Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,271 results · page 9 of 26

Sep 12, 20233D Viewer Remote Code Execution VulnerabilityCVE-2023-36740 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Viewer Remote Code Execution Vulnerability
Product
3D Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Sep 12, 20233D Viewer Remote Code Execution VulnerabilityCVE-2023-36739 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Viewer Remote Code Execution Vulnerability
Product
3D Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Aug 9, 2023A SQL injection vulnerability exists in the “message viewer iframe” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it dCVE-2022-48603 · Other software · ScienceLogic · reported by contact@securifera.comHigh 8.8
A SQL injection vulnerability exists in the “message viewer iframe” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
Product
SL 1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securifera.com securifera.com
Aug 9, 2023A SQL injection vulnerability exists in the “message viewer print” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it diCVE-2022-48602 · Other software · ScienceLogic · reported by contact@securifera.comHigh 8.8
A SQL injection vulnerability exists in the “message viewer print” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
Product
SL 1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securifera.com securifera.com
Jul 10, 2023SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network whiCVE-2023-31405 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability.
Product
SAP NetWeaver AS for Java (Log Viewer)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Jun 22, 2023Cross site scripting (XSS) vulnerabiliy in dmarcts-report-viewer dashboard versions 1.1 and thru commit 8a1d882b4c481a05e296e9b38a7961e912146a0f, allows unautheCVE-2023-34796 · Other software · Techsneeze · reported by MITREMedium 6.1
Cross site scripting (XSS) vulnerabiliy in dmarcts-report-viewer dashboard versions 1.1 and thru commit 8a1d882b4c481a05e296e9b38a7961e912146a0f, allows unauthenticated attackers to execute arbitrary code via the org_name or domain values.
Product
Dmarc Report
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com xmit.xyz
Jun 14, 2023An improper authorization check of local device settings in TeamViewer Remote between version 15.41 and 15.42.7 for Windows and macOS allows an unprivileged usCVE-2023-0837 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 6.6
An improper authorization check of local device settings in TeamViewer Remote between version 15.41 and 15.42.7 for Windows and macOS allows an unprivileged user to change basic local device settings even though the options were locked. This can result in unwanted changes to the configuration.
Product
Remote
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record teamviewer.com teamviewer.com
Jun 9, 2023Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values.CVE-2023-2121 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.3
Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.
Product
Vault
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.hashicorp.com discuss.hashicorp.com
May 31, 2023A vulnerability was found in meitar Inline Google Spreadsheet Viewer Plugin up to 0.9.6 on WordPress and classified as problematic.CVE-2015-10108 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability was found in meitar Inline Google Spreadsheet Viewer Plugin up to 0.9.6 on WordPress and classified as problematic. Affected by this issue is the function displayShortcode of the file inline-gdocs-viewer.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 0.9.6.1 is able to address this issue. The patch is identified as 2a8057df8ca30adc859cecbe5cad21ac28c5b747. It is recommended to upgrade the affected component. VDB-230234 is the identifier assigned to this vulnerability.
Product
meitar Inline Google Spreadsheet Viewer
Affected
up to 0.9.6
What to do
Affects up to 0.9.6. Update meitar Inline Google Spreadsheet Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
May 26, 2023An issue was discovered in Papaya Viewer 1.0.1449.CVE-2023-33255 · Other software · Uthscsa · reported by MITREMedium 6.1
An issue was discovered in Papaya Viewer 1.0.1449. User-supplied input in form of DICOM or NIFTI images can be loaded into the Papaya web application without any kind of sanitization. This allows injection of arbitrary JavaScript code into image metadata, which is executed when that metadata is displayed in the Papaya web application.
Product
Papaya Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
May 3, 2023An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint.CVE-2023-29240 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 5.4
An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Product
BIG-IQ
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record my.f5.com my.f5.com
Apr 6, 2023The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.CVE-2023-29016 · Other software · intranda · reported by GitHubMedium 6.1
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when using nicknames. An attacker could create a user account and enter malicious scripts into their profile's nickname, resulting in the execution in the user's browser when displaying the nickname on certain pages. The vulnerability has been fixed in version 23.03.
Product
goobi-viewer-core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 6, 2023The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.CVE-2023-29015 · Other software · intranda · reported by GitHubMedium 6.1
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user's browser when displaying the comment. The vulnerability has been fixed in version 23.03.
