Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,308 results · page 82 of 127
Aug 8, 2023Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure via network access.CVE-2023-39218 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 6.1
Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure via network access.
- Product
- Zoom Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Aug 8, 2023Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow an authenticated user to enable information disclosure via network acceCVE-2023-36535 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.1
Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow an authenticated user to enable information disclosure via network access.
- Product
- Zoom Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Aug 8, 2023 A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction.CVE-2023-20569 · Other software · AMD · reported by psirt@amd.comMedium 4.7
A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure.
- Product
- Ryzen™ 3000 Series Desktop Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comxenbits.xen.org
Aug 8, 2023log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.CVE-2023-39976 · Other software · Clusterlabs · reported by MITRECritical 9.8
log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.
- Product
- Libqb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6 and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_CVE-2023-38940 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6 and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.
- Product
- f1203
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023Tenda F1202 V1.2.0.9 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the mit_ssid parameter in the formWrlsafeset function.CVE-2023-38939 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda F1202 V1.2.0.9 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the mit_ssid parameter in the formWrlsafeset function.
- Product
- f1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023Netgear EX6200 v1.0.3.94 was discovered to contain a buffer overflow via the wla_temp_ssid parameter at acosNvramConfig_set.CVE-2023-38926 · Network & remote access · netgear · reported by MITREHigh 8.8
Netgear EX6200 v1.0.3.94 was discovered to contain a buffer overflow via the wla_temp_ssid parameter at acosNvramConfig_set.
- Product
- ex6200v1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023Netgear DG834Gv5 1.6.01.34 was discovered to contain multiple buffer overflows via the wla_ssid and wla_temp_ssid parameters at bsw_ssid.cgi.CVE-2023-38591 · Network & remote access · netgear · reported by MITREHigh 8.8
Netgear DG834Gv5 1.6.01.34 was discovered to contain multiple buffer overflows via the wla_ssid and wla_temp_ssid parameters at bsw_ssid.cgi.
- Product
- dg834gv5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023Netgear R6900P v1.3.3.154 was discovered to contain multiple buffer overflows via the wla_ssid and wlg_ssid parameters at ia_ap_setting.cgi.CVE-2023-38412 · Network & remote access · netgear · reported by MITREHigh 8.8
Netgear R6900P v1.3.3.154 was discovered to contain multiple buffer overflows via the wla_ssid and wlg_ssid parameters at ia_ap_setting.cgi.
- Product
- r6900p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023Netgear XR300 v1.0.3.78 was discovered to contain multiple buffer overflows via the wla_ssid and wlg_ssid parameters at genie_ap_wifi_change.cgi.CVE-2023-36499 · Network & remote access · netgear · reported by MITREHigh 8.8
Netgear XR300 v1.0.3.78 was discovered to contain multiple buffer overflows via the wla_ssid and wlg_ssid parameters at genie_ap_wifi_change.cgi.
- Product
- xr300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.CVE-2022-48579 · Other software · Rarlab · reported by MITREHigh 7.5
UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.
- Product
- Unrar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Aug 4, 2023OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading toCVE-2022-41401 · Other software · Openrefine · reported by MITREMedium 6.5
OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.
- Product
- Openrefine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2023PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw.CVE-2023-29689 · Other software · Pyrocms · reported by MITRECritical 9.8
PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw. This vulnerability allows a malicious attacker to send customized commands to the server and execute arbitrary code on the affected system.
- Product
- Pyrocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcupc4k3.lol
Aug 3, 2023A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation.CVE-2023-3749 · Other software · Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. · reported by productsecurity@jci.comHigh 7.1
A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation.
- Product
- VideoEdge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Aug 1, 2023Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside BrocadCVE-2023-31427 · Other software · Brocade · reported by sirt@brocade.comHigh 7.8
Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside Brocade Fabric OS to execute any command regardless of assigned privilege. Starting with Fabric OS v9.1.0, “root” account access is disabled.
