Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,841 results · page 90 of 137
Jan 6, 2023A vulnerability, which was classified as critical, was found in JoomGallery up to 3.3.3.CVE-2018-25067 · Other software · Joomgallery Project · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in JoomGallery up to 3.3.3. This affects an unknown part of the file administrator/components/com_joomgallery/views/config/tmpl/default.php of the component Image Sort Handler. The manipulation leads to sql injection. Upgrading to version 3.3.4 is able to address this issue. The identifier of the patch is dc414ee954e849082260f8613e15a1c1e1d354a1. It is recommended to upgrade the affected component. The identifier VDB-217569 was assigned to this vulnerability.
- Product
- Joomgallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability was found in JervenBolleman sparql-identifiers and classified as critical.CVE-2014-125052 · Other software · JervenBolleman · reported by VulDBMedium 5.5
A vulnerability was found in JervenBolleman sparql-identifiers and classified as critical. This issue affects some unknown processing of the file src/main/java/org/identifiers/db/RegistryDao.java. The manipulation leads to sql injection. The patch is named 44bb0db91c064e305b192fc73521d1dfd25bde52. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217571.
- Product
- sparql-identifiers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability was found in ScottTZhang voter-js and classified as critical.CVE-2014-125050 · Other software · ScottTZhang · reported by VulDBMedium 5.5
A vulnerability was found in ScottTZhang voter-js and classified as critical. Affected by this issue is some unknown functionality of the file main.js. The manipulation leads to sql injection. The patch is identified as 6317c67a56061aeeaeed3cf9ec665fd9983d8044. It is recommended to apply a patch to fix this issue. VDB-217562 is the identifier assigned to this vulnerability.
- Product
- voter-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability classified as critical was found in Arthmoor QSF-Portal.CVE-2019-25099 · Other software · Arthmoor · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in Arthmoor QSF-Portal. This vulnerability affects unknown code of the file index.php. The manipulation of the argument a leads to path traversal. The patch is identified as ea4f61e23ecb83247d174bc2e2cbab521c751a7d. It is recommended to apply a patch to fix this issue. VDB-217558 is the identifier assigned to this vulnerability.
- Product
- QSF-Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability has been found in DBRisinajumi d2files and classified as critical.CVE-2015-10018 · Other software · DBRisinajumi · reported by VulDBMedium 5.5
A vulnerability has been found in DBRisinajumi d2files and classified as critical. Affected by this vulnerability is the function actionUpload/actionDownloadFile of the file controllers/D2filesController.php. The manipulation leads to sql injection. Upgrading to version 1.0.0 is able to address this issue. The identifier of the patch is b5767f2ec9d0f3cbfda7f13c84740e2179c90574. It is recommended to upgrade the affected component. The identifier VDB-217561 was assigned to this vulnerability.
- Product
- d2files
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in typcn Blogile.CVE-2014-125049 · Other software · typcn · reported by VulDBMedium 5.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in typcn Blogile. Affected is the function getNav of the file server.js. The manipulation of the argument query leads to sql injection. The name of the patch is cfec31043b562ffefe29fe01af6d3c5ed1bf8f7d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217560. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Blogile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability, which was classified as critical, has been found in kassi xingwall.CVE-2014-125048 · Other software · kassi · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in kassi xingwall. This issue affects some unknown processing of the file app/controllers/oauth.js. The manipulation leads to session fixiation. The patch is named e9f0d509e1408743048e29d9c099d36e0e1f6ae7. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217559.
- Product
- xingwall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability classified as critical has been found in tbezman school-store.CVE-2014-125047 · Other software · tbezman · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in tbezman school-store. This affects an unknown part. The manipulation leads to sql injection. The identifier of the patch is 2957fc97054216d3a393f1775efd01ae2b072001. It is recommended to apply a patch to fix this issue. The identifier VDB-217557 was assigned to this vulnerability.
- Product
- school-store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability was found in trampgeek jobe up to 1.6.x and classified as critical.CVE-2020-36642 · Other software · trampgeek · reported by VulDBMedium 5.5
A vulnerability was found in trampgeek jobe up to 1.6.x and classified as critical. This issue affects the function run_in_sandbox of the file application/libraries/LanguageTask.php. The manipulation leads to command injection. Upgrading to version 1.7.0 is able to address this issue. The identifier of the patch is 8f43daf50c943b98eaf0c542da901a4a16e85b02. It is recommended to upgrade the affected component. The identifier VDB-217553 was assigned to this vulnerability.
