Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
72 results · page 1 of 2
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).CVE-2026-91294 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).CVE-2026-91293 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.4
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 5.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).CVE-2026-91291 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 3.6
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 3.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).CVE-2026-87381 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.4
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usaCVE-2026-112285 · Other software · Thelia · reported by VulnCheckMedium 5.3
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to inflate max_usage, gaining unlimited discounts.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate froCVE-2026-102107 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 4.6
Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another user, because the server did not verify that the requester was authorized to act as the specified account. This could be used to solicit files or information from a recipient under a trusted identity; exploitation requires the feature to be enabled for the attacker's profile and the targeted recipient to act on the request.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 13, 2026CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.CVE-2026-29810 · Other software · CyberPanel · reported by MITREMedium 4.3
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.
- Product
- CyberPanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints.CVE-2026-84807 · Other software · kimai · reported by VulnCheckMedium 5.3
Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team; because the endpoints POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team reuse an existing team of the same name and add the current user as teamlead without verifying that the user is authorized to manage that team, the attacker gains unauthorized team-lead (administration) rights over the existing team. Fixed in 2.65.0.
- Product
- kimai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 1, 2026A business logic vulnerability exists in the API of HPE Networking Fabric Composer.CVE-2026-73708 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.3
A business logic vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to obtain elevated privileges and modify settings beyond what is authorized by the user's existing privilege level on a vulnerable system.
- Product
- Fabric Composer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sendiCVE-2026-78618 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Medium 6.9
A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request.
- Product
- Dimension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all CVE-2026-80195 · Other software · kimai · reported by VulnCheckHigh 8.7
Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead (or other user) with permission to edit a team can submit a malformed members payload; although Kimai returns a validation error, the existing membership rows have already been deleted. This bypasses the dedicated member-removal endpoint's protection against removing teamleaders and can leave a team with no members or teamleaders, disrupting team-based access control.
- Product
- kimai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 18, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).CVE-2026-61268 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FCVE-2026-12703 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 8
TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an affected macOS host.
- Product
- Remote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint CVE-2026-63242 · Other software · Three Learning · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Medium 4.3
A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records.
- Product
- Koollab LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirecCVE-2024-23564 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.1
HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response. The application includes checks in the initial requests to verify the validity of the provided UserId, but similar validation is not applied to Email requests when sending passwords to user emails.
- Product
- Aftermarket EPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jun 17, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infrastructure Security).CVE-2026-46903 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended and abnormal ways, deviating from the dCVE-2026-44410 · Other software · ZTE · reported by psirt@zte.com.cnLow 3.8
This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended and abnormal ways, deviating from the designer's expectations, to carry out malicious attacks.
- Product
- ZXUniPOS NDS-LTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a Bypass Business Logic vulnerability in the access management control panel.CVE-2026-1274 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.9
IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a Bypass Business Logic vulnerability in the access management control panel.
- Product
- Guardium Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’sCVE-2024-13974 · Network & remote access · Sophos · reported by security-alert@sophos.comHigh 8.1
A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution.
- Product
- Sophos Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services.CVE-2024-7096 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Medium 4.2
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment. Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.
- Product
- WSO2 Open Banking IAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
May 23, 2025A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an attaCVE-2024-9163 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.5
A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an attacker can cause a branch name confusion in confidential MRs.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhackerone.com
May 22, 2025An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service.CVE-2024-6914 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Critical 9.8
An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account takeover, including accounts with elevated privileges. This vulnerability is exploitable only through the account recovery SOAP admin services exposed via the "/services" context path in affected products. The impact may be reduced if access to these endpoints has been restricted based on the "Security Guidelines for Production Deployment" by disabling exposure to untrusted networks.
