Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,308 results · page 89 of 127
Jul 6, 2022Editable SQL Queries behind Base64 encoding sending from the Client-Side to The Server-Side for a particular API used in legacy Work Center module.CVE-2022-30619 · Other software · Agile Point · reported by cna@cyber.gov.ilMedium 5.9
Editable SQL Queries behind Base64 encoding sending from the Client-Side to The Server-Side for a particular API used in legacy Work Center module. He attack is available for any authenticated user, in any kind of rule. under the function : /AgilePointServer/Extension/FetchUsingEncodedData in the parameter: EncodedData
- Product
- Agile Point NX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users.CVE-2022-35230 · Other software · Zabbix · reported by security@zabbix.comLow 3.7
An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
- Product
- Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgsupport.zabbix.com
Jul 6, 2022An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users.CVE-2022-35229 · Other software · Zabbix · reported by security@zabbix.comLow 3.7
An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
- Product
- Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.debian.org
Jul 1, 2022The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local neCVE-2022-25876 · Other software · Link-preview-js Project · reported by report@snyk.ioMedium 6.2
The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.
- Product
- Link-preview-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022Tenda M3 V1.0.0.12 was discovered to contain multiple stack overflow vulnerabilities via the ssidList, storeName, and trademark parameters in the function formSCVE-2022-32036 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda M3 V1.0.0.12 was discovered to contain multiple stack overflow vulnerabilities via the ssidList, storeName, and trademark parameters in the function formSetStoreWeb.
- Product
- M3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS usCVE-2022-25238 · Other software · Silverstripe · reported by MITREMedium 5.4
Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code.
- Product
- Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.silverstripe.orgforum.silverstripe.org
Jun 28, 2022Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.CVE-2022-0085 · Other software · dompdf · reported by security@huntr.devMedium 5.3
Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.
- Product
- dompdf/dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function.CVE-2022-32995 · Other software · Halo · reported by MITRECritical 9.8
Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022When performing the inference shape operation of the SparseToDense operator, if the number of inputs is less than three, it will access data outside of bounds oCVE-2021-33650 · Other software · Mindspore · reported by securities@openeuler.orgHigh 7.5
When performing the inference shape operation of the SparseToDense operator, if the number of inputs is less than three, it will access data outside of bounds of inputs which allocated from heap buffers.
- Product
- Mindspore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022When performing the inference shape operation of the Tile operator, if the input data type is not int or int32, it will access data outside of bounds of heap alCVE-2021-33647 · Other software · Mindspore · reported by securities@openeuler.orgHigh 7.5
When performing the inference shape operation of the Tile operator, if the input data type is not int or int32, it will access data outside of bounds of heap allocated buffers.
- Product
- Mindspore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.CVE-2022-2216 · Other software · ionicabizau · reported by security@huntr.devCritical 9.8
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.
- Product
- ionicabizau/parse-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF).CVE-2021-20544 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 198931.
- Product
- Jazz Team Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 24, 2022IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF).CVE-2021-20421 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- Product
- Jazz Team Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 24, 2022Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for CVE-2022-2105 · Other software · Secheron · reported by ics-cert@hq.dhs.govCritical 9.4
Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for the vendor. Web server root level access allows for changing of safety critical parameters.
- Product
- SEPCOS Control and Protection Relay firmware package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., from the browser console) or by loading the corresponCVE-2022-1667 · Other software · Secheron · reported by ics-cert@hq.dhs.govHigh 7.5
Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., from the browser console) or by loading the corresponding, browser accessible PHP script
- Product
- SEPCOS Control and Protection Relay firmware package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure.CVE-2022-1518 · Other software · Illumina · reported by ics-cert@hq.dhs.govCritical 10
LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure.
- Product
- NextSeq 550Dx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Logo parameter under the Link module.CVE-2022-34013 · Other software · Zhyd · reported by MITREMedium 4.3
OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Logo parameter under the Link module.
