Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,841 results · page 88 of 137
Feb 7, 2023LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app messagCVE-2022-47415 · Other software · LogicalDOC · reported by cve@rapid7.comMedium 5.4
LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app messaging system (both subject and message bodies).
- Product
- LogicalDOC Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2023A vulnerability classified as critical has been found in weblabyrinth 0.3.1.CVE-2011-10002 · Other software · Weblabyrinth Project · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in weblabyrinth 0.3.1. This affects the function Labyrinth of the file labyrinth.inc.php. The manipulation leads to sql injection. Upgrading to version 0.3.2 is able to address this issue. The identifier of the patch is 60793fd8c8c4759596d3510641e96ea40e7f60e9. It is recommended to upgrade the affected component. The identifier VDB-220221 was assigned to this vulnerability.
- Product
- Weblabyrinth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.google.comgithub.com
Feb 6, 2023Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files.CVE-2021-36226 · Other software · Westerndigital · reported by MITRECritical 9.8
Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files.
- Product
- MY Cloud OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comkrebsonsecurity.com
Feb 5, 2023A vulnerability has been found in Gimmie Plugin 1.2.2 on vBulletin and classified as critical.CVE-2014-125086 · Other software · Gimmie Project · reported by VulDBMedium 5.5
A vulnerability has been found in Gimmie Plugin 1.2.2 on vBulletin and classified as critical. Affected by this vulnerability is an unknown functionality of the file trigger_login.php. The manipulation of the argument userid leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The patch is named fe851002d20a8d6196a5abb68bafec4102964d5b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220207.
- Product
- Gimmie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2023A vulnerability, which was classified as critical, was found in Gimmie Plugin 1.2.2 on vBulletin.CVE-2014-125085 · Other software · Gimmie Project · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Gimmie Plugin 1.2.2 on vBulletin. Affected is an unknown function of the file trigger_ratethread.php. The manipulation of the argument t/postusername leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The patch is identified as f11a136e9cbd24997354965178728dc22a2aa2ed. It is recommended to upgrade the affected component. VDB-220206 is the identifier assigned to this vulnerability.
- Product
- Gimmie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2023A vulnerability, which was classified as critical, has been found in Gimmie Plugin 1.2.2 on vBulletin.CVE-2014-125084 · Other software · Gimmie Project · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in Gimmie Plugin 1.2.2 on vBulletin. This issue affects some unknown processing of the file trigger_referral.php. The manipulation of the argument referrername leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The identifier of the patch is 7194a09353dd24a274678383a4418f2fd3fce6f7. It is recommended to upgrade the affected component. The identifier VDB-220205 was assigned to this vulnerability.
- Product
- Gimmie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023A vulnerability, which was classified as critical, was found in Calendar Event Management System 2.3.0.CVE-2023-0675 · Other software · Calendar Event Management System Project · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Calendar Event Management System 2.3.0. This affects an unknown part. The manipulation of the argument start/end leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220197 was assigned to this vulnerability.
- Product
- Calendar Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023A vulnerability classified as critical has been found in OnShift TurboGears 1.0.11.10.CVE-2019-25101 · Other software · OnShift · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in OnShift TurboGears 1.0.11.10. This affects an unknown part of the file turbogears/controllers.py of the component HTTP Header Handler. The manipulation leads to http response splitting. It is possible to initiate the attack remotely. Upgrading to version 1.0.11.11 is able to address this issue. The patch is named f68bbaba47f4474e1da553aa51564a73e1d92a84. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220059.
- Product
- TurboGears
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications.CVE-2023-23933 · Other software · opensearch-project · reported by GitHubMedium 4.3
OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications. There is an issue with the application of document and field level restrictions in the Anomaly Detection plugin, where users with the Anomaly Detector role can read aggregated numerical data (e.g. averages, sums) of fields that are otherwise restricted to them. This issue only affects authenticated users who were previously granted read access to the indexes containing the restricted fields. This issue has been patched in versions 1.3.8 and 2.6.0. There are no known workarounds for this issue.
