Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
865 results · page 10 of 18
Aug 9, 2023There is a command injection problem in the old version of the mobile phone backup app.CVE-2023-26310 · Other software · OPPO · reported by security@oppo.comHigh 7.4
There is a command injection problem in the old version of the mobile phone backup app.
- Product
- OPPO Find X3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.oppo.comsecurity.oppo.com
Jul 24, 2023A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel.CVE-2023-3863 · Other software · Red Hat · reported by Red HatMedium 6.4
A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel. This flaw allows a local user with special privileges to impact a kernel information leak issue.
- Product
- Red Hat Enterprise Linux 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jul 22, 2023A vulnerability classified as problematic has been found in Bug Finder MineStack 1.0.CVE-2023-3835 · Other software · Bug Finder · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Bug Finder MineStack 1.0. This affects an unknown part of the file /user/ticket/create of the component Ticket Handler. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-235161 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MineStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability was found in Bug Finder EX-RATE 1.0.CVE-2023-3834 · Other software · Bug Finder · reported by VulDBLow 3.5
A vulnerability was found in Bug Finder EX-RATE 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /user/ticket/create of the component Ticket Handler. The manipulation of the argument message leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-235160. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EX-RATE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability was found in Bug Finder Montage 1.0.CVE-2023-3833 · Other software · Bug Finder · reported by VulDBLow 3.5
A vulnerability was found in Bug Finder Montage 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /user/ticket/create of the component Ticket Handler. The manipulation of the argument message leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235159. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Montage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability was found in Bug Finder Wedding Wonders 1.0.CVE-2023-3832 · Other software · Bug Finder · reported by VulDBLow 3.5
A vulnerability was found in Bug Finder Wedding Wonders 1.0. It has been classified as problematic. Affected is an unknown function of the file /user/ticket/create of the component Ticket Handler. The manipulation of the argument message leads to cross site scripting. It is possible to launch the attack remotely. VDB-235158 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Wedding Wonders
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability was found in Bug Finder Finounce 1.0 and classified as problematic.CVE-2023-3831 · Other software · Bug Finder · reported by VulDBLow 3.5
A vulnerability was found in Bug Finder Finounce 1.0 and classified as problematic. This issue affects some unknown processing of the file /user/ticket/create of the component Ticket Handler. The manipulation of the argument message leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-235157 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Finounce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability was found in Bug Finder SASS BILLER 1.0.CVE-2023-3830 · Other software · Bug Finder · reported by VulDBLow 3.5
A vulnerability was found in Bug Finder SASS BILLER 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /company/store. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-235151. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SASS BILLER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability was found in Bug Finder ICOGenie 1.0.CVE-2023-3829 · Other software · Bug Finder · reported by VulDBLow 3.5
A vulnerability was found in Bug Finder ICOGenie 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /user/ticket/create of the component Support Ticket Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated remotely. VDB-235150 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ICOGenie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability was found in Bug Finder Listplace Directory Listing Platform 3.0.CVE-2023-3828 · Other software · Bug Finder · reported by VulDBLow 3.5
A vulnerability was found in Bug Finder Listplace Directory Listing Platform 3.0. It has been classified as problematic. This affects an unknown part of the file /listplace/user/coverPhotoUpdate of the component Photo Handler. The manipulation of the argument user_cover_photo leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-235149 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Listplace Directory Listing Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability was found in Bug Finder Listplace Directory Listing Platform 3.0 and classified as problematic.CVE-2023-3827 · Other software · Bug Finder · reported by VulDBLow 3.5
A vulnerability was found in Bug Finder Listplace Directory Listing Platform 3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /listplace/user/ticket/create of the component HTTP POST Request Handler. The manipulation of the argument message leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-235148. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Listplace Directory Listing Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability, which was classified as problematic, has been found in Bug Finder Foody Friend 1.0.CVE-2023-3796 · Other software · Bug Finder · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Bug Finder Foody Friend 1.0. Affected by this issue is some unknown functionality of the file /user/profile of the component Profile Picture Handler. The manipulation of the argument profile_picture leads to unrestricted upload. The attack may be launched remotely. The identifier of this vulnerability is VDB-235064. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Foody Friend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability classified as critical was found in Bug Finder ChainCity Real Estate Investment Platform 1.0.CVE-2023-3795 · Other software · Bug Finder · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in Bug Finder ChainCity Real Estate Investment Platform 1.0. Affected by this vulnerability is an unknown functionality of the file /property of the component GET Parameter Handler. The manipulation of the argument name leads to sql injection. The associated identifier of this vulnerability is VDB-235063. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ChainCity Real Estate Investment Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability classified as problematic has been found in Bug Finder ChainCity Real Estate Investment Platform 1.0.CVE-2023-3794 · Other software · Bug Finder · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Bug Finder ChainCity Real Estate Investment Platform 1.0. Affected is an unknown function of the file /chaincity/user/ticket/create of the component New Ticket Handler. The manipulation of the argument subject leads to cross site scripting. It is possible to launch the attack remotely. VDB-235062 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ChainCity Real Estate Investment Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023A vulnerability was found in Super Store Finder 3.6.CVE-2023-3751 · Other software · Superstorefinder · reported by VulDBMedium 6.3
A vulnerability was found in Super Store Finder 3.6. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php of the component POST Parameter Handler. The manipulation of the argument products leads to sql injection. The attack can be launched remotely. The identifier VDB-234421 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Super Store Finder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023A use-after-free issue was discovered in Py_FindObjects() function in SciPy versions prior to 1.8.0.CVE-2023-29824 · Other software · scipy · reported by MITRECritical 9.8
A use-after-free issue was discovered in Py_FindObjects() function in SciPy versions prior to 1.8.0. NOTE: the vendor and discoverer indicate that this is not a security issue.
