Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,841 results · page 92 of 137
Nov 13, 2022A vulnerability classified as critical has been found in Pingkon HMS-PHP.CVE-2022-3973 · Other software · Pingkon · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Pingkon HMS-PHP. Affected is an unknown function of the file /admin/admin.php of the component Data Pump Metadata. The manipulation of the argument uname/pass leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213552.
- Product
- HMS-PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability, which was classified as critical, was found in Vesta Control Panel.CVE-2022-3967 · Other software · unspecified · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of the file func/main.sh of the component sed Handler. The manipulation leads to argument injection. An attack has to be approached locally. The name of the patch is 39561c32c12cabe563de48cc96eccb9e2c655e25. It is recommended to apply a patch to fix this issue. VDB-213546 is the identifier assigned to this vulnerability.
- Product
- Vesta Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0.CVE-2022-3966 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0. This issue affects the function load_template of the file includes/core/class-shortcodes.php of the component Template Handler. The manipulation of the argument tpl leads to pathname traversal. The attack may be initiated remotely. Upgrading to version 2.5.1 is able to address this issue. The name of the patch is e1bc94c1100f02a129721ba4be5fbc44c3d78ec4. It is recommended to upgrade the affected component. The identifier VDB-213545 was assigned to this vulnerability.
- Product
- Ultimate Member Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022A vulnerability classified as critical has been found in tsruban HHIMS 2.1.CVE-2022-3956 · Other software · tsruban · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in tsruban HHIMS 2.1. Affected is an unknown function of the component Patient Portrait Handler. The manipulation of the argument PID leads to sql injection. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. VDB-213462 is the identifier assigned to this vulnerability.
- Product
- HHIMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022A vulnerability classified as critical was found in eolinker goku_lite.CVE-2022-3948 · Other software · eolinker · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in eolinker goku_lite. This vulnerability affects unknown code of the file /plugin/getList. The manipulation of the argument route/keyword leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-213454 is the identifier assigned to this vulnerability.
- Product
- goku_lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordc2.im5i.comc2.im5i.com
Nov 11, 2022A vulnerability classified as critical has been found in eolinker goku_lite.CVE-2022-3947 · Other software · eolinker · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in eolinker goku_lite. This affects an unknown part of the file /balance/service/list. The manipulation of the argument route/keyword leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213453 was assigned to this vulnerability.
- Product
- goku_lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordc2.im5i.comc2.im5i.com
Nov 11, 2022A vulnerability has been found in Activity Log Plugin and classified as critical.CVE-2022-3941 · Other software · unspecified · reported by VulDBMedium 5.3
A vulnerability has been found in Activity Log Plugin and classified as critical. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutralization for logs. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213448.
- Product
- Activity Log Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Nov 11, 2022A vulnerability, which was classified as critical, has been found in lanyulei ferry.CVE-2022-3939 · Other software · lanyulei · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in lanyulei ferry. Affected by this issue is some unknown functionality of the file apis/public/file.go of the component API. The manipulation of the argument file leads to path traversal. The attack may be launched remotely. VDB-213446 is the identifier assigned to this vulnerability.
- Product
- ferry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022The kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released.CVE-2022-44546 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released. Successful exploitation of this vulnerability may cause a system restart.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Nov 8, 2022In _PMRLogicalOffsetToPhysicalOffset of the PowerVR kernel driver, there is a possible out of bounds write due to a missing bounds check.CVE-2021-39661 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In _PMRLogicalOffsetToPhysicalOffset of the PowerVR kernel driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-246824784
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Nov 7, 2022A vulnerability classified as critical has been found in Maxon ERP.CVE-2022-3878 · Other software · Maxon · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Maxon ERP. This affects an unknown part of the file /index.php/purchase_order/browse_data. The manipulation of the argument tb_search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-213039.
- Product
- ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2022Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse.CVE-2022-3258 · Other software · HYPR · reported by security@hypr.comLow 3.7
Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse.
- Product
- Workforce Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2022A vulnerability was found in Huaxia ERP 2.3 and classified as critical.CVE-2022-3825 · Other software · Huaxia · reported by VulDBMedium 6.3
A vulnerability was found in Huaxia ERP 2.3 and classified as critical. Affected by this issue is some unknown functionality of the component User Management. The manipulation of the argument login leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212792.
- Product
- ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2022A missing authentication for a critical function vulnerability in Fortinet FortiSOAR 6.4.0 - 6.4.4 and 7.0.0 - 7.0.3 and 7.2.0 allows an attacker to disclose inCVE-2022-42473 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.3
A missing authentication for a critical function vulnerability in Fortinet FortiSOAR 6.4.0 - 6.4.4 and 7.0.0 - 7.0.3 and 7.2.0 allows an attacker to disclose information via logging into the database using a privileged account without a password.
