Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

486new WordPress flaws this week

392,772entries in the database

6,458 results · page 86 of 130

Feb 11, 2022Hessian serialization is a network protocol that supports object-based transmission.CVE-2022-24289 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and earlier, running on non-current patch versions of Java, an attacker with client access to Cayenne ROP can transmit a malicious payload to any vulnerable third-party dependency on the server. This can result in arbitrary code execution.
Product
Apache Cayenne
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Feb 10, 2022When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallCVE-2021-42000 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comMedium 5.3
When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.
Product
PingFederate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.pingidentity.com pingidentity.com
Feb 10, 2022Gradle is a build tool with a focus on build automation and support for multi-language development.CVE-2022-23630 · Other software · gradle · reported by GitHubHigh 7.5
Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This occurs when dependency verification is disabled on one or more configurations and those configurations have common dependencies with other configurations that have dependency verification enabled. If the configuration that has dependency verification disabled is resolved first, Gradle does not verify the common dependencies for the configuration that has dependency verification enabled. Gradle 7.4 fixes that issue by validating artifacts at least once if they are present in a resolved configuration that has dependency verification active. For users who cannot update either do not use `ResolutionStrategy.disableDependencyVerification()` and do not use plugins that use that method to disable dependency verification for a single configuration or make sure resolution of configuration that disable that feature do not happen in builds that resolve configuration where the feature is enabled.
Product
gradle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.gradle.org github.com
Feb 10, 2022Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input.CVE-2022-24568 · Other software · Xxyopen · reported by MITRECritical 9.8
Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input.
Product
Novel-plus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 9, 2022S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer, CVE-2022-22542 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer, Supplier and Business Partner objects exposes the private address fields of Employee Business Partners, to an actor that is not explicitly authorized to have access to that information, which could compromise Confidentiality.
Product
SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Feb 9, 2022superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON.CVE-2022-23631 · Other software · blitz-js · reported by GitHubCritical 9
superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requirement is that the server implements at least one endpoint which uses superjson during request processing. This has been patched in superjson 1.8.1. Users are advised to update. There are no known workarounds for this issue.
Product
superjson
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 7, 2022QuickBox Pro v2.4.8 contains a cross-site scripting (XSS) vulnerability at "adminuseredit.php?usertoedit=XSS", as the user supplied input for the value of this CVE-2021-45281 · Other software · Quickbox · reported by MITREMedium 6.1
QuickBox Pro v2.4.8 contains a cross-site scripting (XSS) vulnerability at "adminuseredit.php?usertoedit=XSS", as the user supplied input for the value of this parameter is not properly sanitized.
Product
Quickbox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record websec.nl websec.nl
Feb 7, 2022SupportCandy: Does not validate and escape the page attribute of its shortcodeCVE-2021-24880 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
Product
SupportCandy
Fixed in
2.2.7
What to do
Update SupportCandy to 2.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022SupportCandy: Does not have CSRF check in the wpsc_tickets AJAX actionCVE-2021-24879 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter (stored in their cookies) with an XSS payload in it.
Product
SupportCandy
Fixed in
2.2.7
What to do
Update SupportCandy to 2.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022SupportCandy: Does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embedCVE-2021-24878 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embed, leading to a Reflected Cross-Site Scripting issue
Product
SupportCandy
Fixed in
2.2.7
What to do
Update SupportCandy to 2.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022SupportCandy: Does not have CRSF check in its wpsc_tickets AJAX actionCVE-2021-24843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action.
Product
SupportCandy
Fixed in
2.2.7
What to do
Update SupportCandy to 2.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022SupportCandy: Does not have authorisation and CSRF checks in its wpsc_tickets AJAX actionCVE-2021-24839 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Other actions may be affected as well.
Product
SupportCandy
Fixed in
2.2.5
What to do
Update SupportCandy to 2.2.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2022Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskStation Manager (DSM)CVE-2022-22679 · Network & remote access · Synology · reported by security@synology.comMedium 6.5
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote authenticated users to write arbitrary files via unspecified vectors.
