Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,308 results · page 84 of 127
Apr 19, 2023XSS vulnerability in TripleSign in Tripleplay Platform releases prior to Caveman 3.4.0 allows attackers to inject client-side code to run as an authenticated usCVE-2023-26599 · Other software · Uniguest · reported by MITREMedium 6.1
XSS vulnerability in TripleSign in Tripleplay Platform releases prior to Caveman 3.4.0 allows attackers to inject client-side code to run as an authenticated user via a crafted link.
- Product
- Tripleplay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtripleplay.tvtripleplay.tv
Apr 17, 2023- The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege usersCVE-2023-1427 · WordPress plugins & themes · reported by WPScanMedium 4.9
- The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector.
- Fixed in
- 1.8.15
- What to do
- Update the plugin to 1.8.15 or newer.
Apr 17, 2023Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repoCVE-2023-2017 · Other software · Shopware AG · reported by info@starlabs.sgHigh 8.8
Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing callables. Users are advised to upgrade to v6.4.20.1 to resolve this issue. This is a bypass of CVE-2023-22731.
- Product
- Shopware 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Apr 6, 2023Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected.CVE-2023-24538 · Other software · Go standard library · reported by security@golang.orgCritical 9.8
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow Go template actions from being used inside of them (e.g. "var a = {{.}}"), since there is no obviously safe way to allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will now be escaped. This should be used with caution.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023Unrestricted Upload of File with Dangerous Type vulnerability in Fernus Informatics LMS allows OS Command Injection, Server Side Include (SSI) Injection.CVE-2023-1728 · Other software · Fernus Informatics · reported by iletisim@usom.gov.trCritical 9.8
Unrestricted Upload of File with Dangerous Type vulnerability in Fernus Informatics LMS allows OS Command Injection, Server Side Include (SSI) Injection. This issue affects LMS: before 23.04.03.
- Product
- LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Apr 3, 2023Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.CVE-2023-26976 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.
- Product
- Ac6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2023request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}.CVE-2023-27163 · Other software · Rbaskets · reported by MITREMedium 6.5
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
- Product
- Request Baskets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Mar 31, 2023openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}.CVE-2023-27162 · Other software · Openapi-generator · reported by MITRECritical 9.1
openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
- Product
- Openapi Generator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 31, 2023forem up to v2022.11.11 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /articles/{id}.CVE-2023-27160 · Other software · Forem · reported by MITREHigh 7.2
forem up to v2022.11.11 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /articles/{id}. This vulnerability allows attackers to access network resources and sensitive information via a crafted POST request.
- Product
- Forem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 31, 2023Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon.CVE-2023-27159 · Other software · Appwrite · reported by MITREHigh 7.5
Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.
- Product
- Appwrite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Mar 30, 2023Unpoly is a JavaScript framework for server-side web applications.CVE-2023-28846 · Other software · unpoly · reported by GitHubMedium 5.9
Unpoly is a JavaScript framework for server-side web applications. There is a possible Denial of Service (DoS) vulnerability in the `unpoly-rails` gem that implements the Unpoly server protocol for Rails applications. This issues affects Rails applications that operate as an upstream of a load balancer's that uses passive health checks. The `unpoly-rails` gem echoes the request URL as an `X-Up-Location` response header. By making a request with exceedingly long URLs (paths or query string), an attacker can cause unpoly-rails to write a exceedingly large response header. If the response header is too large to be parsed by a load balancer downstream of the Rails application, it may cause the load balancer to remove the upstream from a load balancing group. This causes that application instance to become unavailable until a configured timeout is reached or until an active healthcheck succeeds. This issue has been fixed and released as version 2.7.2.2 which is available via RubyGems and GitHub. Users unable to upgrade may: Configure your load balancer to use active health checks, e.g. by periodically requesting a route with a known response that indicates healthiness; Configure your l
- Product
- unpoly-rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.nginx.comgithub.com
Mar 30, 2023Server-Side Request Forgery (SSRF) vulnerability in Infoline Project Management System allows Server Side Request Forgery.CVE-2023-1725 · Other software · Infoline · reported by iletisim@usom.gov.trCritical 9.8
Server-Side Request Forgery (SSRF) vulnerability in Infoline Project Management System allows Server Side Request Forgery. This issue affects Project Management System: before 4.09.31.125.
- Product
- Project Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Mar 28, 2023Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract.CVE-2023-25195 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract. Authorized users with limited permissions can gain access to server and may be able to use server for any outbound traffic. This issue affects Apache Fineract: from 1.4 through 1.8.3.
- Product
- Apache Fineract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Mar 27, 2023Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF).CVE-2023-25262 · Other software · Stimulsoft · reported by MITREHigh 7.5
Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe Reporting Designer (Web) offers the possibility to embed sources from external locations. If the user chooses an external location, the request to that resource is performed by the server rather than the client. Therefore, the server causes outbound traffic and potentially imports data. An attacker may also leverage this behaviour to exfiltrate data of machines on the internal network of the server hosting the Stimulsoft Reporting Designer (Web).
