Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,308 results · page 87 of 127
Oct 7, 2022An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10.CVE-2022-37894 · Other software · Arubanetworks · reported by security-alert@hpe.comMedium 6.5
An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected AP of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.
- Product
- Arubaos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comarubanetworks.com
Oct 6, 2022** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used anCVE-2022-40160 · Other software · jxpath · reported by security@apache.orgMedium 6.5
** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used and failed to contact the JXPath maintainers prior to requesting the CVE allocation. The CVE was then allocated by Google in breach of the CNA rules. After review by the JXPath maintainers, the original report was found to be invalid.
- Product
- jxpath
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugs.chromium.org
Oct 6, 2022** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used anCVE-2022-40159 · Other software · jxpath · reported by security@apache.orgMedium 6.5
** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used and failed to contact the JXPath maintainers prior to requesting the CVE allocation. The CVE was then allocated by Google in breach of the CNA rules. After review by the JXPath maintainers, the original report was found to be invalid.
- Product
- jxpath
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugs.chromium.org
Oct 3, 2022A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated usCVE-2022-36551 · Other software · Heartex · reported by MITREMedium 6.5
A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF.
- Product
- Label Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabelstud.iopacketstormsecurity.com
Oct 2, 2022Microsoft Exchange Server Server-Side Request Forgery VulnerabilityCVE-2022-41040 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.
- Product
- Exchange Server
- On CISA’s list since
- Sep 30, 2022 (federal fix deadline Oct 21, 2022)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.compacketstormsecurity.com
Sep 30, 2022Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the requCVE-2022-21826 · Network & remote access · Ivanti · reported by support@hackerone.comMedium 5.4
Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Sep 28, 2022Insufficient capability checks made it possible for teachers to download users outside of their courses.CVE-2021-40692 · Other software · Moodle · reported by Red HatMedium 4.3
Insufficient capability checks made it possible for teachers to download users outside of their courses.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Sep 28, 2022Ampere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which is a power side-channel attack that extracts secret informationCVE-2022-35888 · Other software · Amperecomputing · reported by MITREMedium 6.5
Ampere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which is a power side-channel attack that extracts secret information from the CPU by correlating the power consumption with data being processed on the system.
- Product
- Ampere Altra MAX Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordamperecomputing.comdeveloper.arm.com
Sep 28, 2022IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF).CVE-2022-35282 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker with local network access could exploit this vulnerability to obtain sensitive data.
- Product
- WebSphere Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 23, 2022Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDget function.CVE-2022-40104 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDget function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
- Product
- I9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDset function.CVE-2022-40102 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDset function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
- Product
- I9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url.CVE-2022-40146 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.
- Product
- Apache XML Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.debian.org
Sep 22, 2022Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources.CVE-2022-38648 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.
- Product
- Apache XML Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.debian.org
Sep 22, 2022Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol.CVE-2022-38398 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.
- Product
- Apache XML Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.debian.org
Sep 21, 2022Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.lifCVE-2022-28981 · Other software · Liferay · reported by MITREHigh 7.5
Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter.
- Product
- Liferay Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.liferay.devportal.liferay.dev
Sep 20, 2022McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads.CVE-2022-39221 · Other software · J-onasJones · reported by GitHubHigh 7.5
McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod for Fabric and Quilt up to and including 0.1.2.1 and McWebserver Minecraft Mod for Forge up to and including 0.1.1 allows all files, accessible by the program, to be read by anyone via HTTP request. Version 0.2.0 with patches are released to both platforms (Fabric and Quilt, Forge). As a workaround, the McWebserver mod can be disabled by removing the file from the `mods` directory.
- Product
- McWebserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary CVE-2022-38931 · Other software · Baijiacms Project · reported by MITREHigh 8.8
A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the url parameter.
- Product
- Baijiacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file CVE-2022-40234 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file when uploading a TLS certificate to IBM Spectrum Protect Plus. If this generated .crt file is shared, an attacker can obtain the private key information for the uploaded certificate. IBM X-Force ID: 235718.
- Product
- Spectrum Protect Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 19, 2022Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can resultCVE-2022-3218 · Other software · Necta LLC · reported by cve@rapid7.comCritical 9.8
Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution.