- Product
- anomaly-detection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023A vulnerability was found in fanzila WebFinance 0.5 and classified as critical.CVE-2013-10016 · Other software · fanzila · reported by VulDBMedium 5.5
A vulnerability was found in fanzila WebFinance 0.5 and classified as critical. This issue affects some unknown processing of the file htdocs/admin/save_taxes.php. The manipulation of the argument id leads to sql injection. The patch is named 306f170ca2a8203ae3d8f51fb219ba9e05b945e1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-220055.
- Product
- WebFinance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023A vulnerability has been found in fanzila WebFinance 0.5 and classified as critical.CVE-2013-10015 · Other software · fanzila · reported by VulDBMedium 5.5
A vulnerability has been found in fanzila WebFinance 0.5 and classified as critical. This vulnerability affects unknown code of the file htdocs/admin/save_Contract_Signer_Role.php. The manipulation of the argument n/v leads to sql injection. The patch is identified as abad81af614a9ceef3f29ab22ca6bae517619e06. It is recommended to apply a patch to fix this issue. VDB-220054 is the identifier assigned to this vulnerability.
- Product
- WebFinance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A vulnerability, which was classified as critical, was found in Multilaser RE057 and RE170 2.1/2.2.CVE-2023-0658 · Other software · Multilaser · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Multilaser RE057 and RE170 2.1/2.2. This affects an unknown part of the file /param.file.tgz of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The identifier VDB-220053 was assigned to this vulnerability.
- Product
- RE057
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A vulnerability has been found in dst-admin 1.5.0 and classified as critical.CVE-2023-0649 · Other software · Dst-admin Project · reported by VulDBMedium 6.3
A vulnerability has been found in dst-admin 1.5.0 and classified as critical. This vulnerability affects unknown code of the file /home/sendBroadcast. The manipulation of the argument message leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220036.
- Product
- Dst-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A vulnerability, which was classified as critical, was found in dst-admin 1.5.0.CVE-2023-0648 · Other software · Dst-admin Project · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in dst-admin 1.5.0. This affects an unknown part of the file /home/masterConsole. The manipulation of the argument command leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-220035.
- Product
- Dst-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A vulnerability, which was classified as critical, has been found in dst-admin 1.5.0.CVE-2023-0647 · Other software · Dst-admin Project · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in dst-admin 1.5.0. Affected by this issue is some unknown functionality of the file /home/kickPlayer. The manipulation of the argument userId leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-220034 is the identifier assigned to this vulnerability.
- Product
- Dst-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A vulnerability classified as critical was found in dst-admin 1.5.0.CVE-2023-0646 · Other software · Dst-admin Project · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in dst-admin 1.5.0. Affected by this vulnerability is an unknown functionality of the file /home/cavesConsole. The manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220033 was assigned to this vulnerability.
- Product
- Dst-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical.CVE-2023-0638 · Other software · TRENDnet · reported by VulDBHigh 7.2
A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-220018 is the identifier assigned to this vulnerability.
- Product
- TEW-811DRU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0.CVE-2023-0637 · Other software · TRENDnet · reported by VulDBMedium 6.5
A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. This affects an unknown part of the file wan.asp of the component Web Management Interface. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220017 was assigned to this vulnerability.
- Product
- TEW-811DRU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical.CVE-2023-0613 · Other software · TRENDnet · reported by VulDBHigh 7.5
A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /wireless/security.asp of the component httpd. The manipulation leads to memory corruption. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219937 was assigned to this vulnerability.
- Product
- TEW-811DRU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0.CVE-2023-0612 · Other software · TRENDnet · reported by VulDBHigh 7.5
A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. Affected is an unknown function of the file /wireless/basic.asp of the component httpd. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219936.
- Product
- TEW-811DRU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023A vulnerability, which was classified as critical, has been found in TRENDnet TEW-652BRP 3.04B01.CVE-2023-0611 · Other software · TRENDnet · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in TRENDnet TEW-652BRP 3.04B01. This issue affects some unknown processing of the file get_set.ccp of the component Web Management Interface. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219935.