- Product
- Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloud-trustit.spp.atcves.at
Mar 24, 2023angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment variables.CVE-2023-28444 · Other software · kyubisation · reported by GitHubCritical 9.9
angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment variables. angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a ngssc.json file in the output directory. During deployment of an Angular based app, the environment variables based on the variables from ngssc.json are inserted into the apps index.html (or defined index file). With version 15.0.0 the environment variable detection was widened to the entire project, relative to the angular.json file from the Angular CLI. In a monorepo setup, this could lead to environment variables intended for a backend/service to be detected and written to the ngssc.json, which would then be populated and exposed via index.html. This has NO IMPACT, in a plain Angular project that has no backend component. This vulnerability has been mitigated in version 15.1.0, by adding an option `searchPattern` which restricts the detection file range by default. As a workaround, manually edit or create ngssc.json or run script after ngssc.j
- Product
- angular-server-side-configuration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2023In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names.CVE-2022-48423 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn.kernel.orggit.kernel.org
Mar 15, 2023IBM Robotic Process Automation 21.0.0 - 21.0.7 and 23.0.0 is vulnerable to client-side validation bypass for credential pools.CVE-2022-46773 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Robotic Process Automation 21.0.0 - 21.0.7 and 23.0.0 is vulnerable to client-side validation bypass for credential pools. Invalid credential pools may be created as a result. IBM X-Force ID: 242951.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 13, 2023github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow.CVE-2023-27581 · Other software · rlespinasse · reported by GitHubHigh 8.8
github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. This can be used to execute code on the GitHub runners and to exfiltrate any secrets one uses in the CI pipeline. A patched action is available in version 4.4.1. No workaround is available.
- Product
- github-slug-action
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023McAfee Total Protection prior to 16.0.49 allows attackers to elevate user privileges due to DLL sideloading.CVE-2023-24578 · Other software · Mcafee · reported by MITREMedium 5.5
McAfee Total Protection prior to 16.0.49 allows attackers to elevate user privileges due to DLL sideloading. This could enable a user with lower privileges to execute unauthorized tasks.
- Product
- Total Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to CVE-2023-0628 · Other software · Docker Inc. · reported by security@docker.comMedium 6.1
Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comdocs.docker.com
Mar 10, 2023Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /Repositories.CVE-2023-27161 · Other software · Jellyfin · reported by MITREHigh 7.5
Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /Repositories. This vulnerability allows attackers to access network resources and sensitive information via a crafted POST request.
- Product
- Jellyfin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 7, 2023A Server-Side Request Forgery (SSRF) in loonflow r2.0.14 allows attackers to force the application to make arbitrary requests via manipulation of the hook_url pCVE-2023-25230 · Other software · Loonflow Project · reported by MITREMedium 4.9
A Server-Side Request Forgery (SSRF) in loonflow r2.0.14 allows attackers to force the application to make arbitrary requests via manipulation of the hook_url parameter.
- Product
- Loonflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2023An issue discovered in com.samourai.wallet.PinEntryActivity.java in Streetside Samourai Wallet 0.99.96i allows attackers to view sensitive information and decryCVE-2021-36689 · Other software · Samourai-wallet-android Project · reported by MITREMedium 5.5
An issue discovered in com.samourai.wallet.PinEntryActivity.java in Streetside Samourai Wallet 0.99.96i allows attackers to view sensitive information and decrypt data via a brute force attack that uses a recovered samourai.dat file. The PIN is 5 to 8 digits, which may be insufficient in this situation.
- Product
- Samourai-wallet-android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.samourai.iovrls.ws
Mar 3, 2023Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability.CVE-2022-46973 · Other software · Anji-plus · reported by MITRECritical 9.8
Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability.
- Product
- Aj-report
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2023Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateBlankTxtview.php.CVE-2023-24643 · Other software · Judging Management System Project · reported by MITRECritical 9.8
Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateBlankTxtview.php.
- Product
- Judging Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2023Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateTxtview.php.CVE-2023-24642 · Other software · Judging Management System Project · reported by MITRECritical 9.8
Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateTxtview.php.
- Product
- Judging Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2023Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateview.php.CVE-2023-24641 · Other software · Judging Management System Project · reported by MITRECritical 9.8
Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateview.php.
- Product
- Judging Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the ssid_5g parameter at /goform/WifiBasicSet.CVE-2023-24122 · Other software · Heimgardtechnologies · reported by MITREMedium 6.5
Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the ssid_5g parameter at /goform/WifiBasicSet.
- Product
- Eagle 1200ac Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the ssid parameter at /goform/WifiBasicSet.CVE-2023-24119 · Other software · Heimgardtechnologies · reported by MITREMedium 6.5
Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the ssid parameter at /goform/WifiBasicSet.
- Product
- Eagle 1200ac Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Unauthenticated server side request forgery in HPE Serviceguard ManagerCVE-2022-37938 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Unauthenticated server side request forgery in HPE Serviceguard Manager
- Product
- HPE Serviceguard for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 28, 2023In multiple files, there is a possible way to preserve WiFi settings due to residual data after a reset.CVE-2022-20481 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In multiple files, there is a possible way to preserve WiFi settings due to residual data after a reset. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-241927115
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Feb 27, 2023Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function formOneSsidCfgSet via parameter ssid.CVE-2023-25235 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function formOneSsidCfgSet via parameter ssid.