- Product
- WiFi Mouse (Mouse Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 19, 2022Safe Software FME Server v2021.2.5 and below does not employ server-side validation.CVE-2022-38341 · Other software · Safe · reported by MITREHigh 7.1
Safe Software FME Server v2021.2.5 and below does not employ server-side validation.
- Product
- FME Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.safe.comcycura.com
Sep 14, 2022An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to creatCVE-2022-40626 · Other software · Zabbix · reported by security@zabbix.comMedium 4.8
An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend.
- Product
- Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgsupport.zabbix.com
Sep 14, 2022PayMoney 3.3 is vulnerable to Client Side Remote Code Execution (RCE).CVE-2022-37140 · Other software · Techvill · reported by MITREHigh 8
PayMoney 3.3 is vulnerable to Client Side Remote Code Execution (RCE). The vulnerability exists on the reply ticket function and upload the malicious file. A calculator will open when the victim who download the file open the RTF file.
- Product
- Paymoney
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compaymoney.techvill.org
Sep 14, 2022Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.CVE-2022-2900 · Other software · ionicabizau · reported by security@huntr.devCritical 9.1
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.
- Product
- ionicabizau/parse-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022Talos Linux is a Linux distribution built for Kubernetes deployments.CVE-2022-36103 · Other software · siderolabs · reported by GitHubHigh 7.2
Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluster. Due to improper validation of the request while signing a worker node CSR (certificate signing request) Talos control plane node might issue Talos API certificate which allows full access to Talos API on a control plane node. Accessing Talos API with full level access on a control plane node might reveal sensitive information which allows full level access to the cluster (Kubernetes and Talos PKI, etc.). Talos API join token is stored in the machine configuration on the worker node. When configured correctly, Kubernetes workloads don't have access to the machine configuration, but due to a misconfiguration workload might access the machine configuration and reveal the join token. This problem has been fixed in Talos 1.2.2. Enabling the Pod Security Standards mitigates the vulnerability by denying hostPath mounts and host networking by default in the baseline policy. Clusters that don't run untrusted workloads are not affected. Clusters with correct Pod Security configurations which don't allow hostPath mounts, and secure access to cloud m
- Product
- talos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point.CVE-2022-3027 · Other software · Contec Health · reported by ics-cert@hq.dhs.govMedium 5.7
The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name, including non-standard characters that, when the device attempts connecting to the malicious SSID, the device can be exploited to write arbitrary files or display incorrect information.
- Product
- CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022insert HTML / js code inside input how to get to the vulnerable input : Workers > worker nickname > inject in this input the code.CVE-2022-36778 · Other software · Synel · reported by cna@cyber.gov.ilMedium 6.5
insert HTML / js code inside input how to get to the vulnerable input : Workers > worker nickname > inject in this input the code.
- Product
- eHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming requests to the AWS iCVE-2022-38298 · Other software · Appsmith · reported by MITREHigh 8.8
Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming requests to the AWS internal metadata endpoint.
- Product
- Appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliography/marcsru.php andCVE-2022-38292 · Other software · Slims · reported by MITRECritical 9.8
SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliography/marcsru.php and /bibliography/z3950sru.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2022Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin <= 1.0.95 at WordPress.CVE-2022-36376 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin <= 1.0.95 at WordPress.
- Affected
- up to 1.0.95
- What to do
- Affects up to 1.0.95. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comrankmath.com
Sep 9, 2022A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network resources, and possiblyCVE-2022-40305 · Other software · Canto · reported by MITRECritical 9.8
A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network resources, and possibly have unspecified other impact via the server parameter to the /cwc/login login form.
- Product
- Canto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-602: Client-Side Enforcement of Server-Side Security, whCVE-2022-1525 · Other software · Cognex · reported by ics-cert@hq.dhs.govCritical 9.1
The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-602: Client-Side Enforcement of Server-Side Security, which could allow attackers to bypass web access controls by inspecting and modifying the source code of password protected web elements.
- Product
- 3D-A1000 Dimensioning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022Gluu Oxauth before v4.4.1 allows attackers to execute blind SSRF (Server-Side Request Forgery) attacks via a crafted request_uri parameter.CVE-2022-36663 · Other software · Gluu · reported by MITRECritical 9.8
Gluu Oxauth before v4.4.1 allows attackers to execute blind SSRF (Server-Side Request Forgery) attacks via a crafted request_uri parameter.
- Product
- Oxauth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022All-in-One Video Gallery: Arbitrary file downloads and blind server-side request forgeryCVE-2022-2633 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server.