- Product
- Fabric OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsupport.broadcom.com
Aug 1, 2023A potential power side-channel vulnerability in AMD processors may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache lCVE-2023-20583 · Other software · AMD · reported by psirt@amd.comMedium 4.7
A potential power side-channel vulnerability in AMD processors may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache line changes over time potentially resulting in a leak of sensitive information.
- Product
- Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2023MotoCMS Version 3.4.3 Store Category Template was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the keyword parameter.CVE-2023-36210 · Other software · Motocms · reported by MITRECritical 9.8
MotoCMS Version 3.4.3 Store Category Template was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the keyword parameter.
- Product
- Motocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulners.comexploit-db.com
Aug 1, 2023rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php.CVE-2023-39110 · Other software · Rconfig · reported by MITREHigh 8.8
rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
- Product
- Rconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2023rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php.CVE-2023-39109 · Other software · Rconfig · reported by MITREHigh 8.8
rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
- Product
- Rconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2023rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClass.php.CVE-2023-39108 · Other software · Rconfig · reported by MITREHigh 8.8
rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
- Product
- Rconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Server-Side Request Forgery (SSRF).CVE-2022-42183 · Other software · Precisely · reported by MITRECritical 9.1
Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Server-Side Request Forgery (SSRF).
- Product
- Spectrum Spatial Analyst
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.precisely.comzxsecurity.co.nz
Jul 31, 2023Forminator: Does not properly escape values that are being reflected inside form fields that use pre-populated query parametersCVE-2023-3134 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks.
- Product
- Forminator
- Fixed in
- 1.24.4
- What to do
- Update Forminator to 1.24.4 or newer.
Jul 28, 2023Uninitialized Use in FFmpeg in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pageCVE-2022-4907 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Uninitialized Use in FFmpeg in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Jul 27, 2023Server-Side Request Forgery (SSRF) in GitHub repository omeka/omeka-s prior to 4.0.2.CVE-2023-3981 · Other software · omeka · reported by security@huntr.devMedium 4.9
Server-Side Request Forgery (SSRF) in GitHub repository omeka/omeka-s prior to 4.0.2.
- Product
- omeka/omeka-s
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2023Server Side Request Forgery vulnerability found in Deskpro Support Desk v2021.21.6 allows attackers to execute arbitrary code via a crafted URL.CVE-2021-35391 · Other software · Deskpro · reported by MITREHigh 7.2
Server Side Request Forgery vulnerability found in Deskpro Support Desk v2021.21.6 allows attackers to execute arbitrary code via a crafted URL.
- Product
- Deskpro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsayaanalam.github.iosayaanalam.github.io
Jul 18, 2023IBM Sterling Connect:Express for UNIX 1.5 is vulnerable to server-side request forgery (SSRF).CVE-2023-29260 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Sterling Connect:Express for UNIX 1.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 252135.
- Product
- Sterling Connect:Express for UNIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 16, 2023IBM Robotic Process Automation 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 is vulnerable to client side validation bypass which could allow invalid changeCVE-2023-35901 · Other software · IBM · reported by psirt@us.ibm.comLow 2.7
IBM Robotic Process Automation 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 is vulnerable to client side validation bypass which could allow invalid changes or values in some fields. IBM X-Force ID: 259380.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 12, 2023In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profile due to a missing permission check.CVE-2023-21257 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profile due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Jul 12, 2023Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directoryCVE-2023-22887 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected
- Product
- Apache Airflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Jul 11, 2023An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.CVE-2023-3127 · Other software · Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. · reported by productsecurity@jci.comHigh 7.5
An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.
- Product
- iSTAR Ultra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Jul 11, 2023 A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a pCVE-2023-20575 · Other software · AMD · reported by psirt@amd.comMedium 6.5
A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a program’s execution inside an AMD SEV VM potentially resulting in a leak of sensitive information.
- Product
- 1st Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.CVE-2023-37700 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.
- Product
- fh1203
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager plugin <= 2.9.20 versions.CVE-2023-28986 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager plugin <= 2.9.20 versions.
