Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,289 results · page 109 of 306
Dec 13, 2023An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the fileupload function,CVE-2023-6721 · Other software · Repox · reported by cve-coordination@incibe.esHigh 8.3
An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the fileupload function, resulting in interaction between the attacker and the server's file system.
- Product
- Repox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023An XSS vulnerability has been detected in Repox, which allows an attacker to compromise interactions between a user and the vulnerable application, and can be eCVE-2023-6719 · Other software · Repox · reported by cve-coordination@incibe.esMedium 6.3
An XSS vulnerability has been detected in Repox, which allows an attacker to compromise interactions between a user and the vulnerable application, and can be exploited by a third party by sending a specially crafted JavaScript payload to a user, and thus gain full control of their session.
- Product
- Repox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL datCVE-2023-50263 · Other software · nautobot · reported by GitHubLow 3.7
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs `/files/get/?name=...` and `/files/download/?name=...` are used to provide admin access to files that have been uploaded as part of a run request for a Job that has FileVar inputs. Under normal operation these files are ephemeral and are deleted once the Job in question runs. In the default implementation used in Nautobot, as provided by `django-db-file-storage`, these URLs do not by default require any user authentication to access; they should instead be restricted to only users who have permissions to view Nautobot's `FileProxy` model instances. Note that no URL mechanism is provided for listing or traversal of the available file `name` values, so in practice an unauthenticated user would have to guess names to discover arbitrary files for download, but if a user knows the file name/path value, they can access it without authenticating, so we are considering this a vulnerability. Fixes are included in Nautobot 1.6.7 and Nautobot 2.0.6. No known workar
- Product
- nautobot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023A flaw was found in Undertow.CVE-2023-5379 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS).
- Product
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Dec 12, 2023Windows DPAPI (Data Protection Application Programming Interface) Spoofing VulnerabilityCVE-2023-36004 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 12, 2023The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application accCVE-2015-8314 · Other software · Heartcombo · reported by MITREHigh 7.5
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
- Product
- Devise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023 Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to exeCVE-2023-6593 · Other software · Devolutions · reported by security@devolutions.netCritical 9.8
Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to execute entries in a SQL data source without restriction.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Dec 12, 2023SAS application is vulnerable to Reflected Cross-Site Scripting (XSS).CVE-2023-4932 · Other software · SAS Institute · reported by cvd@cert.plMedium 6.3
SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SASStoredProcess/do` endpoint allows arbitrary JavaScript to be executed when specially crafted URL is opened by an authenticated user. The attack is possible from a low-privileged user. Only versions 9.4_M7 and 9.4_M8 were tested and confirmed to be vulnerable, status of others is unknown. For above mentioned versions hot fixes were published.
- Product
- SAS Integration Technologies
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2023SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential.CVE-2023-49581 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.1
SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By doing so the attacker could increase response times of the AS ABAP, leading to mild impact on availability.
- Product
- SAP NetWeaver Application Server ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2023SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters CVE-2023-49058 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.5
SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file APIs. As a result, it has a low impact to the confidentiality.
- Product
- SAP Master Data Governance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2023Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity ApplicationCVE-2023-48417 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 9.8
Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity Application
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 9, 2023SyncTrayzor 1.1.29 enables CEF (Chromium Embedded Framework) remote debugging, allowing a local attacker to control the application.CVE-2021-46899 · Other software · Antonymale · reported by MITREHigh 7.8
SyncTrayzor 1.1.29 enables CEF (Chromium Embedded Framework) remote debugging, allowing a local attacker to control the application.
- Product
- Synctrayzor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023PyInstaller bundles a Python application and all its dependencies into a single package.CVE-2023-49797 · Other software · pyinstaller · reported by GitHubHigh 8.8
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if **all** the following are satisfied: 1. The user runs an application containing either `matplotlib` or `win32com`. 2. The application is ran as administrator (or at least a user with higher privileges than the attacker). 3. The user's temporary directory is not locked to that specific user (most likely due to `TMP`/`TEMP` environment variables pointing to an unprotected, arbitrary, non default location). Either: A. The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between `shutil.rmtree()`'s builtin symlink check and the deletion itself B: The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links. The vulnerability has been addressed in PR #7827 which corresponds to `pyinstaller >= 5.13.1`. Users are advised to upgrade. There are no known workarounds for this
- Product
- pyinstaller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023 A Qualys web application was found to have a stored XSS vulnerability resulting from the absence of HTML encoding in the presentation of logging information toCVE-2023-6146 · Other software · Qualys · reported by bugreport@qualys.comMedium 5.7
A Qualys web application was found to have a stored XSS vulnerability resulting from the absence of HTML encoding in the presentation of logging information to users. This vulnerability allowed a user with login access to the application to introduce XSS payload via browser details.