- Product
- Oneblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the parameter entryUrls.CVE-2022-34011 · Other software · Zhyd · reported by MITREMedium 4.3
OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the parameter entryUrls.
- Product
- Oneblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low priviCVE-2022-23080 · Other software · directus · reported by vulnerabilitylab@mend.ioMedium 5
In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2022An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloadinCVE-2022-1824 · Other software · McAfee,LLC · reported by trellixpsirt@trellix.comHigh 7.9
An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloading attack by using a specific file name. This could result in the user gaining elevated permissions and being able to execute arbitrary code as there were insufficient checks on the executable being signed by McAfee.
- Product
- McAfee Consumer Product Removal Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservice.mcafee.comservice.mcafee.com
Jun 20, 2022Custom Share Buttons with Floating Sidebar: Does not sanitise and escape some of its settingsCVE-2022-1717 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Share Buttons with Floating Sidebar WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- Custom Share Buttons with Floating Sidebar
- Fixed in
- 4.2
- What to do
- Update Custom Share Buttons with Floating Sidebar to 4.2 or newer.
Jun 19, 2022In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality.CVE-2022-23071 · Other software · recipes · reported by vulnerabilitylab@mend.ioMedium 6.5
In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server.CVE-2021-40903 · Other software · Antminer Monitor Project · reported by MITRECritical 9.8
A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static.
- Product
- Antminer Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Jun 16, 2022A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusteCVE-2022-32546 · Other software · Imagemagick · reported by Red HatHigh 7.8
A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Jun 16, 2022A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrusteCVE-2022-32545 · Other software · Imagemagick · reported by Red HatHigh 7.8
A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Jun 15, 2022flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.CVE-2021-41403 · Other software · Flatcore · reported by MITRECritical 9.8
flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.
- Product
- Flatcore-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022There is a reflective cross-site scripting (XSS) vulnerability in the PHPCMS V9.6.3 management side.CVE-2021-40910 · Websites & servers · Phpcms · reported by MITREMedium 6.1
There is a reflective cross-site scripting (XSS) vulnerability in the PHPCMS V9.6.3 management side.
- Product
- Phpcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Possible buffer overflow due to improper validation of SSID length received from beacon or probe response during an IBSS session in Snapdragon Auto, Snapdragon CVE-2021-35081 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Possible buffer overflow due to improper validation of SSID length received from beacon or probe response during an IBSS session in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 14, 2022Disabled SMMU from secure side while RPM is assigned a secure stream can lead to information disclosure in Snapdragon Industrial IOT, Snapdragon Mobile, SnapdraCVE-2021-35080 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.5
Disabled SMMU from secure side while RPM is assigned a secure stream can lead to information disclosure in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- Product
- Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 13, 2022A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deCVE-2021-40604 · Other software · Invisioncommunity · reported by MITRECritical 9.1
A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated user.
- Product
- IPS Community Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinvisioncommunity.cominvisioncommunity.com
Jun 13, 2022Vulnerability of residual files not being deleted after an update in the ChinaDRM module.CVE-2021-46813 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Vulnerability of residual files not being deleted after an update in the ChinaDRM module. Successful exploitation of this vulnerability may affect availability.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 13, 2022Sideblog: Does not have CSRF check in placeCVE-2022-1787 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- Sideblog
- Affected
- up to 6.0
- What to do
- Affects up to 6.0. Update Sideblog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 12, 2022In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remoCVE-2021-41749 · Other software · Nystudio107 · reported by MITRECritical 9.8
In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.
- Product
- Seomatic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022IdeaLMS 2022 allows SQL injection via the IdeaLMS/ChatRoom/ClassAccessControl/6?isBigBlueButton=0&ClassID= pathname.CVE-2022-31788 · Other software · Ideaco · reported by MITRECritical 9.8
IdeaLMS 2022 allows SQL injection via the IdeaLMS/ChatRoom/ClassAccessControl/6?isBigBlueButton=0&ClassID= pathname.