- Product
- Ac500 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2023Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.CVE-2023-26468 · Other software · Cerebrate-project · reported by MITRECritical 9.1
Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.
- Product
- Cerebrate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023Vditor is a browser-side Markdown editor.CVE-2021-32855 · Other software · npm · reported by GitHubMedium 6.1
Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. Version 3.8.7 contains a patch for this issue.
- Product
- vditor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023Video Sidebar Widgets: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4785 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Sidebar Widgets WordPress plugin through 6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Video Sidebar Widgets
- Affected
- up to 6.1
- What to do
- Affects up to 6.1. Update Video Sidebar Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2023Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted enCVE-2022-48321 · Other software · Tribe29 · reported by security@checkmk.comMedium 6.8
Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted endpoints by use of the host registration API.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheckmk.comsonarsource.com
Feb 20, 2023Liima before 1.17.28 allows server-side template injection.CVE-2023-26092 · Other software · Puzzle · reported by MITRECritical 9.8
Liima before 1.17.28 allows server-side template injection.
- Product
- Liima
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2023A vulnerability was found in doomsider shadow.CVE-2016-15024 · Other software · doomsider · reported by VulDBLow 2.5
A vulnerability was found in doomsider shadow. It has been classified as problematic. Affected is an unknown function. The manipulation leads to denial of service. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is told to be difficult. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 3332c5ba9ec3014ddc74e2147190a050eee97bc0. It is recommended to apply a patch to fix this issue. VDB-221478 is the identifier assigned to this vulnerability.
- Product
- shadow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Server-side request forgery in the CVAT software maintained by Intel(R) before version 2.0.1 may allow an authenticated user to potentially enable information dCVE-2022-27234 · Other software · Intel · reported by secure@intel.comMedium 4.3
Server-side request forgery in the CVAT software maintained by Intel(R) before version 2.0.1 may allow an authenticated user to potentially enable information disclosure via network access.
- Product
- Computer Vision Annotation Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS.CVE-2023-0361 · Other software · Siemens · reported by Red HatHigh 7.4
A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comgithub.com
Feb 15, 2023If an attacker were to access memory locations of LS ELECTRIC XBC-DN32U with operating system version 01.80 that are outside of the communication buffer, the deCVE-2023-0103 · Other software · LS Electric · reported by ics-cert@hq.dhs.govHigh 7.5
If an attacker were to access memory locations of LS ELECTRIC XBC-DN32U with operating system version 01.80 that are outside of the communication buffer, the device stops operating. This could allow an attacker to cause a denial-of-service condition.
- Product
- XBC-DN32U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able toCVE-2023-25765 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comCritical 9.9
In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
- Product
- Jenkins Email Extension Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Feb 14, 2023In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF)CVE-2023-22936 · Other software · Splunk · reported by prodsec@splunk.comMedium 6.3
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF) by an authenticated user. The initiator of the request cannot see the response without the presence of an additional vulnerability within the environment.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.splunk.comresearch.splunk.com
Feb 13, 2023Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory.CVE-2022-25937 · Other software · Glance Project · reported by report@snyk.ioMedium 6.5
Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerability reported in [CVE-2018-3715](https://security.snyk.io/vuln/npm:glance:20180129).
- Product
- Glance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Feb 11, 2023Server-Side Request Forgery (SSRF) vulnerability in Group Arge Energy and Control Systems Smartpower Web allows : Server Side Request Forgery.CVE-2022-45085 · Other software · Group Arge Energy and Control Systems · reported by iletisim@usom.gov.trMedium 6.5
Server-Side Request Forgery (SSRF) vulnerability in Group Arge Energy and Control Systems Smartpower Web allows : Server Side Request Forgery. This issue affects Smartpower Web: before 23.01.01.
- Product
- Smartpower Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 9, 2023An issue in Mojoportal v2.7.0.0 and below allows an authenticated attacker to list all css files inside the root path of the webserver via manipulation of the "CVE-2023-24689 · Other software · Mojoportal · reported by MITREMedium 4.3
An issue in Mojoportal v2.7.0.0 and below allows an authenticated attacker to list all css files inside the root path of the webserver via manipulation of the "s" parameter in /DesignTools/ManageSkin.aspx
- Product
- Mojoportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commojoportal.com
Feb 9, 2023Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID.CVE-2023-21429 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Feb 9, 2023Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive AuthenticaCVE-2023-0574 · Other software · YugabyteDB · reported by security@yugabyte.comMedium 6.8
Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Properly Constrained by ACLs, Communication Channel Manipulation, Authentication Abuse.This issue affects Yugabyte Managed: from 2.0.0.0 through 2.13.0.0
- Product
- YugabyteDB Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyugabyte.comyugabyte.com
Feb 8, 2023There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName.CVE-2023-0286 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgHigh 7.4
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.openbsd.orgftp.openbsd.org
Feb 8, 2023A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a BleichenbCVE-2022-4304 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgMedium 5.9
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgopenssl.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.