- Product
- scipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsquare16.orggithub.com
Jul 5, 2023A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function.CVE-2023-25399 · Other software · scipy · reported by MITREMedium 5.5
A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. Note: This is disputed as a bug and not a vulnerability. SciPy is not designed to be exposed to untrusted users or data directly.
- Product
- scipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsquare16.orggithub.com
Jun 30, 2023pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL (which may be CVE-2023-37360 · Other software · Pacparser Project · reported by MITREMedium 5.9
pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL (which may be realistic within enterprise security products).
- Product
- Pacparser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2023_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.CVE-2023-35840 · Other software · Std42 · reported by MITREMedium 6.5
_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.
- Product
- Elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function.CVE-2023-28705 · Other software · Openfind · reported by twcert@cert.org.twMedium 5.4
Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function. A remote attacker can exploit this vulnerability using phishing emails that contain malicious web pages injected with JavaScript. When users access the system and open the email, it triggers an XSS (Reflected Cross-site scripting) attack.
- Product
- Mail2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 11, 2023Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find().CVE-2023-30192 · Websites & servers · Prestashop · reported by MITRECritical 9.8
Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find().
- Product
- Possearchproducts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iothemeforest.net
May 10, 2023podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfDictionary::findKeyParent.CVE-2023-31556 · Other software · Podofo Project · reported by MITREMedium 6.5
podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfDictionary::findKeyParent.
- Product
- Podofo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Uncontrolled search path in some Intel(R) Pathfinder for RISC-V software may allow an authenticated user to potentially enable escalation of privilege via localCVE-2023-27386 · Other software · Intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path in some Intel(R) Pathfinder for RISC-V software may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Pathfinder For Risc-v
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpers.c.CVE-2023-30406 · Other software · Jerryscript · reported by MITREMedium 5.5
Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpers.c.
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2023Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_lvlhsh_find at src/njs_lvlhsh.c.CVE-2023-27730 · Network & remote access · F5 · reported by MITREHigh 7.5
Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_lvlhsh_find at src/njs_lvlhsh.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Openfind Mail2000 file uploading function has insufficient filtering for user input.CVE-2023-22902 · Other software · Openfind · reported by twcert@cert.org.twMedium 5.4
Openfind Mail2000 file uploading function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can exploit this vulnerability to inject JavaScript, conducting an XSS attack.
- Product
- Mail2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Mar 9, 2023All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation.CVE-2023-26110 · Other software · Node-bluetooth Project · reported by report@snyk.ioHigh 7.3
All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation.
- Product
- Node-bluetooth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.snyk.iosecurity.snyk.io
Mar 9, 2023All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length CVE-2023-26109 · Other software · Node-bluetooth-serial-port Project · reported by report@snyk.ioHigh 7.3
All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation.
- Product
- Node-bluetooth-serial-port
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.snyk.iosecurity.snyk.io
Mar 1, 2023In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value.CVE-2023-23000 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in the error case, but an error pointer is used.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn.kernel.orggithub.com
Feb 28, 2023In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with put_device.CVE-2023-22996 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with put_device.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn.kernel.orggithub.com
Feb 26, 2023In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.CVE-2023-26607 · Other software · Siemens · reported by MITREHigh 7.1
In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
- Product
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgit.kernel.org
Feb 15, 2023Stack overflow vulnerability in function Dict::find in xpdf/Dict.cc in xpdf 4.04, allows local attackers to cause a denial of service.CVE-2022-45586 · Other software · Xpdfreader · reported by MITREMedium 5.5
Stack overflow vulnerability in function Dict::find in xpdf/Dict.cc in xpdf 4.04, allows local attackers to cause a denial of service.