Product
DiskStation Manager (DSM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com synology.com
Feb 4, 2022When combined with specific software sequences, AMD CPUs may transiently execute non-canonical loads and store using only the lower 48 address bits potentially CVE-2020-12965 · Other software · AMD · reported by psirt@amd.comHigh 7.5
When combined with specific software sequences, AMD CPUs may transiently execute non-canonical loads and store using only the lower 48 address bits potentially resulting in data leakage.
Product
All supported processors
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com amd.com
Feb 1, 2022Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users.CVE-2021-44451 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.
Product
Apache Superset
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Feb 1, 2022SVG Support: Does not escape the "CSS Class to target" setting before outputting it in an attributeCVE-2021-24686 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
SVG Support
Fixed in
2.3.20
What to do
Update SVG Support to 2.3.20 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 31, 2022xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.CVE-2022-24130 · Other software · Invisible-island · reported by MITREMedium 5.5
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.
Product
Xterm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record invisible-island.net lists.debian.org
Jan 28, 2022Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.CVE-2022-23456 · Other software · HP · reported by hp-security-alert@hp.comMedium 5.5
Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.
Product
Support Assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hp.com support.hp.com
Jan 25, 2022A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions.CVE-2022-0335 · Other software · Moodle · reported by patrick@puiterwijk.orgHigh 8.8
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com moodle.org
Jan 25, 2022A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions.CVE-2022-0334 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 4.3
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com moodle.org
Jan 25, 2022A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions.CVE-2022-0333 · Other software · Moodle · reported by patrick@puiterwijk.orgLow 3.8
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com moodle.org
Jan 24, 2022ShortDescription is a MediaWiki extension that provides local short description support.CVE-2022-21710 · Other software · StarCitizenTools · reported by GitHubMedium 4.7
ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists in versions prior to 2.3.4. On a wiki that has the ShortDescription enabled, XSS can be triggered on any page or the page with the action=info parameter, which displays the shortdesc property. This is achieved using the wikitext `{{SHORTDESC:<img src=x onerror=alert()>}}`. This issue has a patch in version 2.3.4.
Product
mediawiki-extensions-ShortDescription
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 18, 2022Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language.CVE-2022-21700 · Other software · micronaut-projects · reported by GitHubMedium 5.3
Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language. In affected versions sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used in static state. ### Impact Sending an invalid Content Type header leads to memory leak in `DefaultArgumentConversionContext` as this type is erroneously used in static state. ### Patches The problem is patched in Micronaut 3.2.7 and above. ### Workarounds The default content type binder can be replaced in an existing Micronaut application to mitigate the issue: ```java package example; import java.util.List; import io.micronaut.context.annotation.Replaces; import io.micronaut.core.convert.ConversionService; import io.micronaut.http.MediaType; import io.micronaut.http.bind.DefaultRequestBinderRegistry; import io.micronaut.http.bind.binders.RequestArgumentBinder; import jakarta.inject.Singleton; @Singleton @Replaces(DefaultRequestBinderRegistry.class) class FixedRequestBinderRegistry extends DefaultRequestBinderRegistry { public FixedRequestBinderRegistry(ConversionService conversionServi
Product
micronaut-core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 18, 2022The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL.CVE-2022-22691 · Other software · Umbraco · reported by info@appcheck-ng.comMedium 6.8
The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server thereby disclosing the password reset token if/when the link is followed. A related vulnerability (CVE-2022-22690) could allow this flaw to become persistent so that all password reset URLs are affected persistently following a successful attack. See the AppCheck advisory for further information and associated caveats.
Product
Umbraco CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record appcheck-ng.com appcheck-ng.com
Jan 16, 2022The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patternsCVE-2022-23304 · Other software · Siemens · reported by MITRECritical 9.8
The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.
Product
SIDIS Secured SmartPlug
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org security.gentoo.org
Jan 16, 2022The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns.CVE-2022-23303 · Other software · Siemens · reported by MITRECritical 9.8
The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.
