Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,841 results · page 86 of 137
Apr 2, 2023A vulnerability classified as critical was found in OTCMS 6.0.1.CVE-2023-1797 · Other software · Otcms · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224749 was assigned to this vulnerability.
- Product
- Otcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2023A vulnerability was found in jeecg-boot 3.5.0 and classified as critical.CVE-2023-1784 · Other software · Jeecg · reported by VulDBMedium 5.3
A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Documentation. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224699.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.youdao.comvuldb.com
Mar 30, 2023A vulnerability has been found in IBOS up to 4.5.4 and classified as critical.CVE-2023-1747 · Other software · Ibos · reported by VulDBMedium 6.3
A vulnerability has been found in IBOS up to 4.5.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /?r=email/api/mark&op=delFromSend. The manipulation of the argument emailids leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.5.5 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-224635.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023A vulnerability classified as critical was found in IBOS 4.5.5.CVE-2023-1744 · Other software · Ibos · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in IBOS 4.5.5. This vulnerability affects unknown code of the component htaccess Handler. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224632.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles.CVE-2022-3093 · Other software · Tesla · reported by zdi-disclosures@trendmicro.comMedium 6.4
This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ice_updater update mechanism. The issue results from the lack of proper validation of user-supplied firmware. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17463.
- Product
- Model 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Mar 28, 2023A vulnerability classified as critical was found in DriverGenius 9.70.0.346.CVE-2023-1679 · Other software · Drivergenius · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in DriverGenius 9.70.0.346. This vulnerability affects the function 0x9C406104/0x9C40A108 in the library mydrivers64.sys of the component IOCTL Handler. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224236.
- Product
- Drivergenius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 28, 2023A vulnerability classified as critical has been found in DriverGenius 9.70.0.346.CVE-2023-1678 · Other software · Drivergenius · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in DriverGenius 9.70.0.346. This affects the function 0x9C40A0D8/0x9C40A0DC/0x9C40A0E0 in the library mydrivers64.sys of the component IOCTL Handler. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224235.
- Product
- Drivergenius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 28, 2023RoboDK versions 5.5.3 and prior contain an insecure permission assignment to critical directories vulnerability, which could allow a local user to escalate prCVE-2023-1516 · Other software · RoboDK · reported by ics-cert@hq.dhs.govHigh 7.9
RoboDK versions 5.5.3 and prior contain an insecure permission assignment to critical directories vulnerability, which could allow a local user to escalate privileges and write files to the RoboDK process and achieve code execution.
- Product
- RoboDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2023A vulnerability has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6 and classified as critical.CVE-2023-1458 · Network & remote access · Ubiquiti · reported by VulDBHigh 7.2
A vulnerability has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6 and classified as critical. Affected by this vulnerability is an unknown functionality of the component OSPF Handler. The manipulation of the argument area leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-223303. NOTE: The vendor position is that post-authentication issues are not accepted as vulnerabilities.
- Product
- EdgeRouter X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2023A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6.CVE-2023-1457 · Network & remote access · Ubiquiti · reported by VulDBHigh 7.2
A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. Affected is an unknown function of the component Static Routing Configuration Handler. The manipulation of the argument next-hop-interface leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. VDB-223302 is the identifier assigned to this vulnerability. NOTE: The vendor position is that post-authentication issues are not accepted as vulnerabilities.
- Product
- EdgeRouter X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2023A vulnerability, which was classified as critical, has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6.CVE-2023-1456 · Network & remote access · Ubiquiti · reported by VulDBHigh 7.2
A vulnerability, which was classified as critical, has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. This issue affects some unknown processing of the component NAT Configuration Handler. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier VDB-223301 was assigned to this vulnerability. NOTE: The vendor position is that post-authentication issues are not accepted as vulnerabilities.
- Product
- EdgeRouter X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2023A vulnerability classified as critical was found in JiangMin Antivirus 16.2.2022.418.CVE-2023-1629 · Other software · JiangMin · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in JiangMin Antivirus 16.2.2022.418. Affected by this vulnerability is the function 0x222010 in the library kvcore.sys of the component IOCTL Handler. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224011.
- Product
- Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 23, 2023A vulnerability, which was classified as critical, was found in Rebuild up to 3.2.3.CVE-2023-1612 · Other software · Ruifang-tech · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Rebuild up to 3.2.3. This affects an unknown part of the file /files/list-file. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-223743.
- Product
- Rebuild
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability, which was classified as critical, has been found in Rebuild up to 3.2.3.CVE-2023-1610 · Other software · Ruifang-tech · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Rebuild up to 3.2.3. Affected by this issue is some unknown functionality of the file /project/tasks/list. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-223742 is the identifier assigned to this vulnerability.