- Fixed in
- 2.9.21
- What to do
- Update the plugin to 2.9.21 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 1, 2023Lightweight Sidebar Manager: Cross-Site Request ForgeryCVE-2020-36747 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Lightweight Sidebar Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.4. This is due to missing or incorrect nonce validation on the metabox_save() function. This makes it possible for unauthenticated attackers to save metbox data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Lightweight Sidebar Manager
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Lightweight Sidebar Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jun 30, 2023Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request ForgeCVE-2023-35175 · Other software · HP Inc. · reported by hp-security-alert@hp.comCritical 9.8
Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forgery (SSRF) using the Web Service Eventing model.
- Product
- HP LaserJet Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Jun 30, 2023Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administratiCVE-2023-32612 · Other software · WAVLINK TECHNOLOGY Ltd. · reported by vultures@jpcert.or.jpHigh 7.2
Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with the root privilege.
- Product
- WL-WN531AX2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI).CVE-2023-33570 · Other software · Webkul · reported by MITREHigh 8.8
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI).
- Product
- Bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiltonrenato02.medium.comsiltonrenato02.medium.com
Jun 28, 2023In verifyInputEvent of InputDispatcher.cpp, there is a possible way to conduct click fraud due to side channel information disclosure.CVE-2023-21171 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In verifyInputEvent of InputDispatcher.cpp, there is a possible way to conduct click fraud due to side channel information disclosure. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-261085213
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 28, 2023A stack overflow in the Edit_BasicSSID_5G function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.CVE-2023-34934 · Other software · h3c · reported by MITREHigh 7.5
A stack overflow in the Edit_BasicSSID_5G function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- magic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023A stack overflow in the Edit_BasicSSID function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.CVE-2023-34928 · Other software · h3c · reported by MITREHigh 7.5
A stack overflow in the Edit_BasicSSID function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- magic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2023Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9.CVE-2023-3432 · Other software · plantuml · reported by security@huntr.devCritical 10
Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9.
- Product
- plantuml/plantuml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2023A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network CVE-2023-36002 · Other software · Proofpoint · reported by security@proofpoint.comMedium 4.3
A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.
- Product
- Insider Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordproofpoint.comproofpoint.com
Jun 27, 2023A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables an anonymous attacker on an adjacent netCVE-2023-36000 · Other software · Proofpoint · reported by security@proofpoint.comMedium 6.5
A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to obtain sensitive information. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected.
- Product
- Insider Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordproofpoint.comproofpoint.com
Jun 27, 2023A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write unCVE-2023-35998 · Other software · Proofpoint · reported by security@proofpoint.comMedium 4.6
A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write unauthorized objects. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected.
- Product
- Insider Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordproofpoint.comproofpoint.com
Jun 27, 2023An insecure filesystem permission in the Insider Threat Management Agent for Windows enables local unprivileged users to disrupt agent monitoring.CVE-2023-2818 · Other software · Proofpoint · reported by security@proofpoint.comMedium 5.5
An insecure filesystem permission in the Insider Threat Management Agent for Windows enables local unprivileged users to disrupt agent monitoring. All versions prior to 7.14.3 are affected. Agents for MacOS and Linux and Cloud are unaffected.
- Product
- Insider Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordproofpoint.comproofpoint.com
Jun 26, 2023Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.CVE-2021-31635 · Other software · Jfinal · reported by MITRECritical 9.8
Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.
- Product
- Jfinal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side.CVE-2023-35173 · Other software · nextcloud · reported by GitHubMedium 5.7
Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side. By providing an invalid meta data file, an attacker can make previously dropped files inaccessible. It is recommended that the Nextcloud End-to-end encryption app is upgraded to version 1.12.4 that contains the fix.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2023The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.CVE-2023-28006 · Other software · HCL Software · reported by psirt@hcl.comHigh 7
The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.
- Product
- HCL BigFix OSD Bare Metal Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 22, 2023When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 thrCVE-2023-25499 · Other software · vaadin · reported by security@vaadin.comMedium 5.7
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.
- Product
- vaadin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2023VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not properly check whether header sizes would result in accessing data outside of a packet.CVE-2023-35849 · Other software · Virtualsquare · reported by MITREHigh 7.5
VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not properly check whether header sizes would result in accessing data outside of a packet.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.