Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,308 results · page 85 of 127
Feb 1, 2023A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a crafted payload injeCVE-2022-47872 · Other software · Maccms · reported by MITREHigh 8.8
A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a crafted payload injected into the Name parameter under the Interface address module.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MCVE-2023-22664 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023Eta is an embedded JS templating engine that works inside Node, Deno, and the browser.CVE-2023-23630 · Other software · eta-dev · reported by GitHubHigh 8.6
Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`.
- Product
- eta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023 ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of CVE-2023-0591 · Other software · jrspruitt · reported by research@onekey.comMedium 5.5
ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction directory (provided the process has write access to that file or directory). This is due to the fact that a node name (dent_node.name) is considered trusted and joined to the extraction directory path during processing, then the node content is written to that joined path. By crafting a malicious UBIFS file with node names holding path traversal payloads (e.g. ../../tmp/outside.txt), it's possible to force ubi_reader to write outside of the extraction directory. This issue affects ubi-reader before 0.8.5.
- Product
- ubi_reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2023In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.CVE-2022-4898 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.4
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was taken to prevent the possibility of the support link being susceptible to XSS
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Jan 27, 2023LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenuliCVE-2022-48010 · Other software · Limesurvey · reported by MITREMedium 5.4
LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenulink?subaction=surveytexts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Welcome-message text fields. NOTE: the vendor indicates that this is not a vulnerability because the manipulation requires Superadministrator privileges, and Superadministrators are already allowed to customize surveys with JavaScript as they wish.
- Product
- Limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality.CVE-2023-24060 · Other software · Havenweb · reported by MITREMedium 5
Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname (or even the hostname of the Haven server itself). NOTE: this product has significant usage but does not have numbered releases; ordinary end users may typically use the master branch.
- Product
- Haven
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhavenweb.org
Jan 26, 2023Dentsply Sirona Sidexis <= 4.3 is vulnerable to Unquoted Service Path.CVE-2022-44264 · Other software · Dentsplysirona · reported by MITREHigh 7.8
Dentsply Sirona Sidexis <= 4.3 is vulnerable to Unquoted Service Path.
- Product
- Sidexis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Dentsply Sirona Sidexis <= 4.3 is vulnerable to Incorrect Access Control.CVE-2022-44263 · Other software · Dentsplysirona · reported by MITREHigh 7.8
Dentsply Sirona Sidexis <= 4.3 is vulnerable to Incorrect Access Control.
- Product
- Sidexis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data.CVE-2023-24495 · Other software · Tenable · reported by vulnreport@tenable.comMedium 6.5
A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. A privileged, authenticated remote attacker could interact with external and internal services covertly.
- Product
- Tenable.sc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 26, 2023LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools.CVE-2023-23611 · Other software · openedx · reported by GitHubMedium 5.4
LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back for any LTI XBlock so long as it knows or can guess the block location for that XBlock. An LTI tool submits scores to the edX platform for line items. The code that uploads that score to the LMS grade tables determines which XBlock to upload the grades for by reading the resource_link_id field of the associated line item. The LTI tool may submit any value for the resource_link_id field, allowing a malicious LTI tool to submit scores for any LTI XBlock on the platform. The impact is a loss of integrity for LTI XBlock grades. This issue is patched in 7.2.2. No workarounds exist.
- Product
- xblock-lti-consumer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF).CVE-2022-46998 · Other software · Taogogo · reported by MITRECritical 9.8
An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF).
- Product
- Taocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2023ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF).CVE-2021-43449 · Other software · Onlyoffice · reported by MITREHigh 8.1
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve arbitrary URLs as a document.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
Jan 21, 2023A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request heCVE-2023-24044 · Websites & servers · Plesk · reported by MITREMedium 6.1
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."
- Product
- Obsidian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.commedium.com
Jan 20, 2023 Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability.CVE-2023-23691 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability to force a victim's browser to desynchronize its connection with the website, typically leading to XSS and DoS.
- Product
- Dell PowerVault ME5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023Sidebar Widgets by CodeLights: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4460 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.
- Product
- Sidebar Widgets by CodeLights
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Sidebar Widgets by CodeLights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 12, 2023A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on the internal network vCVE-2022-25026 · Other software · Rocketsoftware · reported by MITREHigh 7.5
A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on the internal network via a crafted HTTP request to /trufusionPortal/upDwModuleProxy.
- Product
- Trufusion Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.nettitude.comlabs.nettitude.com
Jan 11, 2023TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-channeCVE-2022-4499 · Network & remote access · TP-Link · reported by cret@cert.orgHigh 7.5
TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-channel attack. By measuring the response time of the httpd process, an attacker could guess each byte of the username and password.
- Product
- WR710N
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Jan 11, 2023Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the bounds of a mapped register potentially lCVE-2023-20525 · Other software · AMD · reported by psirt@amd.comMedium 6.5
Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the bounds of a mapped register potentially leading to a denial of service.
- Product
- 2nd Gen EPYC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2023The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks.CVE-2022-48251 · Computers, phones & browsers · ARM · reported by MITREHigh 7.5
The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks. NOTE: the vendor reportedly offers the position "while power side channel attacks ... are possible, they are not directly caused by or related to the Arm architecture."
- Product
- Cortex-a53 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeprint.iacr.orgeshard.com
Jan 2, 2023Inappropriate implementation in Paint in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data outside an iframe via a craftedCVE-2022-4025 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Inappropriate implementation in Paint in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data outside an iframe via a crafted HTML page. (Chrome security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Dec 30, 2022Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the ssid parameter at /goform/WifiBasicSet.CVE-2022-47119 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the ssid parameter at /goform/WifiBasicSet.