- Product
- Fortinet FortiSOAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Nov 1, 2022A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking.CVE-2022-3786 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgHigh 7.5
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.openssl.orgopenssl.org
Nov 1, 2022A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking.CVE-2022-3602 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgHigh 7.5
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authenticat
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Nov 1, 2022A vulnerability has been found in IBAX go-ibax and classified as critical.CVE-2022-3802 · Other software · IBAX · reported by VulDBMedium 6.3
A vulnerability has been found in IBAX go-ibax and classified as critical. This vulnerability affects unknown code of the file /api/v2/open/rowsInfo. The manipulation of the argument where leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212638 is the identifier assigned to this vulnerability.
- Product
- go-ibax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022A vulnerability, which was classified as critical, was found in IBAX go-ibax.CVE-2022-3801 · Other software · IBAX · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in IBAX go-ibax. This affects an unknown part of the file /api/v2/open/rowsInfo. The manipulation of the argument order leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212637 was assigned to this vulnerability.
- Product
- go-ibax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022A vulnerability, which was classified as critical, has been found in IBAX go-ibax.CVE-2022-3800 · Other software · IBAX · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in IBAX go-ibax. Affected by this issue is some unknown functionality of the file /api/v2/open/rowsInfo. The manipulation of the argument table_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212636.
- Product
- go-ibax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022A vulnerability classified as critical was found in IBAX go-ibax.CVE-2022-3799 · Other software · IBAX · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in IBAX go-ibax. Affected by this vulnerability is an unknown functionality of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212635.
- Product
- go-ibax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022A vulnerability classified as critical has been found in IBAX go-ibax.CVE-2022-3798 · Other software · IBAX · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in IBAX go-ibax. Affected is an unknown function of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212634 is the identifier assigned to this vulnerability.
- Product
- go-ibax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022A vulnerability has been found in Tim Campus Confession Wall and classified as critical.CVE-2022-3789 · Other software · Tim Campus · reported by VulDBMedium 5.5
A vulnerability has been found in Tim Campus Confession Wall and classified as critical. Affected by this vulnerability is an unknown functionality of the file share.php. The manipulation of the argument post_id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212611.
- Product
- Confession Wall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022A vulnerability, which was classified as critical, has been found in Axiomatic Bento4.CVE-2022-3785 · Other software · Axiomatic · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. Affected by this issue is the function AP4_DataBuffer::SetDataSize of the component Avcinfo. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212564.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022A vulnerability classified as critical was found in Axiomatic Bento4 5e7bb34.CVE-2022-3784 · Other software · Axiomatic · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Axiomatic Bento4 5e7bb34. Affected by this vulnerability is the function AP4_Mp4AudioDsiParser::ReadBits of the file Ap4Mp4AudioInfo.cpp of the component mp4hls. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212563.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a scenario where unauthorized disclosure of aCVE-2022-3499 · Other software · Tenable · reported by vulnreport@tenable.comMedium 6.5
An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a scenario where unauthorized disclosure of agent logs and data is present.
- Product
- Nessus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Oct 31, 2022A vulnerability, which was classified as critical, has been found in easyii CMS.CVE-2022-3771 · Other software · easyii · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in easyii CMS. This issue affects the function file of the file helpers/Upload.php of the component File Upload Management. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The identifier VDB-212501 was assigned to this vulnerability.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022A vulnerability classified as critical was found in Yunjing CMS.CVE-2022-3770 · Other software · Yunjing · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Yunjing CMS. This vulnerability affects unknown code of the file /index/user/upload_img.html. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212500.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022A vulnerability was found in seccome Ehoney and classified as critical.CVE-2022-3732 · Other software · seccome · reported by VulDBMedium 6.3
A vulnerability was found in seccome Ehoney and classified as critical. Affected by this issue is some unknown functionality of the file /api/v1/bait/set. The manipulation of the argument Payload leads to sql injection. The attack may be launched remotely. VDB-212414 is the identifier assigned to this vulnerability.
- Product
- Ehoney
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022A vulnerability has been found in seccome Ehoney and classified as critical.CVE-2022-3731 · Other software · seccome · reported by VulDBMedium 6.3
A vulnerability has been found in seccome Ehoney and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/v1/attack/token. The manipulation of the argument Payload leads to sql injection. The attack can be launched remotely. The identifier VDB-212413 was assigned to this vulnerability.
- Product
- Ehoney
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022A vulnerability, which was classified as critical, was found in seccome Ehoney.CVE-2022-3730 · Other software · seccome · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in seccome Ehoney. Affected is an unknown function of the file /api/v1/attack/falco. The manipulation of the argument Payload leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-212412.
- Product
- Ehoney
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022A vulnerability, which was classified as critical, has been found in seccome Ehoney.CVE-2022-3729 · Other software · seccome · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in seccome Ehoney. This issue affects some unknown processing of the file /api/v1/attack. The manipulation of the argument AttackIP leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-212411.