Product
goobi-viewer-core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 6, 2023The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.CVE-2023-29014 · Other software · intranda · reported by GitHubMedium 6.1
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser. The vulnerability has been fixed in version 23.03.
Product
goobi-viewer-core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 28, 2023An issue was discovered in Online Reviewer Management System v1.0.CVE-2023-25432 · Other software · Online Reviewer Management System Project · reported by MITREHigh 7.2
An issue was discovered in Online Reviewer Management System v1.0. There is a SQL injection that can directly issue instructions to the background database system via reviewer_0/admins/assessments/course/course-update.php.
Product
Online Reviewer Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 28, 2023An issue was discovered in Online Reviewer Management System v1.0.CVE-2023-25431 · Other software · Online Reviewer Management System Project · reported by MITREMedium 4.8
An issue was discovered in Online Reviewer Management System v1.0. There is a XSS vulnerability via reviewer_0/admins/assessments/course/course-update.php.
Product
Online Reviewer Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 6, 2023PDF.js Viewer: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4670 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF.js Viewer WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
PDF.js Viewer
Fixed in
2.1.8
What to do
Update PDF.js Viewer to 2.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2023HPSFViewer might allow Escalation of Privilege.CVE-2022-3990 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.8
HPSFViewer might allow Escalation of Privilege. This potential vulnerability was remediated on July 29th, 2022. Customers who opted for automatic updates should have already received the remediation.
Product
HPSFViewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hp.com support.hp.com
Jan 30, 2023PDF Viewer: Does not validate and escape one of its shortcode attributesCVE-2023-0033 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF Viewer WordPress plugin before 1.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
PDF Viewer
Fixed in
1.0.0
What to do
Update PDF Viewer to 1.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 27, 2023Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.CVE-2022-48011 · Other software · Opencats · reported by MITRECritical 9.8
Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
Product
Opencats
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 26, 2023Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_CVE-2021-36539 · Other software · Instructure · reported by MITREMedium 6.5
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).
Product
Canvas Learning Management Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 14, 2022A vulnerability, which was classified as critical, has been found in bspkrs MCPMappingViewer.CVE-2022-4494 · Other software · bspkrs · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in bspkrs MCPMappingViewer. Affected by this issue is the function extractZip of the file src/main/java/bspkrs/mmv/RemoteZipHandler.java of the component ZIP File Handler. The manipulation leads to path traversal. The attack may be launched remotely. The name of the patch is 6e602746c96b4756c271d080dae7d22ad804a1bd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215804.
Product
MCPMappingViewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Nov 9, 2022Improper input validation vulnerability in DualOutFocusViewer prior to SMR Nov-2022 Release 1 allows local attacker to perform an arbitrary code execution.CVE-2022-39880 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.1
Improper input validation vulnerability in DualOutFocusViewer prior to SMR Nov-2022 Release 1 allows local attacker to perform an arbitrary code execution.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Nov 3, 2022In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settingsCVE-2022-44623 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings
Product
TeamCity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com jetbrains.com
Oct 31, 2022 Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the applicationCVE-2022-39019 · Other software · M-Files · reported by vdp@themissinglink.com.auMedium 6.3
Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server.
Product
Hubshare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 24, 2022Stack-based buffer overflow in WTViewerE series WTViewerE 761941 from 1.31 to 1.61 and WTViewerEfree from 1.01 to 1.52 allows an attacker to cause the product tCVE-2022-40984 · Other software · Yokogawa Test & Measurement Corporation · reported by vultures@jpcert.or.jpCritical 9.8
Stack-based buffer overflow in WTViewerE series WTViewerE 761941 from 1.31 to 1.61 and WTViewerEfree from 1.01 to 1.52 allows an attacker to cause the product to crash by processing a long file name.
Product
WTViewerE series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cdn.aff.yokogawa.com jvn.jp
Oct 20, 2022Simple Exam Reviewer Management System v1.0 is vulnerable to Insecure file upload.CVE-2022-42201 · Other software · Simple Exam Reviewer Management System Project · reported by MITREHigh 7.2
Simple Exam Reviewer Management System v1.0 is vulnerable to Insecure file upload.
Product
Simple Exam Reviewer Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sourcecodester.com
Oct 20, 2022Simple Exam Reviewer Management System v1.0 is vulnerable to Stored Cross Site Scripting (XSS) via the Exam List.CVE-2022-42200 · Other software · Simple Exam Reviewer Management System Project · reported by MITREMedium 5.4
Simple Exam Reviewer Management System v1.0 is vulnerable to Stored Cross Site Scripting (XSS) via the Exam List.