- Product
- WSO2 API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.comsecurity.docs.wso2.com
Feb 25, 2025Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access.CVE-2024-45424 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 5.3
Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Business Logic Error vulnerability that could resultCVE-2025-24425 · Websites & servers · Adobe · reported by AdobeMedium 5.3
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Business Logic Error vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to circumvent intended security mechanisms by manipulating the logic of the application's operations causing limited data modification. Exploitation of this issue does not require user interaction.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).CVE-2024-21245 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.4
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.CVE-2024-46505 · Other software · reported by MITRECritical 9.1
Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjayaramyalla.medium.com
Sep 16, 2024A Business Logic vulnerability in Shopkit 1.0 allows an attacker to add products with negative quantities to the shopping cart via the qtd parameter in the add-CVE-2023-45854 · Other software · shopkit_project · reported by MITREHigh 7.5
A Business Logic vulnerability in Shopkit 1.0 allows an attacker to add products with negative quantities to the shopping cart via the qtd parameter in the add-to-cart function.
- Product
- shopkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.CVE-2024-24699 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 6.5
Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.
- Product
- Zoom Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.CVE-2023-6832 · Other software · microweber · reported by security@huntr.devMedium 4.3
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2023Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.CVE-2023-6566 · Other software · microweber · reported by security@huntr.devMedium 6.5
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects.CVE-2023-3914 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.4
A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects. A service account is not deleted when a namespace is deleted, allowing access to internal projects.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhackerone.com
Sep 6, 2023SearchBlox before Version 9.1 is vulnerable to business logic bypass where the user is able to create multiple super admin users in the system.CVE-2020-10130 · Other software · SearchBlox · reported by cret@cert.orgHigh 8.8
SearchBlox before Version 9.1 is vulnerable to business logic bypass where the user is able to create multiple super admin users in the system.
- Product
- SearchBlox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.searchblox.comdeveloper.searchblox.com
Aug 10, 2023Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.CVE-2023-4304 · Other software · froxlor · reported by security@huntr.devLow 3.8
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2023Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could CVE-2023-29294 · Websites & servers · Adobe · reported by AdobeMedium 4.3
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.
- Product
- Magento Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jun 14, 2023Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.CVE-2023-3229 · Other software · fossbilling · reported by security@huntr.devMedium 6.5
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.
- Product
- fossbilling/fossbilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.CVE-2023-3228 · Other software · fossbilling · reported by security@huntr.devMedium 5.7
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.
- Product
- fossbilling/fossbilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1887 · Other software · thorsten · reported by security@huntr.devMedium 4.3
Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1542 · Other software · answerdev · reported by security@huntr.devMedium 5.4
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1541 · Other software · answerdev · reported by security@huntr.devLow 3.8
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2023Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.CVE-2023-0565 · Other software · froxlor · reported by security@huntr.devMedium 5.5
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.CVE-2022-4719 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.CVE-2022-3363 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2022A business logic issue in the handling of large repositories in all versions of GitLab CE/EE from 10.0 before 15.1.6, all versions starting from 15.2 before 15.CVE-2022-2455 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
A business logic issue in the handling of large repositories in all versions of GitLab CE/EE from 10.0 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2 allowed an authenticated and authorized user to exhaust server resources by importing a malicious project.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.CVE-2022-1848 · Other software · erudika · reported by security@huntr.devMedium 5.3
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.
- Product
- erudika/para
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022A business logic vulnerability exists in Mi App Store.CVE-2020-14121 · Other software · MI · reported by security@xiaomi.comMedium 5.5
A business logic vulnerability exists in Mi App Store. The vulnerability is caused by incomplete permission checks of the products being bypassed, and an attacker can exploit the vulnerability to perform a local silent installation.
- Product
- MI App Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Apr 19, 2022Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).CVE-2022-21464 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). The supported version that is affected is Prior to 9.2.6.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools and unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 under certain conditions CVE-2022-1111 · Websites & servers · GitLab · reported by cve@gitlab.comLow 2.4
A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 under certain conditions caused imported projects to show an incorrect user in the 'Access Granted' column in the project membership pages
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.CVE-2022-0514 · Other software · crater-invoice · reported by security@huntr.devMedium 6.5
Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2022Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.CVE-2022-0746 · Other software · dolibarr · reported by security@huntr.devMedium 4.3
Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.
- Product
- dolibarr/dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2022Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0688 · Other software · microweber · reported by security@huntr.devMedium 4.9
Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.