- Product
- A15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbrief-nymphea-813.notion.sitebrief-nymphea-813.notion.site
Dec 29, 2022Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and CVE-2022-38212 · Other software · Esri · reported by psirt@esri.comHigh 7.5
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38203.
- Product
- ArcGIS Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and CVE-2022-38211 · Other software · Esri · reported by psirt@esri.comHigh 7.5
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212.
- Product
- ArcGIS Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and CVE-2022-38203 · Other software · Esri · reported by psirt@esri.comHigh 7.5
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212.
- Product
- Portal for ArcGIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field.CVE-2022-2582 · Other software · github.com/aws/aws-sdk-go · reported by security@golang.orgMedium 4.3
The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it.
- Product
- github.com/aws/aws-sdk-go/service/s3/s3crypto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2020-36566 · Other software · github.com/whyrusleeping/tar-utils · reported by security@golang.orgCritical 9.1
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
- Product
- github.com/whyrusleeping/tar-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2020-36561 · Other software · github.com/yi-ge/unzip · reported by security@golang.orgCritical 9.1
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
- Product
- github.com/yi-ge/unzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2020-36560 · Other software · github.com/artdarek/go-unzip · reported by security@golang.orgCritical 9.1
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
- Product
- github.com/artdarek/go-unzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directoryCVE-2020-36559 · Other software · aahframe.work · reported by security@golang.orgHigh 7.5
Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
- Product
- aahframe.work
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory.CVE-2019-25073 · Other software · github.com/goadesign/goa · reported by security@golang.orgHigh 7.5
Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory.
- Product
- github.com/goadesign/goa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2018-25046 · Other software · code.cloudfoundry.org/archiver · reported by security@golang.orgCritical 9.1
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
- Product
- code.cloudfoundry.org/archiver/extractor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Token validation methods are susceptible to a timing side-channel during HMAC comparison.CVE-2015-10004 · Other software · github.com/robbert229/jwt · reported by security@golang.orgHigh 7.5
Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.
- Product
- github.com/robbert229/jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Some Dahua software products have a vulnerability of server-side request forgery (SSRF).CVE-2022-45429 · Network & remote access · Dahuasecurity · reported by cybersecurity@dahuatech.comHigh 7.5
Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatenating links (URL) that conform to specific rules.
- Product
- DSS Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddahuasecurity.comdahuasecurity.com
Dec 22, 2022Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user cCVE-2022-45420 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 22, 2022ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1.CVE-2022-34476 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1. This vulnerability affects Firefox < 102.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 22, 2022Due to a layout change, iframe contents could have been rendered outside of its border.CVE-2022-28286 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 22, 2022When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen modeCVE-2022-22743 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 21, 2022Wildix WMS 6 before 6.02.20221216, WMS 5 before 5.04.20221214, and WMS4 before 4.04.45396.23 allows Server-side request forgery (SSRF) via ZohoClient.php.CVE-2022-47635 · Other software · Wildix · reported by MITRECritical 9.8
Wildix WMS 6 before 6.02.20221216, WMS 5 before 5.04.20221214, and WMS4 before 4.04.45396.23 allows Server-side request forgery (SSRF) via ZohoClient.php.
- Product
- WMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwildix.atlassian.netwildix.atlassian.net
Dec 20, 2022 IBM Security Guardium 11.4 could allow a privileged user to obtain sensitive information inside of an HTTP response.CVE-2022-39166 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.4
IBM Security Guardium 11.4 could allow a privileged user to obtain sensitive information inside of an HTTP response. IBM X-Force ID: 235405.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 20, 2022Sidebar Widgets by CodeLights: Stored Cross-Site ScriptingCVE-2022-4619 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Sidebar Widgets by CodeLights
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Sidebar Widgets by CodeLights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 20, 2022Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the ssid parameter at /goform/fast_setting_wifi_set.CVE-2022-46541 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the ssid parameter at /goform/fast_setting_wifi_set.
- Product
- F1203 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2022Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function.CVE-2022-45666 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function.
- Product
- I22 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022 IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from user-controlCVE-2022-38708 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 234180.
- Product
- Cognos Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 19, 2022 IBM Spectrum Scale 5.1 could allow users with permissions to create pod, persistent volume and persistent volume claim to access files and directories outside CVE-2022-40607 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.8
IBM Spectrum Scale 5.1 could allow users with permissions to create pod, persistent volume and persistent volume claim to access files and directories outside of the volume, including on the host filesystem. IBM X-Force ID: 235740.
- Product
- Spectrum Scale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 17, 2022An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF)CVE-2022-47514 · Other software · Xml-rpc.net Project · reported by MITREHigh 8.8
An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, as demonstrated by a pingback.aspx POST request.
- Product
- Xml-rpc.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compapercutsoftware.github.io
Dec 16, 2022Adobe Campaign version 7.3.1 (and earlier) and 8.3.9 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitraCVE-2022-42343 · Other software · Adobe · reported by AdobeMedium 6.5
Adobe Campaign version 7.3.1 (and earlier) and 8.3.9 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.
- Product
- Adobe Campaign Classic (ACC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Dec 16, 2022In revokeOwnPermissionsOnKill of PermissionManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to sidCVE-2022-20559 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In revokeOwnPermissionsOnKill of PermissionManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-219739967
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 16, 2022In getSmsRoleHolder of RoleService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informCVE-2022-20538 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In getSmsRoleHolder of RoleService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-235601770
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 16, 2022In Telecom, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.CVE-2022-20531 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Telecom, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.