long lived tokens can be stored securely, for example on the devices key chain. The short lived tokens can then be used to authenticate the client towards the backend for frequently performed actions such as sending and receiving messages. While short-lived tokens should not be available to an attacker per-se, they are used more often and in the shape of an HTTP header, increasing the risk of exposure to an attacker relative to the lo
- Product
- wire-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Wire is an open source secure messenger.CVE-2021-41094 · Other software · wireapp · reported by GitHubMedium 4.2
Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling their device passcode. Upon launching, the app will attempt to enable encryption at rest by generating encryption keys via the Secure Enclave, however it will fail silently if no device passcode is set. The user has no indication that encryption at rest is not active since the feature is hidden to them. This issue has been resolved in version 3.70
- Product
- wire-ios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Wire is an open source secure messenger.CVE-2021-41093 · Other software · wireapp · reported by GitHubHigh 7.4
Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally requires an authentication cookie. See wire-ios-sync-engine and wire-ios-transport references. This is the root advisory that pulls the changes together.
- Product
- wire-ios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Redis is an open source, in-memory database that persists on disk.CVE-2021-41099 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. The vulnerability involves changing the default proto-max-bulk-len configuration parameter to a very large value and constructing specially crafted network payloads or commands. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Redis is an open source, in-memory database that persists on disk.CVE-2021-32762 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis library which does not perform an overflow check before calling the calloc() heap allocation function. This issue only impacts systems with heap allocators that do not perform their own overflow checks. Most modern systems do and are therefore not likely to be affected. Furthermore, by default redis-sentinel uses the jemalloc allocator which is also not vulnerable. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Redis is an open source, in-memory database that persists on disk.CVE-2021-32687 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the set-max-intset-entries configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Redis is an open source, in-memory database that persists on disk.CVE-2021-32675 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). An attacker delivering specially crafted requests over multiple connections can cause the server to allocate significant amount of memory. Because the same parsing mechanism is used to handle authentication requests, this vulnerability can also be exploited by unauthenticated users. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways: Using network access control tools like firewalls, iptables, security groups, etc. or Enabling TLS and requiring users to authenticate using client side certificates.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Redis is an open source, in-memory database that persists on disk.CVE-2021-32672 · Other software · redis · reported by GitHubMedium 5.3
Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Redis is an open source, in-memory database that persists on disk.CVE-2021-32628 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value) to a very large value, and then constructing specially crafted commands to create very large ziplists. The problem is fixed in Redis versions 6.2.6, 6.0.16, 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the above configuration parameters. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Redis is an open source, in-memory database that persists on disk.CVE-2021-32627 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default proto-max-bulk-len and client-query-buffer-limit configuration parameters to very large values and constructing specially crafted very large stream elements. The problem is fixed in Redis 6.2.6, 6.0.16 and 5.0.14. For users unable to upgrade an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Redis is an open source, in-memory database that persists on disk.CVE-2021-32626 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021containerd is an open source container runtime with an emphasis on simplicity, robustness and portability.CVE-2021-41103 · Other software · containerd · reported by GitHubHigh 7.8
containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This vulnerability has been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are released and may restart containers or update directory permissions to mitigate the vulnerability. Users unable to update should limit access to the host to trusted users. Update directory permission on container bundles directories.
- Product
- containerd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comgithub.com
Sep 30, 2021Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.CVE-2021-41109 · Other software · parse-community · reported by GitHubHigh 7.5
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the `Parse.User` class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload. A patch in version 4.10.4 removes session tokens from the LiveQuery payload. As a workaround, set `user.acl(new Parse.ACL())` in a beforeSave trigger to make the user private already on sign-up.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2021Discourse is an open source discussion platform.CVE-2021-41095 · Other software · discourse · reported by GitHubMedium 4.2
Discourse is an open source discussion platform. There is a cross-site scripting (XSS) vulnerability in versions 2.7.7 and earlier of the `stable` branch, versions 2.8.0.beta6 and earlier of the `beta` branch, and versions 2.8.0.beta6 and earlier of the `tests-passed` branch. Rendering of some error messages that contain user input can be susceptible to XSS attacks. This vulnerability only affects sites which have blocked watched words that contain HTML tags, modified or disabled Discourse's default Content Security Policy. This issue is patched in the latest `stable`, `beta` and `tests-passed` versions of Discourse. As a workaround, avoid modifying or disabling Discourse’s default Content Security Policy, and blocking watched words containing HTML tags.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2021jsuites is an open source collection of common required javascript web components.CVE-2021-41086 · Other software · jsuites · reported by GitHubHigh 8.7
jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scripting (XSS) attacks via clipboard content. jsuites is vulnerable to DOM based XSS if the user can be tricked into copying _anything_ from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to `innerHTML` allowing for javascript injection and thus XSS. Users are advised to update to version 4.9.11 to resolve.
- Product
- jsuites
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2021http4s is an open source scala interface for HTTP.CVE-2021-41084 · Other software · http4s · reported by GitHubHigh 8.7
http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`å), Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.