- Product
- jobe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability has been found in HPI-Information-Systems ProLOD and classified as critical.CVE-2015-10017 · Other software · HPI-Information-Systems · reported by VulDBMedium 5.5
A vulnerability has been found in HPI-Information-Systems ProLOD and classified as critical. This vulnerability affects unknown code. The manipulation of the argument this leads to sql injection. The name of the patch is 3f710905458d49c77530bd3cbcd8960457566b73. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217552.
- Product
- ProLOD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability classified as critical has been found in JATOS.CVE-2022-4878 · Other software · Jatos · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in JATOS. Affected is the function ZipUtil of the file modules/common/app/utils/common/ZipUtil.java of the component ZIP Handler. The manipulation leads to path traversal. Upgrading to version 3.7.5-alpha is able to address this issue. The name of the patch is 2b42519f309d8164e8811392770ce604cdabb5da. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217548.
- Product
- Jatos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability, which was classified as critical, has been found in jeff-kelley opensim-utils.CVE-2015-10016 · Other software · jeff-kelley · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in jeff-kelley opensim-utils. Affected by this issue is the function DatabaseForRegion of the file regionscrits.php. The manipulation of the argument region leads to sql injection. The patch is identified as c29e5c729a833a29dbf5b1e505a0553fe154575e. It is recommended to apply a patch to fix this issue. VDB-217550 is the identifier assigned to this vulnerability.
- Product
- opensim-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability, which was classified as critical, was found in Seiji42 cub-scout-tracker.CVE-2014-125046 · Other software · Seiji42 · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Seiji42 cub-scout-tracker. This affects an unknown part of the file databaseAccessFunctions.js. The manipulation leads to sql injection. The patch is named b4bc1a328b1f59437db159f9d136d9ed15707e31. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217551.
- Product
- cub-scout-tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2023A vulnerability has been found in meol1 and classified as critical.CVE-2014-125045 · Other software · Meol1 Project · reported by VulDBMedium 5.5
A vulnerability has been found in meol1 and classified as critical. Affected by this vulnerability is the function GetAnimal of the file opdracht4/index.php. The manipulation of the argument where leads to sql injection. The identifier of the patch is 82441e413f87920d1e8f866e8ef9d7f353a7c583. It is recommended to apply a patch to fix this issue. The identifier VDB-217525 was assigned to this vulnerability.
- Product
- Meol1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2023A vulnerability has been found in Red Snapper NView and classified as critical.CVE-2017-20163 · Other software · Red Snapper · reported by VulDBMedium 5.5
A vulnerability has been found in Red Snapper NView and classified as critical. This vulnerability affects the function mutate of the file src/Session.php. The manipulation of the argument session leads to sql injection. The name of the patch is cbd255f55d476b29e5680f66f48c73ddb3d416a8. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217516.
- Product
- NView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2023A vulnerability, which was classified as critical, was found in soshtolsus wing-tight.CVE-2014-125044 · Other software · soshtolsus · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in soshtolsus wing-tight. This affects an unknown part of the file index.php. The manipulation of the argument p leads to file inclusion. It is possible to initiate the attack remotely. Upgrading to version 1.0.0 is able to address this issue. The patch is named 567bc33e6ed82b0d0179c9add707ac2b257aeaf2. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217515.
- Product
- wing-tight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2023 IBM Robotic Process Automation 20.12 through 21.0.6 could allow an attacker with physical access to the system to obtain highly sensitive information from systCVE-2022-41740 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.6
IBM Robotic Process Automation 20.12 through 21.0.6 could allow an attacker with physical access to the system to obtain highly sensitive information from system memory. IBM X-Force ID: 238053.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 5, 2023A vulnerability, which was classified as critical, has been found in glidernet ogn-live.CVE-2015-10015 · Other software · glidernet · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in glidernet ogn-live. This issue affects some unknown processing. The manipulation leads to sql injection. The patch is named bc0f19965f760587645583b7624d66a260946e01. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217487.