Product
SIDIS Secured SmartPlug
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org security.gentoo.org
Jan 10, 2022In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the iCVE-2021-22060 · Other software · VMware · reported by security@vmware.comMedium 4.3
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
Product
Spring Framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tanzu.vmware.com oracle.com
Jan 10, 2022Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker within radio range to take control of or CVE-2020-9057 · Other software · Linear · reported by cret@cert.orgHigh 8.8
Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker within radio range to take control of or cause a denial of service to a vulnerable device. An attacker can also capture and replay Z-Wave traffic. Firmware upgrades cannot directly address this vulnerability as it is an issue with the Z-Wave specification for these legacy chipsets. One way to protect against this vulnerability is to use 500 or 700 series chipsets that support Security 2 (S2) encryption. As examples, the Linear WADWAZ-1 version 3.43 and WAPIRZ-1 version 3.43 (with 300 series chipsets) are vulnerable.
Product
WADWAZ-1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record doi.org github.com
Jan 6, 2022Insta HMS before 12.4.10 is vulnerable to XSS because of improper validation of user-supplied input by multiple scripts.CVE-2021-42841 · Other software · Practo · reported by MITREMedium 6.1
Insta HMS before 12.4.10 is vulnerable to XSS because of improper validation of user-supplied input by multiple scripts. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Product
Insta HMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Jan 6, 2022If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit coCVE-2021-44878 · Other software · Pac4j · reported by MITREHigh 7.5
If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit configuration on its side or for the "idtoken" response type which is not secure and violates the OpenID Core Specification. The "none" algorithm does not require any signature verification when validating the ID tokens, which allows the attacker to bypass the token validation by injecting a malformed ID token using "none" as the value of "alg" key in the header with an empty signature value.
Product
Pac4j
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com openid.net
Dec 28, 2021SUPERAntispyware v8.0.0.1050 was discovered to contain an issue in the component saskutil64.sys.CVE-2020-22061 · Other software · Superantispyware · reported by MITREHigh 7.8
SUPERAntispyware v8.0.0.1050 was discovered to contain an issue in the component saskutil64.sys. This issue allows attackers to arbitrarily write data to the device via IOCTL 0x9C402140.
Product
Superantispyware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Dec 23, 2021NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language ProceCVE-2021-43854 · Other software · nltk · reported by GitHubHigh 7.5
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Versions prior to 3.6.5 are vulnerable to regular expression denial of service (ReDoS) attacks. The vulnerability is present in PunktSentenceTokenizer, sent_tokenize and word_tokenize. Any users of this class, or these two functions, are vulnerable to the ReDoS attack. In short, a specifically crafted long input to any of these vulnerable functions will cause them to take a significant amount of execution time. If your program relies on any of the vulnerable functions for tokenizing unpredictable user input, then we would strongly recommend upgrading to a version of NLTK without the vulnerability. For users unable to upgrade the execution time can be bounded by limiting the maximum length of an input to any of the vulnerable functions. Our recommendation is to implement such a limit.
Product
nltk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 21, 2021Dell Wyse Management Suite version 3.3.1 and prior support insecure Transport Security Protocols TLS 1.0 and TLS 1.1 which are susceptible to Man-In-The-Middle CVE-2021-36337 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell Wyse Management Suite version 3.3.1 and prior support insecure Transport Security Protocols TLS 1.0 and TLS 1.1 which are susceptible to Man-In-The-Middle attacks thereby compromising Confidentiality and Integrity of data.
Product
Wyse Management Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Dec 15, 2021In eicOpsDecryptAes128Gcm of acropora/app/identity/identity_support.c, there is a possible out of bounds write due to a missing bounds check.CVE-2021-1044 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In eicOpsDecryptAes128Gcm of acropora/app/identity/identity_support.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-195570681References: N/A
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Dec 15, 2021In createAdminSupportIntent of DevicePolicyManagerService.java, there is a possible disclosure of information about installed device/profile owner package name CVE-2021-0983 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In createAdminSupportIntent of DevicePolicyManagerService.java, there is a possible disclosure of information about installed device/profile owner package name due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-192245204
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Dec 15, 2021In isRequestPinItemSupported of ShortcutService.java, there is a possible cross-user leak of packages in which the default launcher supports requests to create CVE-2021-0979 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In isRequestPinItemSupported of ShortcutService.java, there is a possible cross-user leak of packages in which the default launcher supports requests to create pinned shortcuts due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-191772737
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Dec 14, 2021Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server.CVE-2021-4044 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgHigh 7.5
Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be returned by OpenSSL if the application has previously called SSL_CTX_set_cert_verify_callback(). Since most applications do not do this the SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be totally unexpected and applications may not behave correctly as a result. The exact behaviour will depend on the application but it could result in crashes, infinite loops or other similar incorrect responses. This issue is made more serious in combination with a separate bug in OpenSSL 3.0 that will cause X509_verify_cert() to indicate an internal error when processing a certificate chain. This will occur where a certificate does not include the Subject Alternative Name ex
Product
OpenSSL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.openssl.org security.netapp.com
Dec 14, 2021UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-asCVE-2021-44041 · Other software · Uipath · reported by MITRECritical 9.8
UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-assistant://. This allows an attacker to execute code on a victim's machine or capture NTLM credentials by supplying a networked or WebDAV file path.