- Product
- Rebuild
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability was found in novel-plus 3.6.2 and classified as critical.CVE-2023-1606 · Other software · Xxyopen · reported by VulDBMedium 6.3
A vulnerability was found in novel-plus 3.6.2 and classified as critical. Affected by this issue is some unknown functionality of the file DictController.java. The manipulation of the argument orderby leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223736.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability has been found in novel-plus 3.6.2 and classified as critical.CVE-2023-1595 · Other software · Xxyopen · reported by VulDBMedium 4.7
A vulnerability has been found in novel-plus 3.6.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the file common/log/list. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223663.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability, which was classified as critical, was found in novel-plus 3.6.2.CVE-2023-1594 · Other software · Xxyopen · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in novel-plus 3.6.2. Affected is the function MenuService of the file sys/menu/list. The manipulation of the argument sort leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-223662 is the identifier assigned to this vulnerability.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023A vulnerability, which was classified as critical, was found in DataGear up to 4.5.0.CVE-2023-1571 · Other software · Datagear · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in DataGear up to 4.5.0. This affects an unknown part of the file /analysisProject/pagingQueryData. The manipulation of the argument queryOrder leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.5.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223563.
- Product
- Datagear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023A vulnerability classified as critical has been found in Simple and Beautiful Shopping Cart System 1.0.CVE-2023-1558 · Other software · Simple And Beautiful Shopping Cart System Project · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Simple and Beautiful Shopping Cart System 1.0. This affects an unknown part of the file uploadera.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223551.
- Product
- Simple And Beautiful Shopping Cart System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023A vulnerability in Trend Micro Endpoint Encryption Full Disk Encryption version 6.0.0.3204 and below could allow an attacker with physical access to an affectedCVE-2023-28005 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.8
A vulnerability in Trend Micro Endpoint Encryption Full Disk Encryption version 6.0.0.3204 and below could allow an attacker with physical access to an affected device to bypass Microsoft Windows� Secure Boot process in an attempt to execute other attacks to obtain access to the contents of the device. An attacker must first obtain physical access to the target system in order to exploit this vulnerability. It is also important to note that the contents of the drive(s) encrypted with TMEE FDE would still be protected and would NOT be accessible by the attacker by exploitation of this vulnerability alone.
- Product
- Trend Micro Endpoint Encryption Full Disk Encryption
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comsuccess.trendmicro.com
Mar 21, 2023A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical.CVE-2018-25082 · Other software · zwczou · reported by VulDBMedium 6.3
A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The patch is named e54abadc777715b6dcb545c13214d1dea63df6c9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223403.
- Product
- WeChat SDK Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow deletion of reports from the IGSSCVE-2023-27983 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 6.5
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow deletion of reports from the IGSS project report directory, this would lead to loss of data when an attacker abuses this functionality. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
- Product
- IGSS Data Server(IGSSdataServer.exe)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Mar 21, 2023A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow the creation of a malicious reporCVE-2023-27980 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.8
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow the creation of a malicious report file in the IGSS project report directory, this could lead to remote code execution when a victim eventually opens the report. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior)
- Product
- IGSS Data Server(IGSSdataServer.exe)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Mar 20, 2023A vulnerability, which was classified as critical, has been found in ATM Consulting dolibarr_module_quicksupplierprice up to 1.1.6.CVE-2022-4933 · Other software · ATM Consulting · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in ATM Consulting dolibarr_module_quicksupplierprice up to 1.1.6. Affected by this issue is the function upatePrice of the file script/interface.php. The manipulation leads to sql injection. The attack may be launched remotely. Upgrading to version 1.1.7 is able to address this issue. The patch is identified as ccad1e4282b0e393a32fcc852e82ec0e0af5446f. It is recommended to upgrade the affected component. VDB-223382 is the identifier assigned to this vulnerability.
- Product
- dolibarr_module_quicksupplierprice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2023A vulnerability, which was classified as critical, was found in Zarthus IRC Twitter Announcer Bot up to 1.1.0.CVE-2015-10096 · Other software · Zarthus · reported by VulDBMedium 5
A vulnerability, which was classified as critical, was found in Zarthus IRC Twitter Announcer Bot up to 1.1.0. This affects the function get_tweets of the file lib/twitterbot/plugins/twitter_announcer.rb. The manipulation of the argument tweet leads to command injection. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.1.1 is able to address this issue. The patch is named 6b1941b7fc2c70e1f40981b43c84a2c20cc12bd3. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223383.