- Product
- ogn-live
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2023A vulnerability classified as critical was found in Miccighel PR-CWT.CVE-2014-125041 · Other software · Miccighel · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in Miccighel PR-CWT. This vulnerability affects unknown code. The manipulation leads to sql injection. The patch is identified as e412127d07004668e5a213932c94807d87067a1f. It is recommended to apply a patch to fix this issue. VDB-217486 is the identifier assigned to this vulnerability.
- Product
- PR-CWT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2023A vulnerability classified as critical has been found in arekk uke.CVE-2015-10014 · Other software · arekk · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in arekk uke. This affects an unknown part of the file lib/uke/finder.rb. The manipulation leads to sql injection. The identifier of the patch is 52fd3b2d0bc16227ef57b7b98a3658bb67c1833f. It is recommended to apply a patch to fix this issue. The identifier VDB-217485 was assigned to this vulnerability.
- Product
- uke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2023A vulnerability was found in soerennb eXtplorer up to 2.1.12 and classified as critical.CVE-2019-25097 · Other software · soerennb · reported by VulDBMedium 5.5
A vulnerability was found in soerennb eXtplorer up to 2.1.12 and classified as critical. Affected by this issue is some unknown functionality of the component Directory Content Handler. The manipulation leads to path traversal. Upgrading to version 2.1.13 is able to address this issue. The name of the patch is b8fcb888f4ff5e171c16797a4b075c6c6f50bf46. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217436.
- Product
- eXtplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023A vulnerability has been found in ghostlander Halcyon and classified as critical.CVE-2021-4300 · Other software · ghostlander · reported by VulDBMedium 6.3
A vulnerability has been found in ghostlander Halcyon and classified as critical. Affected by this vulnerability is the function CBlock::AddToBlockIndex of the file src/main.cpp of the component Block Verification. The manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version 1.1.1.0-hal is able to address this issue. The identifier of the patch is 0675b25ae9cc10b5fdc8ea3a32c642979762d45e. It is recommended to upgrade the affected component. The identifier VDB-217417 was assigned to this vulnerability.
- Product
- Halcyon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023A vulnerability has been found in AlliedModders AMX Mod X on Windows and classified as critical.CVE-2020-36639 · Other software · AlliedModders · reported by VulDBMedium 4.3
A vulnerability has been found in AlliedModders AMX Mod X on Windows and classified as critical. This vulnerability affects the function cmdVoteMap of the file plugins/adminvote.sma of the component Console Command Handler. The manipulation of the argument amx_votemap leads to path traversal. The patch is identified as a5f2b5539f6d61050b68df8b22ebb343a2862681. It is recommended to apply a patch to fix this issue. VDB-217354 is the identifier assigned to this vulnerability.
- Product
- AMX Mod X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023A vulnerability classified as critical was found in gesellix titlelink on Joomla.CVE-2010-10003 · Other software · gesellix · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in gesellix titlelink on Joomla. Affected by this vulnerability is an unknown functionality of the file plugin_content_title.php. The manipulation of the argument phrase leads to sql injection. The patch is named b4604e523853965fa981a4e79aef4b554a535db0. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217351.
- Product
- titlelink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2023A vulnerability has been found in IS_Projecto2 and classified as critical.CVE-2014-125038 · Other software · IS Projecto2 Project · reported by VulDBMedium 5.5
A vulnerability has been found in IS_Projecto2 and classified as critical. This vulnerability affects unknown code of the file Cnn-EJB/ejbModule/ejbs/NewsBean.java. The manipulation of the argument date leads to sql injection. The name of the patch is aa128b2c9c9fdcbbf5ecd82c1e92103573017fe0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217192.
- Product
- IS Projecto2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2023A vulnerability, which was classified as critical, was found in License to Kill.CVE-2014-125037 · Other software · License TO Kill Project · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in License to Kill. This affects an unknown part of the file models/injury.rb. The manipulation of the argument name leads to sql injection. The patch is named cd11cf174f361c98e9b1b4c281aa7b77f46b5078. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217191.