- Product
- Ehoney
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2022 The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encryption for its data-over-sound protocolsCVE-2022-41627 · Other software · AliveCor · reported by ics-cert@hq.dhs.govMedium 4.8
The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encryption for its data-over-sound protocols. Exploiting this vulnerability could allow an attacker to read patient EKG results or create a denial-of-service condition by emitting sounds at similar frequencies as the device, disrupting the smartphone microphone’s ability to accurately read the data. To carry out this attack, the attacker must be close (less than 5 feet) to pick up and emit sound waves.
- Product
- KardiaMobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022A vulnerability, which was classified as critical, was found in Axiomatic Bento4.CVE-2022-3667 · Other software · Axiomatic · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in Axiomatic Bento4. This affects the function AP4_MemoryByteStream::WritePartial of the file Ap4ByteStream.cpp of the component mp42aac. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212007.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022A vulnerability, which was classified as critical, has been found in Axiomatic Bento4.CVE-2022-3666 · Other software · Axiomatic · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. Affected by this issue is the function AP4_LinearReader::Advance of the file Ap4LinearReader.cpp of the component mp42ts. The manipulation leads to use after free. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212006 is the identifier assigned to this vulnerability.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022A vulnerability classified as critical was found in Axiomatic Bento4.CVE-2022-3665 · Other software · Axiomatic · reported by VulDBHigh 7.3
A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is an unknown functionality of the file AvcInfo.cpp of the component avcinfo. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212005 was assigned to this vulnerability.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022A vulnerability classified as critical has been found in Axiomatic Bento4.CVE-2022-3664 · Other software · Axiomatic · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Axiomatic Bento4. Affected is the function AP4_BitStream::WriteBytes of the file Ap4BitStream.cpp of the component avcinfo. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212004.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remotCVE-2022-27623 · Network & remote access · Synology · reported by security@synology.comHigh 7.4
Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote attackers to read or write arbitrary files via unspecified vectors.
- Product
- DiskStation Manager (DSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Oct 21, 2022A vulnerability, which was classified as critical, was found in Linux Kernel.CVE-2022-3640 · Computers, phones & browsers · Linux · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211944.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orglists.debian.org
Oct 21, 2022A vulnerability, which was classified as critical, has been found in Linux Kernel.CVE-2022-3635 · Computers, phones & browsers · Linux · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function tst_timer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. VDB-211934 is the identifier assigned to this vulnerability.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orglists.debian.org
Oct 19, 2022Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.CVE-2022-3327 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022Sensitive information could be displayed when a detailed technical error message is posted.CVE-2022-38107 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.3
Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details.
- Product
- SQL Sentry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.sentryone.comsolarwinds.com
Oct 19, 2022Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived arCVE-2022-43435 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
- Product
- Jenkins 360 FireLine Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 19, 2022Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in worksCVE-2022-43434 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
- Product
- Jenkins NeuVector Vulnerability Scanner Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 19, 2022Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived arCVE-2022-43433 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
- Product
- Jenkins ScreenRecorder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 19, 2022Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archivCVE-2022-43432 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
- Product
- Jenkins XFramium Builder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 19, 2022When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made available with the ability to directly queryCVE-2022-42467 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made available with the ability to directly query the database. It was felt that it is safer to require the developer to explicitly enable this capability. As of 2.0.0-M8, this can now be done using the 'isis.prototyping.h2-console.web-allow-remote-access' configuration property; the web console will be unavailable without setting this configuration. As an additional safeguard, the new 'isis.prototyping.h2-console.generate-random-web-admin-password' configuration parameter (enabled by default) requires that the administrator use a randomly generated password to use the console. The password is printed to the log, as "webAdminPass: xxx" (where "xxx") is the password. To revert to the original behaviour, the administrator would therefore need to set these configuration parameter: isis.prototyping.h2-console.web-allow-remote-access=true isis.prototyping.h2-console.generate-random-web-admin-password=false Note also that the h2 webconsole is never available in production mode, so these safeguards are only to ensure that the webconsole is secured by default also in prototype mod
- Product
- Apache Isis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Oct 18, 2022Missing AES encryption in Corsair K63 Wireless 3.1.3 allows physically proximate attackers to inject and sniff keystrokes via 2.4 GHz radio transmissions.CVE-2022-35860 · Other software · Corsair · reported by MITREMedium 6.8
Missing AES encryption in Corsair K63 Wireless 3.1.3 allows physically proximate attackers to inject and sniff keystrokes via 2.4 GHz radio transmissions.
- Product
- K63 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkth.diva-portal.orgkth.diva-portal.org
Oct 17, 2022A vulnerability, which was classified as critical, has been found in Linux Kernel.CVE-2022-3565 · Computers, phones & browsers · Linux · reported by VulDBMedium 4.6
A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211088.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orglists.debian.org
Oct 17, 2022A vulnerability classified as critical was found in Linux Kernel.CVE-2022-3564 · Computers, phones & browsers · Linux · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211087.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orglists.debian.org
Oct 17, 2022A vulnerability classified as critical was found in X.org Server.CVE-2022-3550 · Other software · X.org · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211051.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcgit.freedesktop.orglists.debian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.