Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6 results
Nov 21, 2022Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB.CVE-2022-4111 · Other software · tooljet · reported by security@huntr.devMedium 6.5
Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB.
- Product
- tooljet/tooljet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022Account Takeover :: when see the info i can see the hash pass i can creaked it ...............CVE-2022-3422 · Other software · tooljet · reported by security@huntr.devHigh 7.5
Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_password_token the hacker can send the request and changed the pass
- Product
- tooljet/tooljet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022Just like in the previous report, an attacker could steal the account of different users.CVE-2022-3348 · Other software · tooljet · reported by security@huntr.devMedium 4.9
Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.
- Product
- tooljet/tooljet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's migCVE-2022-3019 · Other software · tooljet · reported by security@huntr.devHigh 8.8
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one).
- Product
- tooljet/tooljet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2022Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0.CVE-2022-2631 · Other software · tooljet · reported by security@huntr.devHigh 8.8
Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0.
- Product
- tooljet/tooljet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0.CVE-2022-2037 · Other software · tooljet · reported by security@huntr.devHigh 8
Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0.
- Product
- tooljet/tooljet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.