- Product
- Qualysguard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application.CVE-2023-39909 · Other software · Ericsson · reported by MITREHigh 8.8
Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application.
- Product
- Network Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Dec 6, 2023An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the applicationCVE-2023-46751 · Other software · Artifex · reported by MITREHigh 7.5
An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer.
- Product
- Ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ghostscript.comghostscript.com
Dec 4, 2023Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.CVE-2023-28586 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6
Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 4, 2023Memory Corruption in SPS Application while exporting public key in sorter TA.CVE-2023-28546 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption in SPS Application while exporting public key in sorter TA.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 4, 2023 Azure RTOS ThreadX is an advanced real-time operating system (RTOS) designed specifically for deeply embedded applications.CVE-2023-48693 · Other software · azure-rtos · reported by GitHubHigh 8.7
Azure RTOS ThreadX is an advanced real-time operating system (RTOS) designed specifically for deeply embedded applications. An attacker can cause arbitrary read and write due to vulnerability in parameter checking mechanism in Azure RTOS ThreadX, which may lead to privilege escalation. The affected components include RTOS ThreadX v6.2.1 and below. The fixes have been included in ThreadX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- threadx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications.CVE-2023-48692 · Other software · azure-rtos · reported by GitHubCritical 9
Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to icmp, tcp, snmp, dhcp, nat and ftp in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications.CVE-2023-48691 · Other software · azure-rtos · reported by GitHubHigh 8.1
Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause an out-of-bounds write in Azure RTOS NETX Duo, that could lead to remote code execution. The affected components include process related to IGMP protocol in RTOS v6.2.1 and below. The fix has been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications.CVE-2023-48316 · Other software · azure-rtos · reported by GitHubCritical 9.8
Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to snmp, smtp, ftp and dtls in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications.CVE-2023-48315 · Other software · azure-rtos · reported by GitHubHigh 8.8
Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to ftp and sntp in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023XWiki Change Request is an XWiki application allowing to request changes on a wiki without publishing directly the changes.CVE-2023-49280 · Other software · xwiki-contrib · reported by GitHubHigh 7.7
XWiki Change Request is an XWiki application allowing to request changes on a wiki without publishing directly the changes. Change request allows to edit any page by default, and the changes are then exported in an XML file that anyone can download. So it's possible for an attacker to obtain password hash of users by performing an edit on the user profiles and then downloading the XML file that has been created. This is also true for any document that might contain password field and that a user can view. This vulnerability impacts all version of Change Request, but the impact depends on the rights that has been set on the wiki since it requires for the user to have the Change request right (allowed by default) and view rights on the page to target. This issue cannot be easily exploited in an automated way. The patch consists in denying to users the right of editing pages that contains a password field with change request. It means that already existing change request for those pages won't be removed by the patch, administrators needs to take care of it. The patch is provided in Change Request 1.10, administrators should upgrade immediately. It's possible to workaround the vulnerab
- Product
- application-changerequest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2023Calendarinho is an open source calendaring application to manage large teams of consultants.CVE-2023-49281 · Other software · Cainor · reported by GitHubMedium 4.7
Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks, where users are tricked into visiting malicious sites, potentially leading to information theft and reputational damage to the website used for redirection. The problem is has been patched in commit `15b2393`. Users are advised to update to a commit after `15b2393`. There are no known workarounds for this vulnerability.
- Product
- Calendarinho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2023Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.CVE-2023-44402 · Other software · electron · reported by GitHubMedium 6.1
Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to macOS as these fuses are only currently supported on macOS. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the `.app` bundle on macOS which these fuses are supposed to protect against. There are no app side workarounds, you must update to a patched version of Electron.
- Product
- electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2023dpaste is an open source pastebin application written in Python using the Django framework.CVE-2023-49277 · Other software · DarrenOfficial · reported by GitHubHigh 8.3
dpaste is an open source pastebin application written in Python using the Django framework. A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities. Users are strongly advised to upgrade to dpaste release v3.8 or later versions, as dpaste versions older than v3.8 are susceptible to the identified security vulnerability. No known workarounds have been identified, and applying the patch is the most effective way to remediate the vulnerability.
- Product
- dpaste
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023An uncontrolled search path element vulnerability has been found on 4D and 4D server Windows executables applications, affecting version 19 R8 100218.CVE-2023-4770 · Other software · 4D · reported by cve-coordination@incibe.esMedium 6.5
An uncontrolled search path element vulnerability has been found on 4D and 4D server Windows executables applications, affecting version 19 R8 100218. This vulnerability consists in a DLL hijacking by replacing x64 shfolder.dll in the installation path, causing an arbitrary code execution.