- Product
- All-in-One Video Gallery
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update All-in-One Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 4, 2022Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem proCVE-2022-39824 · Other software · Appsmith · reported by MITREHigh 8.9
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or achieve an information leak.
- Product
- Appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2022Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage.CVE-2021-27693 · Other software · Publiccms · reported by MITRECritical 9.8
Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2022A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2.CVE-2021-3859 · Other software · Redhat · reported by Red HatHigh 7.5
A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.
- Product
- Jboss Enterprise Application Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 25, 2022Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /card_scan.php?CardFormatNo= XSS with session fixation (via PHPSESSID) when they are chained tCVE-2022-31798 · Other software · Nortekcontrol · reported by MITREMedium 6.1
Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /card_scan.php?CardFormatNo= XSS with session fixation (via PHPSESSID) when they are chained together. This would allow an attacker to take over an admin account or a user account.
- Product
- Emerge E3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comeg.linkedin.com
Aug 25, 2022H3C H200 H200V100R004 was discovered to contain a stack overflow via the function Edit_BasicSSID_5G.CVE-2022-37094 · Other software · H3c · reported by MITRECritical 9.8
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function Edit_BasicSSID_5G.
- Product
- H200 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022H3C H200 H200V100R004 was discovered to contain a stack overflow via the function Edit_BasicSSID.CVE-2022-37090 · Other software · H3c · reported by MITRECritical 9.8
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function Edit_BasicSSID.
- Product
- H200 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function Edit_BasicSSID.CVE-2022-36504 · Other software · H3c · reported by MITREHigh 7.8
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function Edit_BasicSSID.
- Product
- Magic Nx18 Plus Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function Edit_BasicSSID_5G.CVE-2022-36497 · Other software · H3c · reported by MITREHigh 7.8
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function Edit_BasicSSID_5G.
- Product
- Magic Nx18 Plus Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022H3C B5 Mini B5MiniV100R005 was discovered to contain a stack overflow via the function Edit_BasicSSID.CVE-2022-36478 · Other software · H3c · reported by MITREHigh 7.8
H3C B5 Mini B5MiniV100R005 was discovered to contain a stack overflow via the function Edit_BasicSSID.
- Product
- B5 Mini Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022H3C B5 Mini B5MiniV100R005 was discovered to contain a stack overflow via the function Edit_BasicSSID_5G.CVE-2022-36473 · Other software · H3c · reported by MITREHigh 7.8
H3C B5 Mini B5MiniV100R005 was discovered to contain a stack overflow via the function Edit_BasicSSID_5G.
- Product
- B5 Mini Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of thCVE-2021-31566 · Other software · Libarchive · reported by Red HatHigh 7.8
An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.
- Product
- Libarchive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 16, 2022When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service (S3) in Splunk Web, TLS certificate validation is not correctCVE-2022-37437 · Other software · Splunk · reported by prodsec@splunk.comHigh 7.4
When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service (S3) in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination. The vulnerability only affects connections between Splunk Enterprise and an Ingest Actions Destination through Splunk Web and only applies to environments that have configured TLS certificate validation. It does not apply to Destinations configured directly in the outputs.conf configuration file. The vulnerability affects Splunk Enterprise version 9.0.0 and does not affect versions below 9.0.0, including the 8.1.x and 8.2.x versions.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2022undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user CVE-2022-35949 · Other software · nodejs · reported by GitHubMedium 5.3
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in `undici@5.8.1`. The best workaround is to validate user input before passing it to the `undici.request` call.
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2022Side-channel information leakage in Keyboard input in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who had compromised the renderer process toCVE-2022-2612 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Side-channel information leakage in Keyboard input in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Aug 12, 2022A stack overflow vulnerability exists in /goform/wifiSSIDset in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of servicCVE-2022-35560 · Network & remote access · Tenda · reported by MITREHigh 7.5
A stack overflow vulnerability exists in /goform/wifiSSIDset in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of service (DoS) via the index parameter.
- Product
- W6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2022A stack overflow vulnerability exists in /goform/wifiSSIDget in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of servicCVE-2022-35557 · Network & remote access · Tenda · reported by MITREHigh 7.5
A stack overflow vulnerability exists in /goform/wifiSSIDget in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of service (DoS) via the index parameter.
- Product
- W6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2022In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.CVE-2022-20332 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-180019130
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.