- Product
- Idealms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 9, 2022Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism.CVE-2022-31813 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comhttpd.apache.org
Jun 9, 2022Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php.CVE-2022-31830 · Other software · Baidu · reported by MITRECritical 9.1
Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php.
- Product
- Kity Minder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php.CVE-2022-31827 · Other software · Monstaftp · reported by MITRECritical 9.1
MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php.
- Product
- Monstaftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsController.php.CVE-2022-31393 · Other software · Jizhicms · reported by MITRECritical 9.1
Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsController.php.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/TemplateController.php.CVE-2022-31390 · Other software · Jizhicms · reported by MITRECritical 9.1
Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/TemplateController.php.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022A Server-Side Request Forgery (SSRF) in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via injecCVE-2022-31386 · Other software · Nbnbk Project · reported by MITRECritical 9.1
A Server-Side Request Forgery (SSRF) in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the URL parameter.
- Product
- Nbnbk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Vapor is a server-side Swift HTTP web framework.CVE-2022-31019 · Other software · vapor · reported by GitHubHigh 7.5
Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: `curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo`. The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow and a process crash. This issue has been fixed in version 4.61.1.
- Product
- vapor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2022H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Edit_BasicSSID parameter at /goform/aspForm.CVE-2022-30920 · Other software · H3c · reported by MITRECritical 9.8
H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Edit_BasicSSID parameter at /goform/aspForm.
- Product
- Magic R100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2022H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Edit_BasicSSID_5G parameter at /goform/aspForm.CVE-2022-30919 · Other software · H3c · reported by MITRECritical 9.8
H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Edit_BasicSSID_5G parameter at /goform/aspForm.
- Product
- Magic R100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2022FileZilla v3.59.0 allows attackers to obtain cleartext passwords of connected SSH or FTP servers via a memory dump.- NOTE: the vendor does not consider this a vCVE-2022-29620 · Other software · Filezilla-project · reported by MITREMedium 6.5
FileZilla v3.59.0 allows attackers to obtain cleartext passwords of connected SSH or FTP servers via a memory dump.- NOTE: the vendor does not consider this a vulnerability
- Product
- Filezilla Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhichbuffer.medium.comyoutu.be
Jun 7, 2022Implicit Intent hijacking vulnerability in Settings prior to SMR Jun-2022 Release 1 allows attackers to get Wi-Fi SSID and password via a malicious QR code scanCVE-2022-30729 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Implicit Intent hijacking vulnerability in Settings prior to SMR Jun-2022 Release 1 allows attackers to get Wi-Fi SSID and password via a malicious QR code scanner.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 6, 2022The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to inCVE-2022-28051 · Other software · Seeddms · reported by MITREMedium 5.4
The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to inject malicious javascript code.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Owl Labs Meeting Owl 5.2.0.15 does not require a password for Bluetooth commands, because only client-side authentication is used.CVE-2022-31463 · Other software · Owllabs · reported by MITREHigh 8.2
Owl Labs Meeting Owl 5.2.0.15 does not require a password for Bluetooth commands, because only client-side authentication is used.
- Product
- Meeting OWL Pro Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarstechnica.comresources.owllabs.com
Jun 2, 2022elitecms 1.01 is vulnerable to SQL Injection via /admin/edit_sidebar.php.CVE-2022-30816 · Other software · Elitecms · reported by MITRECritical 9.8
elitecms 1.01 is vulnerable to SQL Injection via /admin/edit_sidebar.php.
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022elitecms 1.01 is vulnerable to SQL Injection via admin/edit_sidebar.php?page=2&sidebar=CVE-2022-30815 · Other software · Elitecms · reported by MITRECritical 9.8
elitecms 1.01 is vulnerable to SQL Injection via admin/edit_sidebar.php?page=2&sidebar=
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022elitecms v1.01 is vulnerable to SQL Injection via /admin/add_sidebar.php.CVE-2022-30814 · Other software · Elitecms · reported by MITRECritical 9.8
elitecms v1.01 is vulnerable to SQL Injection via /admin/add_sidebar.php.
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.