- Product
- IRC Twitter Announcer Bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2023A vulnerability, which was classified as critical, was found in RockOA 2.3.2.CVE-2023-1501 · Other software · Rockoa · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in RockOA 2.3.2. This affects the function runAction of the file acloudCosAction.php.SQL. The manipulation of the argument fileid leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223401 was assigned to this vulnerability.
- Product
- Rockoa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2023A vulnerability classified as critical was found in Rebuild up to 3.2.3.CVE-2023-1495 · Other software · Ruifang-tech · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Rebuild up to 3.2.3. Affected by this vulnerability is the function queryListOfConfig of the file /admin/robot/approval/list. The manipulation of the argument q leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c9474f84e5f376dd2ade2078e3039961a9425da7. It is recommended to apply a patch to fix this issue. The identifier VDB-223381 was assigned to this vulnerability.
- Product
- Rebuild
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2023A vulnerability classified as critical has been found in IBOS 4.5.5.CVE-2023-1494 · Other software · Ibos · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in IBOS 4.5.5. Affected is an unknown function of the file ApiController.php. The manipulation of the argument emailids leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223380.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2023A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1 and classified as critical.CVE-2023-1490 · Other software · Max Secure · reported by VulDBMedium 4.4
A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1 and classified as critical. Affected by this issue is the function 0x220020 in the library SDActMon.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223376.
- Product
- Anti Virus Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 18, 2023A vulnerability has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54 and classified as critical.CVE-2023-1489 · Other software · Lespeed · reported by VulDBHigh 7.8
A vulnerability has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54 and classified as critical. Affected by this vulnerability is the function 0x9C402088 in the library WiseHDInfo64.dll of the component IoControlCode Handler. The manipulation leads to improper access controls. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223375.
- Product
- WiseCleaner Wise System Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 18, 2023A vulnerability was found in xzjie cms up to 1.0.3 and classified as critical.CVE-2023-1484 · Other software · xzjie · reported by VulDBMedium 6.3
A vulnerability was found in xzjie cms up to 1.0.3 and classified as critical. This issue affects some unknown processing of the file /api/upload. The manipulation of the argument uploadFile leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-223367.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2023A vulnerability has been found in XiaoBingBy TeaCMS up to 2.0.2 and classified as critical.CVE-2023-1483 · Other software · XiaoBingBy · reported by VulDBMedium 6.3
A vulnerability has been found in XiaoBingBy TeaCMS up to 2.0.2 and classified as critical. This vulnerability affects unknown code of the file /admin/getallarticleinfo. The manipulation of the argument searchInfo leads to sql injection. The attack can be initiated remotely. VDB-223366 is the identifier assigned to this vulnerability.
- Product
- TeaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023A vulnerability classified as critical has been found in jeecg-boot 3.5.0.CVE-2023-1454 · Other software · Jeecg · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023Improper authorization in Samsung Keyboard prior to SMR Mar-2023 Release 1 allows physical attacker to access users text history on the lockscreen.CVE-2023-21454 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 2.4
Improper authorization in Samsung Keyboard prior to SMR Mar-2023 Release 1 allows physical attacker to access users text history on the lockscreen.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 15, 2023Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function VulnerabilityCVE-2023-28461 · Network & remote access · Array Networks · reported by MITREExploitedRansomwareCritical 9.8
Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.
- Product
- AG/vxAG ArrayOS
- On CISA’s list since
- Nov 25, 2024 (federal fix deadline Dec 16, 2024)
- What to do
- Attackers are using this now. Install Array Networks ’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.arraynetworks.netsupport.arraynetworks.net
Mar 15, 2023IBM Robotic Process Automation 21.0.1 through 21.0.7 and 23.0.0 through 23.0.1 could allow a user with physical access to the system due to session tokens for nCVE-2023-22591 · Other software · IBM · reported by psirt@us.ibm.comLow 3.9
IBM Robotic Process Automation 21.0.1 through 21.0.7 and 23.0.0 through 23.0.1 could allow a user with physical access to the system due to session tokens for not being invalidated after a password reset. IBM X-Force ID: 243710.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 15, 2023A vulnerability classified as critical has been found in Simple Art Gallery 1.0.CVE-2023-1416 · Other software · Code-projects · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Simple Art Gallery 1.0. Affected is an unknown function of the file adminHome.php. The manipulation of the argument social_facebook leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223128.
- Product
- Simple ART Gallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2023In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or ..CVE-2023-28371 · Other software · Stellarium · reported by MITRECritical 9.8
In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal.