- Product
- http4s
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2021Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available.CVE-2021-39229 · Other software · caronc · reported by GitHubHigh 7.5
Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. In affected versions users who use Apprise granting them access to the IFTTT plugin (which just comes out of the box) are subject to a denial of service attack on an inefficient regular expression. The vulnerable regular expression is [here](https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1aad980cfff253/apprise/plugins/NotifyIFTTT.py#L356-L359). The problem has been patched in release version 0.9.5.1. Users who are unable to upgrade are advised to remove `apprise/plugins/NotifyIFTTT.py` to eliminate the service.
- Product
- apprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021Wasmtime is an open source runtime for WebAssembly & WASI.CVE-2021-39218 · Other software · bytecodealliance · reported by GitHubMedium 6.3
Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses `externref`s in Wasmtime. To trigger this bug, Wasmtime needs to be running Wasm that uses `externref`s, the host creates non-null `externrefs`, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC safepoint where there are no live references at this safepoint, and there is a safepoint with live references earlier in this frame's function. Under this scenario, Wasmtime would incorrectly use the GC stack map for the safepoint from earlier in the function instead of the empty safepoint. This would result in Wasmtime treating arbitrary stack slots as `externref`s that needed to be rooted for GC. At the *next* GC, it would be determined that nothing was referencing these bogus `externref`s (because nothing could ever reference them, because they are not really `externref`s) and then Wasmtime would deallocate them and run `<ExternRef as Drop>::drop` on them. This results in a fre
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021Wasmtime is an open source runtime for WebAssembly & WASI.CVE-2021-39219 · Other software · bytecodealliance · reported by GitHubMedium 6.3
Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the `wasmtime` crate clearly marks which functions are safe and which are `unsafe`, guaranteeing that if consumers never use `unsafe` then it should not be possible to have memory unsafety issues in their embeddings of Wasmtime. An issue was discovered in the safe API of `Linker::func_*` APIs. These APIs were previously not sound when one `Engine` was used to create the `Linker` and then a different `Engine` was used to create a `Store` and then the `Linker` was used to instantiate a module into that `Store`. Cross-`Engine` usage of functions is not supported in Wasmtime and this can result in type confusion of function pointers, resulting in being able to safely call a function with the wrong type. Triggering this bug requires using at least two `Engine` values in an embedding and then additionally using two different values with a `Linker` (one at the creation time of the `Linker` and another when instantiating a module with the `Linker`). It's expected that usage of more-than-one `Engine` in an embedding is relatively rare sin
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021Wasmtime is an open source runtime for WebAssembly & WASI.CVE-2021-39216 · Other software · bytecodealliance · reported by GitHubMedium 6.3
Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-free bug when passing `externref`s from the host to guest Wasm content. To trigger the bug, you have to explicitly pass multiple `externref`s from the host to a Wasm instance at the same time, either by passing multiple `externref`s as arguments from host code to a Wasm function, or returning multiple `externref`s to Wasm from a multi-value return function defined in the host. If you do not have host code that matches one of these shapes, then you are not impacted. If Wasmtime's `VMExternRefActivationsTable` became filled to capacity after passing the first `externref` in, then passing in the second `externref` could trigger a garbage collection. However the first `externref` is not rooted until we pass control to Wasm, and therefore could be reclaimed by the collector if nothing else was holding a reference to it or otherwise keeping it alive. Then, when control was passed to Wasm after the garbage collection, Wasm could use the first `externref`, which at this point has already been freed. We have reason to believe that the effective impact of
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021Jitsi Meet is an open source video conferencing application.CVE-2021-39215 · Other software · jitsi · reported by GitHubHigh 7.5
Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating.
- Product
- jitsi-meet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021Jitsi Meet is an open source video conferencing application.CVE-2021-39205 · Other software · jitsi · reported by GitHubMedium 6.8
Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.
- Product
- jitsi-meet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021Pimcore is an open source data & experience management platform.CVE-2021-39189 · Other software · pimcore · reported by GitHubMedium 5.3
Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021Pomerium is an open source identity-aware access proxy.CVE-2021-39206 · Other software · pomerium · reported by GitHubHigh 8.6
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched. This issue can only be triggered when using path prefix based policy. Removing any such policies should provide mitigation.
- Product
- pomerium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021Pomerium is an open source identity-aware access proxy.CVE-2021-39204 · Other software · pomerium · reported by GitHubHigh 7.5
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.
- Product
- pomerium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021Pomerium is an open source identity-aware access proxy.CVE-2021-39162 · Other software · pomerium · reported by GitHubHigh 8.6
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.
- Product
- pomerium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2021ZStack is open source IaaS(infrastructure as a service) software.CVE-2021-32836 · Other software · zstackio · reported by GitHubHigh 7.5
ZStack is open source IaaS(infrastructure as a service) software. In ZStack before versions 3.10.12 and 4.1.6 there is a pre-auth unsafe deserialization vulnerability in the REST API. An attacker in control of the request body will be able to provide both the class name and the data to be deserialized and therefore will be able to instantiate an arbitrary type and assign arbitrary values to its fields. This issue may lead to a Denial Of Service. If a suitable gadget is available, then an attacker may also be able to exploit this vulnerability to gain pre-auth remote code execution. For additional details see the referenced GHSL-2021-087.
- Product
- zstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.