- Product
- TEW-652BRP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a local attacker modifiesCVE-2022-42972 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.8
A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a local attacker modifies the webroot directory. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)
- Product
- APC Easy UPS Online Monitoring Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jan 31, 2023A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identitCVE-2022-42970 · Other software · Schneider Electric · reported by cybersecurity@se.comCritical 9.8
A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)
- Product
- APC Easy UPS Online Monitoring Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jan 31, 2023 ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of CVE-2023-0591 · Other software · jrspruitt · reported by research@onekey.comMedium 5.5
ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction directory (provided the process has write access to that file or directory). This is due to the fact that a node name (dent_node.name) is considered trusted and joined to the extraction directory path during processing, then the node content is written to that joined path. By crafting a malicious UBIFS file with node names holding path traversal payloads (e.g. ../../tmp/outside.txt), it's possible to force ubi_reader to write outside of the extraction directory. This issue affects ubi-reader before 0.8.5.
- Product
- ubi_reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2023 A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause access to manipulate and read specific files in the IGSS project CVE-2022-32528 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.6
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause access to manipulate and read specific files in the IGSS project report directory, potentially leading to a denial-of-service condition when an attacker sends specific messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170)
- Product
- IGSS Data Server (IGSSdataServer.exe)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jan 28, 2023A vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical.CVE-2021-4315 · Other software · NYUCCL · reported by VulDBMedium 5.5
A vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical. This vulnerability affects unknown code of the file psiturk/experiment.py. The manipulation of the argument mode leads to improper neutralization of special elements used in a template engine. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.1 is able to address this issue. The name of the patch is 47787e15cecd66f2aa87687bf852ae0194a4335f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-219676.
- Product
- psiTurk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023In onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility services due to a logic error in the code.CVE-2023-20921 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility services due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-243378132
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 23, 2023An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by connecting to the UART pins, interruptingCVE-2022-41505 · Network & remote access · Tp-link · reported by MITREMedium 6.4
An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by connecting to the UART pins, interrupting the boot process, and setting an init=/bin/sh value.
- Product
- Tapo C200 V1 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2023A vulnerability has been found in Anant Labs google-enterprise-connector-dctm up to 3.2.3 and classified as critical.CVE-2014-125083 · Other software · Anant Labs · reported by VulDBMedium 5.5
A vulnerability has been found in Anant Labs google-enterprise-connector-dctm up to 3.2.3 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username/domain leads to sql injection. The patch is named 6fba04f18ab7764002a1da308e7cd9712b501cb7. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218911.
- Product
- google-enterprise-connector-dctm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2023A vulnerability classified as critical has been found in oktora24 2moons.CVE-2013-10014 · Other software · oktora24 · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in oktora24 2moons. Affected is an unknown function. The manipulation leads to sql injection. The patch is identified as 1b09cf7672eb85b5b0c8a4de321f7a4ad87b09a7. It is recommended to apply a patch to fix this issue. VDB-218898 is the identifier assigned to this vulnerability.
- Product
- 2moons
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2023A vulnerability classified as critical has been found in ale7714 sigeprosi.CVE-2012-10006 · Other software · ale7714 · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in ale7714 sigeprosi. This affects an unknown part. The manipulation leads to sql injection. The identifier of the patch is 5291886f6c992316407c376145d331169c55f25b. It is recommended to apply a patch to fix this issue. The identifier VDB-218493 was assigned to this vulnerability.
- Product
- sigeprosi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2023OS Command Injection vulnerability in OKER G955V1 v1.03.02.20161128, allows physical attackers to interrupt the boot sequence and execute arbitrary commands witCVE-2020-22007 · Other software · Okerthai · reported by MITREMedium 6.8
OS Command Injection vulnerability in OKER G955V1 v1.03.02.20161128, allows physical attackers to interrupt the boot sequence and execute arbitrary commands with root privileges.
- Product
- G955v1 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comdropbox.com
Jan 18, 2023A vulnerability classified as critical was found in danynab movify-j.CVE-2015-10068 · Other software · danynab · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in danynab movify-j. This vulnerability affects the function getByMovieId of the file app/business/impl/ReviewServiceImpl.java. The manipulation of the argument movieId/username leads to sql injection. The name of the patch is c3085e01936a4d7eff1eda3093f25d56cc4d2ec5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218476.