- Product
- 4D.exe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023eDoc Employee Job Application – Best WordPress Job Manager for Employees: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48322 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eDoc Intelligence eDoc Employee Job Application – Best WordPress Job Manager for Employees allows Reflected XSS.This issue affects eDoc Employee Job Application – Best WordPress Job Manager for Employees: from n/a through 1.13.
- Product
- eDoc Employee Job Application – Best WordPress Job Manager for Employees
- Affected
- up to 1.13
- What to do
- Affects up to 1.13. Update eDoc Employee Job Application – Best WordPress Job Manager for Employees to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 29, 2023Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager.CVE-2023-49091 · Other software · azukaar · reported by GitHubHigh 8.8
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vulnerable due to to the authorization header used for user login remaining valid and not expiring after log out. This vulnerability allows an attacker to use the token to gain unauthorized access to the application/system even after the user has logged out. This issue has been patched in version 0.13.1.
- Product
- Cosmos-Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2023The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validCVE-2023-29062 · Other software · Becton, Dickinson and Company (BD) · reported by cybersecurity@bd.comLow 3.8
The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validating the identity of the requested resource. This is possible through the use of LLMNR, MBT-NS, or MDNS and will result in NTLMv2 hashes being sent to a malicious entity position on the local network. These hashes can subsequently be attacked through brute force and cracked if a weak password is used. This attack would only apply to domain joined systems.
- Product
- FACSChorus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2023Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers.CVE-2023-48713 · Other software · knative · reported by GitHubMedium 6.5
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound memory allocation bug. This is a DoS vulnerability, where a non-privileged Knative user can cause a DoS for the cluster. This issue has been patched in version 0.39.0.
- Product
- serving
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2023OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind.CVE-2023-32065 · Websites & servers · oroinc · reported by GitHubMedium 5.8
OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1.
- Product
- orocommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2023OroCalendarBundle enables a Calendar feature and related functionality in Oro applications.CVE-2023-32063 · Other software · oroinc · reported by GitHubMedium 5
OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1.
- Product
- crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2023OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster.CVE-2022-41951 · Other software · oroinc · reported by GitHubHigh 8.5
OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster. Path Traversal is possible in `Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName`. With this method, an attacker can pass the path to a non-existent file, which will allow writing the content to a new file that will be available during script execution. This vulnerability has been fixed in version 5.0.9.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2023 An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior toCVE-2023-5607 · Other software · Trellix · reported by trellixpsirt@trellix.comHigh 8.4
An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior to version 8.4.0 could lead to an authorised administrator attacker executing arbitrary code through uploading a specially crafted GTI reputation file. The attacker would need the appropriate privileges to access the relevant section of the User Interface. The import logic has been updated to restrict file types and content.
- Product
- Trellix Application and Change Control (TACC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkcm.trellix.comkcm.trellix.com
Nov 24, 2023OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace fileCVE-2023-49298 · Other software · openzfs · reported by MITREHigh 7.5
OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.
- Product
- openzfs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.freebsd.orgbugs.gentoo.org
Nov 22, 2023Nautobot is a Network Source of Truth and Network Automation Platform built as a web application All users of Nautobot versions earlier than 1.6.6 or 2.0.5 are CVE-2023-48705 · Other software · nautobot · reported by GitHubHigh 7.1
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application All users of Nautobot versions earlier than 1.6.6 or 2.0.5 are potentially affected by a cross-site scripting vulnerability. Due to incorrect usage of Django's `mark_safe()` API when rendering certain types of user-authored content; including custom links, job buttons, and computed fields; it is possible that users with permission to create or edit these types of content could craft a malicious payload (such as JavaScript code) that would be executed when rendering pages containing this content. The maintainers have fixed the incorrect uses of `mark_safe()` (generally by replacing them with appropriate use of `format_html()` instead) to prevent such malicious data from being executed. Users on Nautobot 1.6.x LTM should upgrade to v1.6.6 and users on Nautobot 2.0.x should upgrade to v2.0.5. Appropriate object permissions can and should be applied to restrict which users are permitted to create or edit the aforementioned types of user-authored content. Other than that, there is no direct workaround available.
- Product
- nautobot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comdocs.djangoproject.com
Nov 21, 2023A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the ACVE-2021-37942 · Other software · Elastic · reported by security@elastic.coHigh 7
A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher level of permissions than their user typically has access to.
- Product
- Elastic APM Java Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.coelastic.co
Nov 21, 2023The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error.CVE-2021-22143 · Other software · Elastic · reported by security@elastic.coLow 2.1
The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application error it is possible the headers will not be sanitized before being sent.