- Product
- Stellarium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2023A vulnerability classified as critical was found in XiaoBingBy TeaCMS 2.0.CVE-2023-1398 · Other software · XiaoBingBy · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in XiaoBingBy TeaCMS 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/upload. The manipulation leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222985 was assigned to this vulnerability.
- Product
- TeaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 canCVE-2023-0888 · Other software · B. Braun · reported by productsecurity@bbraun.comMedium 4.9
An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks
- Product
- Space Battery Pack SP with Wi-Fi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbbraun.combbraunusa.com
Mar 10, 2023Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function VulnerabilityCVE-2023-27532 · Other software · Veeam · reported by support@hackerone.comExploitedRansomwareHigh 7.5
Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.
- Product
- Backup & Replication
- On CISA’s list since
- Aug 22, 2023 (federal fix deadline Sep 12, 2023)
- What to do
- Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogveeam.comveeam.com
Mar 10, 2023A vulnerability was found in lmxcms 1.41 and classified as critical.CVE-2023-1322 · Other software · Lmxcms · reported by VulDBMedium 6.3
A vulnerability was found in lmxcms 1.41 and classified as critical. Affected by this issue is the function reply of the file BookAction.class.php. The manipulation of the argument id with the input 1) and updatexml(0,concat(0x7e,user()),1)# leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222728.
- Product
- Lmxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023A vulnerability has been found in lmxcms 1.41 and classified as critical.CVE-2023-1321 · Other software · Lmxcms · reported by VulDBMedium 6.3
A vulnerability has been found in lmxcms 1.41 and classified as critical. Affected by this vulnerability is the function update of the file AcquisiAction.class.php. The manipulation of the argument id with the input -1 and updatexml(0,concat(0x7e,user()),1)# leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222727.
- Product
- Lmxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023A vulnerability in the GRand Unified Bootloader (GRUB) for Cisco IOS XR Software could allow an unauthenticated attacker with physical access to the device to vCVE-2023-20064 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.6
A vulnerability in the GRand Unified Bootloader (GRUB) for Cisco IOS XR Software could allow an unauthenticated attacker with physical access to the device to view sensitive files on the console using the GRUB bootloader command line. This vulnerability is due to the inclusion of unnecessary commands within the GRUB environment that allow sensitive files to be viewed. An attacker could exploit this vulnerability by being connected to the console port of the Cisco IOS XR device when the device is power-cycled. A successful exploit could allow the attacker to view sensitive files that could be used to conduct additional attacks against the device.
- Product
- Cisco IOS XR Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Mar 9, 2023A vulnerability was found in UCMS 1.6 and classified as critical.CVE-2023-1303 · Other software · Ucms Project · reported by VulDBMedium 6.3
A vulnerability was found in UCMS 1.6 and classified as critical. This issue affects some unknown processing of the file sadmin/fileedit.php of the component System File Management Module. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-222683.
- Product
- Ucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin.CVE-2023-1277 · Other software · Ubuntukylin · reported by VulDBHigh 7.8
A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of the component Update Handler. The manipulation leads to command injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222600.
- Product
- Kylin-system-updater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023A vulnerability, which was classified as critical, has been found in SUL1SS_shop.CVE-2023-1276 · Other software · Sul1ss Shop Project · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, has been found in SUL1SS_shop. This issue affects some unknown processing of the file application\merch\controller\Order.php. The manipulation of the argument keyword leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-222599.
- Product
- Sul1ss Shop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtib36.github.iovuldb.com
Mar 8, 2023feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java.CVE-2023-27088 · Other software · Feiqu-opensource Project · reported by MITREHigh 8.8
feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. demo users with low permission can perform operations within the permission of the admin super administrator and can use this vulnerability to change the blacklist IP address in the system at will.
- Product
- Feiqu-opensource
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023A vulnerability, which was classified as critical, was found in Typora up to 1.5.5 on Windows.CVE-2023-1003 · Other software · Typora · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Typora up to 1.5.5 on Windows. Affected is an unknown function of the component WSH JScript Handler. The manipulation leads to code injection. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.8 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221736.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023An attacker with physical access to the affected Moxa UC Series devices can initiate a restart of the device and gain access to its BIOS.CVE-2023-1257 · Other software · MOXA · reported by ics-cert@hq.dhs.govHigh 7.6
An attacker with physical access to the affected Moxa UC Series devices can initiate a restart of the device and gain access to its BIOS. Command line options can then be altered, allowing the attacker to access the terminal. From the terminal, the attacker can modify the device’s authentication files to create a new user and gain full access to the system.
- Product
- UC-8580 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.