- Product
- movify-j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability has been found in youngerheart nodeserver and classified as critical.CVE-2020-36651 · Other software · youngerheart · reported by VulDBMedium 5.5
A vulnerability has been found in youngerheart nodeserver and classified as critical. Affected by this vulnerability is an unknown functionality of the file nodeserver.js. The manipulation leads to path traversal. The identifier of the patch is c4c0f0138ab5afbac58e03915d446680421bde28. It is recommended to apply a patch to fix this issue. The identifier VDB-218461 was assigned to this vulnerability.
- Product
- nodeserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability was found in tynx wuersch and classified as critical.CVE-2015-10066 · Other software · tynx · reported by VulDBMedium 5.5
A vulnerability was found in tynx wuersch and classified as critical. Affected by this issue is the function packValue/getByCustomQuery of the file backend/base/Store.class.php. The manipulation leads to sql injection. The patch is identified as 66d4718750a741d1053d327a79e285fd50372519. It is recommended to apply a patch to fix this issue. VDB-218462 is the identifier assigned to this vulnerability.
- Product
- wuersch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability classified as critical has been found in PrivateSky apersistence.CVE-2017-20171 · Other software · PrivateSky · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in PrivateSky apersistence. This affects an unknown part of the file db/sql/mysqlUtils.js. The manipulation leads to sql injection. The identifier of the patch is 954425f61634b556fe644837a592a5b8fcfca068. It is recommended to apply a patch to fix this issue. The identifier VDB-218457 was assigned to this vulnerability.
- Product
- apersistence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability classified as critical was found in AenBleidd FiND.CVE-2015-10065 · Other software · AenBleidd · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in AenBleidd FiND. This vulnerability affects the function init_result of the file validator/my_validator.cpp. The manipulation leads to buffer overflow. The patch is identified as ee2eef34a83644f286c9adcaf30437f92e9c48f1. It is recommended to apply a patch to fix this issue. VDB-218458 is the identifier assigned to this vulnerability.
- Product
- FiND
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability, which was classified as critical, has been found in risheesh debutsav.CVE-2014-125081 · Other software · risheesh · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in risheesh debutsav. This issue affects some unknown processing. The manipulation leads to sql injection. The patch is named 7a8430df79277c613449262201cc792db894fc76. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218459.
- Product
- debutsav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023Git GUI is a convenient graphical tool that comes with Git for Windows.CVE-2022-41953 · Other software · git-for-windows · reported by GitHubHigh 8.6
Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line. Git GUI has a function to clone repositories. Immediately after the local clone is available, Git GUI will automatically post-process it, among other things running a spell checker called `aspell.exe` if it was found. Git GUI is implemented as a Tcl/Tk script. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable _always includes the current directory_. Therefore, malicious repositories can ship with an `aspell.exe` in their top-level directory which is executed by Git GUI without giving the user a chance to inspect it first, i.e. running untrusted code. This issue has been addressed in version 2.39.1. Users are advised to upgrade. Users unable to upgrade should avoid using Git GUI for cloning. If that is not a viable option, at least avoid cloning from untrusted sources.
- Product
- git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of serviCVE-2021-32837 · Other software · python-mechanize · reported by GitHubHigh 7.5
mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of service (ReDoS) prior to version 0.4.6. If a web server responds in a malicious way, then mechanize could crash. Version 0.4.6 has a patch for the issue.
- Product
- mechanize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability was found in saemorris TheRadSystem and classified as critical.CVE-2015-10063 · Other software · saemorris · reported by VulDBHigh 7.3
A vulnerability was found in saemorris TheRadSystem and classified as critical. This issue affects the function redirect of the file _login.php. The manipulation of the argument user/pass leads to sql injection. The attack may be initiated remotely. The identifier of the patch is bfba26bd34af31648a11af35a0bb66f1948752a6. It is recommended to apply a patch to fix this issue. The identifier VDB-218453 was assigned to this vulnerability.