- Product
- Elastic APM .NET Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.coelastic.co
Nov 21, 2023SuiteCRM is a Customer Relationship Management (CRM) software application.CVE-2023-47643 · Other software · salesagility · reported by GitHubLow 3.1
SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire attack surface of the API, including sensitive fields such as UserHash. This issue is patched in version 8.4.2. There are no known workarounds.
- Product
- SuiteCRM-Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023 An arbitrary file write vulnerability exists where an authenticated attacker with privileges on the managing application could alter Nessus Rules variables to CVE-2023-6178 · Other software · Tenable · reported by vulnreport@tenable.comMedium 6.8
An arbitrary file write vulnerability exists where an authenticated attacker with privileges on the managing application could alter Nessus Rules variables to overwrite arbitrary files on the remote host, which could lead to a denial of service condition.
- Product
- Nessus Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Nov 20, 2023 An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter NessusCVE-2023-6062 · Other software · Tenable · reported by vulnreport@tenable.comMedium 6.8
An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus Rules variables to overwrite arbitrary files on the remote host, which could lead to a denial of service condition.
- Product
- Nessus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Nov 20, 2023An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking.CVE-2023-47311 · Other software · Spaceapplications · reported by MITREMedium 6.1
An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking.
- Product
- Yacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlinkedin.comlinkedin.com
Nov 20, 2023Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via the text variable scriptCCVE-2023-46471 · Other software · Spaceapplications · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via the text variable scriptContainer of the ScriptViewer.
- Product
- Yacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlinkedin.comlinkedin.com
Nov 20, 2023Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via crafted telecommand in thCVE-2023-46470 · Other software · Spaceapplications · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via crafted telecommand in the timeline view of the ArchiveBrowser.
- Product
- Yacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlinkedin.comlinkedin.com
Nov 20, 2023The XWiki Admin Tools Application provides tools to help the administration of XWiki.CVE-2023-48293 · Other software · xwiki-contrib · reported by GitHubHigh 8.8
The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version 4.5.1, a cross-site request forgery vulnerability in the query on XWiki tool allows executing arbitrary database queries on the database of the XWiki installation. Among other things, this allows modifying and deleting all data of the wiki. This could be both used to damage the wiki and to create an account with elevated privileges for the attacker, thus impacting the confidentiality, integrity and availability of the whole XWiki instance. A possible attack vector are comments on the wiki, by embedding an image with wiki syntax like `[[image:path:/xwiki/bin/view/Admin/QueryOnXWiki?query=DELETE%20FROM%20xwikidoc]]`, all documents would be deleted from the database when an admin user views this comment. This has been patched in Admin Tools Application 4.5.1 by adding form token checks. Some workarounds are available. The patch can also be applied manually to the affected pages. Alternatively, if the query tool is not needed, by deleting the document `Admin.SQLToolsGroovy`, all database query tools can be deactivated.
- Product
- application-admintools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023The XWiki Admin Tools Application provides tools to help the administration of XWiki.CVE-2023-48292 · Other software · xwiki-contrib · reported by GitHubCritical 9.6
The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker to execute arbitrary shell commands by tricking an admin into loading the URL with the shell command. A very simple possibility for an attack are comments. When the attacker can leave a comment on any page in the wiki it is sufficient to include an image with an URL like `/xwiki/bin/view/Admin/RunShellCommand?command=touch%20/tmp/attacked` in the comment. When an admin views the comment, the file `/tmp/attacked` will be created on the server. The output of the command is also vulnerable to XWiki syntax injection which offers a simple way to execute Groovy in the context of the XWiki installation and thus an even easier way to compromise the integrity and confidentiality of the whole XWiki installation. This has been patched by adding a form token check in version 4.5.1 of the admin tools. Some workarounds are available. The patch can be applied manually to the affected wiki pages. Alternatively, the document `Admin.RunShellC
- Product
- application-admintools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s).CVE-2023-6179 · Other software · Honeywell · reported by psirt@honeywell.comHigh 7.8
Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s). A(n) attacker could potentially exploit this vulnerability, leading to a standard user to have arbitrary system code execution. Honeywell recommends updating to the most recent version of this product, service or offering (Pro-watch 6.0.2, 6.0, 5.5.2,5.0.5).
- Product
- ProWatch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbuildings.honeywell.comhoneywell.com
Nov 15, 2023The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not yeCVE-2023-30954 · Other software · Palantir · reported by cve-coordination@palantir.comLow 2.7
The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not yet initialized.
- Product
- com.palantir.video:video-application-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.