- Product
- License TO Kill
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2023A vulnerability classified as critical has been found in Hesburgh Libraries of Notre Dame Sipity.CVE-2021-4298 · Other software · Hesburgh Libraries of Notre Dame · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in Hesburgh Libraries of Notre Dame Sipity. This affects the function SearchCriteriaForWorksParameter of the file app/parameters/sipity/parameters/search_criteria_for_works_parameter.rb. The manipulation leads to sql injection. Upgrading to version 2021.8 is able to address this issue. The patch is named d1704c7363b899ffce65be03a796a0ee5fdbfbdc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217179.
- Product
- Sipity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2023A vulnerability, which was classified as critical, has been found in taoeffect Empress.CVE-2014-125030 · Other software · taoeffect · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in taoeffect Empress. Affected by this issue is some unknown functionality. The manipulation leads to use of hard-coded password. The patch is identified as 557e177d8a309d6f0f26de46efb38d43e000852d. It is recommended to apply a patch to fix this issue. VDB-217154 is the identifier assigned to this vulnerability.
- Product
- Empress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2022A vulnerability was found in Exciting Printer and classified as critical.CVE-2017-20156 · Other software · Exciting · reported by VulDBMedium 5.5
A vulnerability was found in Exciting Printer and classified as critical. This issue affects some unknown processing of the file lib/printer/jobs/prepare_page.rb of the component Argument Handler. The manipulation of the argument URL leads to command injection. The patch is named 5f8c715d6e2cc000f621a6833f0a86a673462136. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217139.
- Product
- Printer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where a helper function maps more physical pages than were requesCVE-2022-34674 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.8
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where a helper function maps more physical pages than were requested, which may lead to undefined behavior or an information leak.
- Product
- vGPU software (guest driver) - Linux, vGPU software (Virtual GPU Manager), NVIDIA Cloud Gaming (guest driver), NVIDIA Cloud Gaming (Virtual GPU Manager)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgnvidia.custhelp.com
Dec 30, 2022A vulnerability was found in Modbus Tools Modbus Poll up to 9.10.0 and classified as critical.CVE-2022-4857 · Other software · Modbus Tools · reported by VulDBMedium 6.3
A vulnerability was found in Modbus Tools Modbus Poll up to 9.10.0 and classified as critical. Affected by this issue is some unknown functionality of the file mbpoll.exe of the component mbp File Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-217022 is the identifier assigned to this vulnerability.
- Product
- Modbus Poll
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022A vulnerability has been found in Modbus Tools Modbus Slave up to 7.5.1 and classified as critical.CVE-2022-4856 · Other software · Modbus Tools · reported by VulDBMedium 6.3
A vulnerability has been found in Modbus Tools Modbus Slave up to 7.5.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file mbslave.exe of the component mbs File Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-217021 was assigned to this vulnerability.
- Product
- Modbus Slave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability was found in Widoco and classified as critical.CVE-2022-4772 · Other software · Widoco Project · reported by VulDBMedium 4.5
A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is f2279b76827f32190adfa9bd5229b7d5a147fa92. It is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability.
- Product
- Widoco
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSCVE-2016-15005 · Other software · github.com/dinever/golf · reported by security@golang.orgHigh 8.8
CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests.
- Product
- github.com/dinever/golf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability classified as critical has been found in Modern Tribe Panel Builder Plugin.CVE-2020-36626 · Other software · Modern Tribe · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in Modern Tribe Panel Builder Plugin. Affected is the function add_post_content_filtered_to_search_sql of the file ModularContent/SearchFilter.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 4528d4f855dbbf24e9fc12a162fda84ce3bedc2f. It is recommended to apply a patch to fix this issue. VDB-216738 is the identifier assigned to this vulnerability.
- Product
- Panel Builder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2022A vulnerability was found in Brave UX for-the-badge and classified as critical.CVE-2021-4281 · Other software · Brave UX · reported by VulDBMedium 4.6
A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the file .github/workflows/combine-prs.yml. The manipulation leads to os command injection. The name of the patch is 55b5a234c0fab935df5fb08365bc8fe9c37cf46b. It is recommended to apply a patch to fix this issue. VDB-216842 is the identifier assigned to this vulnerability.
- Product
- for-the-badge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2022A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1.CVE-2022-4742 · Other software · Json-pointer Project · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. Upgrading to version 0.6.2 is able to address this issue. The patch is identified as 859c9984b6c407fc2d5a0a7e47c7274daa681941. It is recommended to upgrade the affected component. VDB-216794 is the identifier assigned to this vulnerability.