- Product
- TheRadSystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability was found in MNBikeways database and classified as critical.CVE-2015-10060 · Other software · MNBikeways · reported by VulDBMedium 5.5
A vulnerability was found in MNBikeways database and classified as critical. This issue affects some unknown processing of the file Data/views.py. The manipulation of the argument id1/id2 leads to sql injection. The identifier of the patch is 829a027aca7c17f5a7ec1addca8dd5d5542f86ac. It is recommended to apply a patch to fix this issue. The identifier VDB-218417 was assigned to this vulnerability.
- Product
- database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability was found in PictureThisWebServer and classified as critical.CVE-2015-10055 · Other software · Picturethiswebserver Project · reported by VulDBMedium 5.5
A vulnerability was found in PictureThisWebServer and classified as critical. This issue affects the function router.post of the file routes/user.js. The manipulation of the argument username/password leads to sql injection. The patch is named 68b9dc346e88b494df00d88c7d058e96820e1479. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218399.
- Product
- Picturethiswebserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability, which was classified as critical, was found in githuis P2Manage.CVE-2015-10054 · Other software · githuis · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in githuis P2Manage. This affects the function Execute of the file PTwoManage/Database.cs. The manipulation of the argument sql leads to sql injection. The identifier of the patch is 717380aba80002414f82d93c770035198b7858cc. It is recommended to apply a patch to fix this issue. The identifier VDB-218397 was assigned to this vulnerability.
- Product
- P2Manage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability has been found in frontaccounting faplanet and classified as critical.CVE-2014-125080 · Other software · frontaccounting · reported by VulDBMedium 5.5
A vulnerability has been found in frontaccounting faplanet and classified as critical. This vulnerability affects unknown code. The manipulation leads to path traversal. The patch is identified as a5dcd87f46080a624b1a9ad4b0dd035bbd24ac50. It is recommended to apply a patch to fix this issue. VDB-218398 is the identifier assigned to this vulnerability.
- Product
- faplanet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp.CVE-2022-4890 · Other software · abhilash1985 · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some unknown processing of the file config/initializers/new_framework_defaults_7_0.rb of the component Cookie Handler. The manipulation leads to deserialization. The attack may be initiated remotely. The patch is named b067372f3ee26fe1b657121f0f41883ff4461a06. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218387.
- Product
- PredictApp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability classified as critical was found in Events Extension on BigTree.CVE-2018-25076 · Other software · Events Project · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in Events Extension on BigTree. Affected by this vulnerability is the function getRandomFeaturedEventByDate/getUpcomingFeaturedEventsInCategoriesWithSubcategories/recacheEvent/searchResults of the file classes/events.php. The manipulation leads to sql injection. The patch is named 11169e48ab1249109485fdb1e0c9fca3d25ba01d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218395.
- Product
- Events
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3.CVE-2015-10053 · Other software · prodigasistemas · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3. Affected is an unknown function of the file app/controllers/curupira/passwords_controller.rb. The manipulation leads to sql injection. Upgrading to version 0.1.4 is able to address this issue. The patch is identified as 93a9a77896bb66c949acb8e64bceafc74bc8c271. It is recommended to upgrade the affected component. VDB-218394 is the identifier assigned to this vulnerability.
- Product
- curupira
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability, which was classified as critical, was found in antonbolling clan7ups.CVE-2013-10012 · Other software · antonbolling · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in antonbolling clan7ups. Affected is an unknown function of the component Login/Session. The manipulation leads to sql injection. The name of the patch is 25afad571c488291033958d845830ba0a1710764. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218388.
- Product
- clan7ups
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability classified as critical has been found in karsany OBridge up to 1.3.CVE-2018-25075 · Other software · karsany · reported by VulDBMedium 4.6
A vulnerability classified as critical has been found in karsany OBridge up to 1.3. Affected is the function getAllStandaloneProcedureAndFunction of the file obridge-main/src/main/java/org/obridge/dao/ProcedureDao.java. The manipulation leads to sql injection. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.4 is able to address this issue. The name of the patch is 52eca4ad05f3c292aed3178b2f58977686ffa376. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218376.
- Product
- OBridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.