- Product
- Xpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.xpdfreader.comforum.xpdfreader.com
Jan 31, 2023Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add().CVE-2022-31902 · Other software · Notepad-plus-plus · reported by MITREMedium 5.5
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add().
- Product
- Notepad++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability classified as critical was found in AenBleidd FiND.CVE-2015-10065 · Other software · AenBleidd · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in AenBleidd FiND. This vulnerability affects the function init_result of the file validator/my_validator.cpp. The manipulation leads to buffer overflow. The patch is identified as ee2eef34a83644f286c9adcaf30437f92e9c48f1. It is recommended to apply a patch to fix this issue. VDB-218458 is the identifier assigned to this vulnerability.
- Product
- FiND
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source code for Default.aspx in some situations) anCVE-2022-45895 · Other software · Planetestream · reported by MITREMedium 6.5
Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source code for Default.aspx in some situations) and the WhoAmI endpoint (e.g., path disclosure).
- Product
- Planet Estream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec-consult.comsec-consult.com
Dec 16, 2022In findParam of HevcUtils.cpp there is a possible out of bounds read due to a missing bounds check.CVE-2022-20528 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In findParam of HevcUtils.cpp there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-230172711
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 16, 2022In sdpu_find_most_specific_service_uuid of sdp_utils.cc, there is a possible way to crash Bluetooth due to a missing null check.CVE-2022-20521 · Computers, phones & browsers · Google · reported by security@android.comMedium 5
In sdpu_find_most_specific_service_uuid of sdp_utils.cc, there is a possible way to crash Bluetooth due to a missing null check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-227203684
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022In findAllDeAccounts of AccountsDb.java, there is a possible denial of service due to resource exhaustion.CVE-2021-0934 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In findAllDeAccounts of AccountsDb.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-169762606
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Nov 28, 2022Find and Replace All: Does not have CSRF checkCVE-2022-3850 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack
- Product
- Find and Replace All
- Fixed in
- 1.3
- What to do
- Update Find and Replace All to 1.3 or newer.
Nov 28, 2022Find and Replace All: Does not sanitize and escape some parameters from its setting page before outputting them back to the userCVE-2022-2311 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue.
- Product
- Find and Replace All
- Fixed in
- 1.3
- What to do
- Update Find and Replace All to 1.3 or newer.
Nov 3, 2022Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackers to bypass the loCVE-2022-38168 · Other software · Avaya · reported by MITRECritical 9.1
Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackers to bypass the login page, access sensitive information, and reset user passwords via URL modification.
- Product
- Scopia Pathfinder 10 PTS Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc.CVE-2022-29475 · Other software · abode systems, inc. · reported by talos-cna@cisco.comHigh 8.1
An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
- Product
- iota All-In-One Security Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 9, 2022Exposure of Sensitive Information in Find My Mobile prior to version 7.2.25.14 allows local attacker to access IMEI via log.CVE-2022-36878 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Exposure of Sensitive Information in Find My Mobile prior to version 7.2.25.14 allows local attacker to access IMEI via log.
- Product
- Find My Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jul 12, 2022Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device.CVE-2022-33707 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device.
- Product
- FindMyMobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jul 12, 2022Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to access some protected information with privilege of CVE-2022-30758 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to access some protected information with privilege of Finder.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jul 12, 2022Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to launch certain activities with privilege of Finder.CVE-2022-30756 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 8.5
Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to launch certain activities with privilege of Finder.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jul 4, 2022The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object.CVE-2022-33171 · Other software · Typeorm · reported by MITRECritical 9.8
The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation
- Product
- Typeorm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 20, 2022Better Find and Replace: Does not properly sanitiseCVE-2022-1472 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection
- Product
- Better Find and Replace
- Fixed in
- 1.3.6
- What to do
- Update Better Find and Replace to 1.3.6 or newer.
Jun 15, 2022In param_find_digests_internal and related functions of the Titan-M source, there is a possible out of bounds write due to an incorrect bounds check.CVE-2022-20233 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In param_find_digests_internal and related functions of the Titan-M source, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-222472803References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 13, 2022WPMK Ajax Finder: Cross-Site Request ForgeryCVE-2022-1749 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting_page() function found in the ~/inc/config/create-plugin-config.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.
- Product
- WPMK Ajax Finder
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WPMK Ajax Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.