- Product
- Json-pointer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2022fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious firmware, and brick CVE-2021-35954 · Other software · Fastrack · reported by MITREHigh 8.1
fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious firmware, and brick the device via the Serial Wire Debug (SWD) feature.
- Product
- Reflex 2.0 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0.CVE-2020-36632 · Other software · hughsk · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to initiate the attack remotely. Upgrading to version 5.0.1 is able to address this issue. The name of the patch is 20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is recommended to upgrade the affected component. The identifier VDB-216777 was assigned to this vulnerability.
- Product
- flat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022A vulnerability classified as critical was found in SimbCo httpster.CVE-2020-36629 · Other software · SimbCo · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in SimbCo httpster. This vulnerability affects the function fs.realpathSync of the file src/server.coffee. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. The name of the patch is d3055b3e30b40b65d30c5a06d6e053dffa7f35d0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216748.
- Product
- httpster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022A vulnerability classified as critical has been found in Calsign APDE.CVE-2020-36628 · Other software · Calsign · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in Calsign APDE. This affects the function handleExtract of the file APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java of the component ZIP File Handler. The manipulation leads to path traversal. Upgrading to version 0.5.2-pre2-alpha is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216747.
- Product
- APDE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2022IBM Security Verify Governance, Identity Manager 10.01 could allow a remote attacker to obtain sensitive information when a detailed technical error message is CVE-2022-22449 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Security Verify Governance, Identity Manager 10.01 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 224915.
- Product
- Security Verify Governance, Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 21, 2022A vulnerability, which was classified as critical, has been found in sslh.CVE-2022-4639 · Other software · unspecified · reported by VulDBMedium 5.6
A vulnerability, which was classified as critical, has been found in sslh. This issue affects the function hexdump of the file probe.c of the component Packet Dumping Handler. The manipulation of the argument msg_info leads to format string. The attack may be initiated remotely. The name of the patch is b19f8a6046b080e4c2e28354a58556bb26040c6f. It is recommended to apply a patch to fix this issue. The identifier VDB-216497 was assigned to this vulnerability.
- Product
- sslh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2022 IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical informatioCVE-2022-43872 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical information (e.g. event log entries) about the FTM SWIFT system. IBM X-Force ID: 239708.
- Product
- Financial Transaction Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 19, 2022A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical.CVE-2022-4613 · Other software · Click Studios · reported by VulDBMedium 5
A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical. This issue affects some unknown processing of the component Browser Extension Provisioning. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216275.
- Product
- Passwordstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability classified as critical was found in laravel-jqgrid.CVE-2021-4262 · Other software · unspecified · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in laravel-jqgrid. Affected by this vulnerability is the function getRows of the file src/Mgallegos/LaravelJqgrid/Repositories/EloquentRepositoryAbstract.php. The manipulation leads to sql injection. The name of the patch is fbc2d94f43d0dc772767a5bdb2681133036f935e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216271.
- Product
- laravel-jqgrid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability classified as critical has been found in pacman-canvas up to 1.0.5.CVE-2021-4261 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in pacman-canvas up to 1.0.5. Affected is the function addHighscore of the file data/db-handler.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 1.0.6 is able to address this issue. The name of the patch is 29522c90ca1cebfce6453a5af5a45281d99b0646. It is recommended to upgrade the affected component. VDB-216270 is the identifier assigned to this vulnerability.
- Product
- pacman-canvas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability classified as critical has been found in Furqan node-whois.CVE-2020-36618 · Other software · Furqan · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to launch the attack remotely. The name of the patch is 46ccc2aee8d063c7b6b4dee2c2834113b7286076. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216252.
- Product
- node-whois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome.CVE-2022-3875 · Other software · Click Studios · reported by VulDBHigh 7.3
A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown code of the component API. The manipulation leads to authentication bypass by assumed-immutable data. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216244.
- Product
- Passwordstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allows a physically proxiCVE-2022-47549 · Other software · Trustedfirmware · reported by MITREMedium 6.4
An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections.
- Product
- Op-tee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compeople.linaro.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.