Product
Simple Exam Reviewer Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sourcecodester.com
Oct 20, 2022Simple Exam Reviewer Management System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Exam List.CVE-2022-42199 · Other software · Simple Exam Reviewer Management System Project · reported by MITREHigh 8.8
Simple Exam Reviewer Management System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Exam List.
Product
Simple Exam Reviewer Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 20, 2022In Simple Exam Reviewer Management System v1.0 the User List function suffers from insecure file upload.CVE-2022-42198 · Other software · Simple Exam Reviewer Management System Project · reported by MITREHigh 8.8
In Simple Exam Reviewer Management System v1.0 the User List function suffers from insecure file upload.
Product
Simple Exam Reviewer Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sourcecodester.com
Oct 20, 2022In Simple Exam Reviewer Management System v1.0 the User List function has improper access control that allows low privileged users to modify user permissions toCVE-2022-42197 · Other software · Simple Exam Reviewer Management System Project · reported by MITREMedium 6.5
In Simple Exam Reviewer Management System v1.0 the User List function has improper access control that allows low privileged users to modify user permissions to higher privileges.
Product
Simple Exam Reviewer Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sourcecodester.com
Oct 19, 2022OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.CVE-2022-43023 · Other software · Opencats · reported by MITREMedium 6.5
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
Product
Opencats
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 17, 2022A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issuCVE-2022-2428 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.4
A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests
Product
GitLab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com gitlab.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, vds.x3d) file received from untrusted sources in SAP 3D VCVE-2022-41202 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, vds.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens a manipulated Right Hemisphere Binary (.rh, rh.x3d) file received from untrusted sources in SAP 3D CVE-2022-41201 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens a manipulated Right Hemisphere Binary (.rh, rh.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens a manipulated Scalable Vector Graphic (.svg, svg.x3d) file received from untrusted sources in SAP 3CVE-2022-41200 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens a manipulated Scalable Vector Graphic (.svg, svg.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens a manipulated Open Inventor File (.iv, vrml.x3d) file received from untrusted sources in SAP 3D VisCVE-2022-41199 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens a manipulated Open Inventor File (.iv, vrml.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens a manipulated SketchUp (.skp, SketchUp.x3d) file received from untrusted sources in SAP 3D Visual ECVE-2022-41198 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens a manipulated SketchUp (.skp, SketchUp.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sources in SAP 3D Visual EnCVE-2022-41197 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible for the application to crash and becomes temporarily unavailable to the user until restart of the application.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sources in SAP 3D Visual EnCVE-2022-41196 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens a manipulated EAAmiga Interchange File Format (.iff, 2d.x3d) file received from untrusted sources iCVE-2022-41195 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens a manipulated EAAmiga Interchange File Format (.iff, 2d.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens a manipulated Encapsulated Postscript (.eps, ai.x3d) file received from untrusted sources in SAP 3DCVE-2022-41194 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens a manipulated Encapsulated Postscript (.eps, ai.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible for the application to crash and becomes temporarily unavailable to the user until restart of the application.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens a manipulated Encapsulated Post Script (.eps, ai.x3d) file received from untrusted sources in SAP 3CVE-2022-41193 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens a manipulated Encapsulated Post Script (.eps, ai.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens manipulated Jupiter Tesselation (.jt, JTReader.x3d) file received from untrusted sources in SAP 3D CVE-2022-41192 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens manipulated Jupiter Tesselation (.jt, JTReader.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible for the application to crash and becomes temporarily unavailable to the user until restart of the application.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) file received from untrusted sources in SAP 3CVE-2022-41191 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dxf, TeighaTranslator.exe) file received from untrusted sources in SAP 3D VCVE-2022-41190 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dxf, TeighaTranslator.exe) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dwg, TeighaTranslator.exe) file received from untrusted sources in SAP 3D VCVE-2022-41189 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dwg, TeighaTranslator.exe) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untrusted sources in SAP CVE-2022-41188 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible for the application to crash and becomes temporarily unavailable to the user until restart of the application.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens a manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untrusted sources in SACVE-2022-41187 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens a manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) file received from untrusted sources in CVE-2022-41186 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, a Remote Code Execution can be triggered when payload forces a stack-based overflow and or a re-use of dangling pointer which refers to overwritten space in memory.
Product
SAP 3D Visual Enterprise Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.