Product
Assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.uipath.com docs.uipath.com
Dec 8, 2021When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped.CVE-2021-43541 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org lists.debian.org
Dec 7, 2021The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and lCVE-2021-43176 · Other software · GOautodial · reported by disclosure@synopsys.comHigh 8.8
The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the action. This permits an attacker to execute any PHP source file with a .php extension that is present on the disk and readable by the GOautodial web server process. Combined with CVE-2021-43175, it is possible for the attacker to do this without valid credentials. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Product
GOautodial API
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synopsys.com synopsys.com
Dec 7, 2021A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html intoCVE-2021-29113 · Other software · Esri · reported by psirt@esri.comMedium 4.7
A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page.
Product
ArcGIS Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record esri.com esri.com
Nov 30, 2021Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor.CVE-2021-43296 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor.
Product
Manageengine Supportcenter Plus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record manageengine.com manageengine.com
Nov 30, 2021Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module.CVE-2021-43295 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module.
Product
Manageengine Supportcenter Plus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record manageengine.com manageengine.com
Nov 30, 2021Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module.CVE-2021-43294 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module.
Product
Manageengine Supportcenter Plus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record manageengine.com manageengine.com
Nov 30, 2021The vulnerabilty was discovered in ActiveX module related to NeoRS remote support program.CVE-2020-7880 · Other software · douzone · reported by vuln@krcert.or.krHigh 7.5
The vulnerabilty was discovered in ActiveX module related to NeoRS remote support program. This issue allows an remote attacker to download and execute remote file. It is because of improper parameter validation of StartNeoRS function in ActiveX.
Product
NeoRS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record boho.or.kr boho.or.kr
Nov 30, 2021# Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them CVE-2021-3769 · Other software · ohmyzsh · reported by security@huntr.devHigh 7.5
# Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them to the terminal. All of them do that on git information, particularly the branch name, so if the branch has a specially-crafted name the vulnerability can be exploited. **Fixed in**: [b3ba9978](https://github.com/ohmyzsh/ohmyzsh/commit/b3ba9978). **Impacted areas**: - `pygmalion` theme. - `pygmalion-virtualenv` theme. - `refined` theme.
Product
ohmyzsh/ohmyzsh
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 30, 2021# Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-suppCVE-2021-3726 · Other software · ohmyzsh · reported by security@huntr.devHigh 7.5
# Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-supplied string. In Oh My Zsh, this function is always used securely, but custom user code could use the `title` function in a way that is unsafe. **Fixed in**: [a263cdac](https://github.com/ohmyzsh/ohmyzsh/commit/a263cdac). **Impacted areas**: - `title` function in `lib/termsupport.zsh`. - Custom user code using the `title` function.
Product
ohmyzsh/ohmyzsh
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 28, 2021Zoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityCVE-2021-44077 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution
Product
ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
On CISA’s list since
Dec 1, 2021 (federal fix deadline Dec 15, 2021)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com pitstop.manageengine.com
Nov 26, 2021BaserCMS is an open source content management system with a focus on Japanese language support.CVE-2021-41279 · Other software · baserproject · reported by GitHubHigh 7.7
BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.
Product
basercms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 26, 2021Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id,CVE-2021-36919 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id, &assignee).
Affected
up to 6.0.6
What to do
Affects up to 6.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.