Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
Jun 7, 2023Marval MSM through 14.19.0.12476 and 15.0 has a Remote Code Execution vulnerability.CVE-2023-33284 · Other software · Marvalglobal · reported by MITREHigh 8.8
Marval MSM through 14.19.0.12476 and 15.0 has a Remote Code Execution vulnerability. A remote attacker authenticated as any user is able to execute code in context of the web server.
- Product
- MSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberskydd.secyberskydd.se
Jun 7, 2023Marval MSM through 14.19.0.12476 uses a static encryption key for secrets.CVE-2023-33283 · Other software · Marvalglobal · reported by MITREMedium 5.5
Marval MSM through 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt them by using this key.
- Product
- MSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberskydd.secyberskydd.se
Jun 7, 2023Marval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials.CVE-2023-33282 · Other software · Marvalglobal · reported by MITRECritical 9.8
Marval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials. A remote attacker is able to login and create a valid session. This makes it possible to make backend calls to endpoints in the application.
- Product
- MSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarvalglobal.comcyberskydd.se
Jun 28, 2022Marval MSM v14.19.0.12476 has a 0-Click Account Takeover vulnerability which allows an attacker to change any user's password in the organization, this means thCVE-2022-31887 · Other software · Marvalglobal · reported by MITRECritical 9.8
Marval MSM v14.19.0.12476 has a 0-Click Account Takeover vulnerability which allows an attacker to change any user's password in the organization, this means that the user can also escalate achieve Privilege Escalation by changing the administrator password.
- Product
- Marval MSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyber-guy.gitbook.iodrive.google.com
Jun 28, 2022Marval MSM v14.19.0.12476 has an Improper Access Control vulnerability which allows a low privilege user to delete other users API Keys including high privilegeCVE-2022-31884 · Other software · Marvalglobal · reported by MITREMedium 6.5
Marval MSM v14.19.0.12476 has an Improper Access Control vulnerability which allows a low privilege user to delete other users API Keys including high privilege and the Administrator users API Keys.
- Product
- Marval MSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyber-guy.gitbook.iodrive.google.com
Jun 28, 2022Marval MSM v14.19.0.12476 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2022-31886 · Other software · Marvalglobal · reported by MITREMedium 6.5
Marval MSM v14.19.0.12476 is vulnerable to Cross Site Request Forgery (CSRF). An attacker can disable the 2FA by sending the user a malicious form.
- Product
- Marval MSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyber-guy.gitbook.iodrive.google.com
Jun 28, 2022Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts.CVE-2022-31885 · Other software · Marvalglobal · reported by MITRECritical 9.8
Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts.
- Product
- Marval MSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyber-guy.gitbook.iodrive.google.com
Jun 28, 2022Marval MSM v14.19.0.12476 is has an Insecure Direct Object Reference (IDOR) vulnerability.CVE-2022-31883 · Other software · Marvalglobal · reported by MITREHigh 8.8
Marval MSM v14.19.0.12476 is has an Insecure Direct Object Reference (IDOR) vulnerability. A low privilege user is able to see other users API Keys including the Admins API Keys.
- Product
- Marval MSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyber-guy.gitbook.iodrive.google.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.