Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
981 results · page 11 of 20
Mar 5, 2024A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecteCVE-2023-49973 · Other software · Oretnom23 · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter at /customer_support/index.php?page=customer_list.
- Product
- Customer Support System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Mar 5, 2024A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecteCVE-2023-49971 · Other software · sourcecodester · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter at /customer_support/index.php?page=customer_list.
- Product
- customer_support_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Mar 5, 2024An issue in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the messagCVE-2024-24278 · Other software · teamwire · reported by MITREHigh 7.5
An issue in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the message function.
- Product
- teamwire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.hisolutions.comresearch.hisolutions.com
Mar 4, 2024Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR.CVE-2023-33095 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Mar 1, 2024A cross-site scripting (XSS) vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PubCVE-2024-25434 · Other software · Pkp.sfu · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Publicname parameter.
- Product
- Open Journal Systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 1, 2024File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameteCVE-2024-27747 · Other software · sourcecodester · reported by MITRECritical 9.8
File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameter in the profile.php component.
- Product
- petrol_pump_management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address paraCVE-2024-27746 · Other software · sourcecodester · reported by MITRECritical 9.8
SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address parameter in the index.php component.
- Product
- petrol_pump_management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the image paramCVE-2024-27744 · Other software · sourcecodester · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the image parameter in the profile.php component.
- Product
- petrol_pump_management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the Address parCVE-2024-27743 · Other software · petroleum_management_software_application_project · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the Address parameter in the add_invoices.php component.
- Product
- petroleum_management_software_application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted payload to the uniquejobCVE-2023-46951 · Other software · contribsys · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted payload to the uniquejobs function.
- Product
- sidekiq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 29, 2024An issue in vivotek Network Camera v.FD8166A-VVTK-0204j allows a remote attacker to execute arbitrary code via a crafted payload to the upload_file.cgi componenCVE-2024-26548 · Other software · vivotek · reported by MITRECritical 9.8
An issue in vivotek Network Camera v.FD8166A-VVTK-0204j allows a remote attacker to execute arbitrary code via a crafted payload to the upload_file.cgi component.
- Product
- network_camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 29, 2024Cross-site scripting (XSS) vulnerability in RenderTune v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the CVE-2024-25292 · Other software · Martinbarker · reported by MITRECritical 9.6
Cross-site scripting (XSS) vulnerability in RenderTune v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Upload Title parameter.
- Product
- Rendertune
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024Cross Site Scripting (XSS) vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload CVE-2023-51802 · Other software · Oretnom23 · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the page or class_month parameter in the /php-attendance/attendance_report component.
- Product
- Simple Student Attendance System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024SQL Injection vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the id parCVE-2023-51801 · Other software · simple_atudent_attendance_system · reported by MITRECritical 9.8
SQL Injection vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the id parameter in the student_form.php and the class_form.php pages.
- Product
- simple_atudent_attendance_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024Cross Site Scripting (XSS) vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the CVE-2023-51800 · Other software · sourcecodester · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the main_settings component in the phone, address, bank, acc_name, acc_number parameters, new_class and cname parameter, add_new_parent function in the name email parameters, new_term function in the tname parameter, and the edit_student function in the name parameter.
- Product
- school_fees_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name.CVE-2023-48650 · Other software · Concretecms · reported by MITREMedium 4.8
Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orgconcretecms.org
Feb 28, 2024Obsidian Mind Map v1.1.0 allows attackers to execute arbitrary code via a crafted payload injected into an uploaded document.CVE-2022-36677 · Other software · lynchjames · reported by MITREMedium 6.1
Obsidian Mind Map v1.1.0 allows attackers to execute arbitrary code via a crafted payload injected into an uploaded document.
- Product
- obsidian-mindmap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024A cross-site scripting (XSS) vulnerability in Md1health Md1patient v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injectCVE-2024-25435 · Other software · md1health · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Md1health Md1patient v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Msg parameter.
- Product
- md1patient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2024In Srelay (the SOCKS proxy and Relay) v.0.4.8p3, a specially crafted network payload can trigger a denial of service condition and disrupt the service.CVE-2024-25398 · Other software · bulkstream · reported by MITREHigh 7.5
In Srelay (the SOCKS proxy and Relay) v.0.4.8p3, a specially crafted network payload can trigger a denial of service condition and disrupt the service.
- Product
- srelay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Feb 26, 2024SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php componenCVE-2024-24401 · Other software · nagios · reported by MITRECritical 9.8
SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php component.
- Product
- nagios_xi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2024An issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function.CVE-2023-51931 · Other software · alanclarke · reported by MITREHigh 7.5
An issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function.
- Product
- urlite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 15, 2024An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.CVE-2024-24386 · Other software · vitalpbx · reported by MITREHigh 7.2
An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.
- Product
- vitalpbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorderickduarte.notion.sitegithub.com
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the NCVE-2024-25300 · Other software · Redaxo · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Template section.
- Product
- Redaxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injectCVE-2024-25226 · Other software · Code-projects · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter under the Add Category function.
- Product
- Simple Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injectCVE-2024-25225 · Other software · Code-projects · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter under the Add Category function.
- Product
- Simple Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injectCVE-2024-25224 · Other software · Code-projects · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Size Number parameter under the Add Size function.
- Product
- Simple Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected intCVE-2024-25221 · Other software · Code-projects · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Note Section parameter at /TaskManager/Tasks.php.
- Product
- Task Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected intCVE-2024-25219 · Other software · task_manager_app · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Task Name parameter /TaskManager/Task.php.
- Product
- task_manager_app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected intCVE-2024-25218 · Other software · Code-projects · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Project Name parameter /TaskManager/Projects.php.
- Product
- Task Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024An issue in Employee Managment System v1.0 allows attackers to bypass authentication via injecting a crafted payload into the E-mail and Password parameters at CVE-2024-25214 · Other software · sherlock · reported by MITRECritical 9.8
An issue in Employee Managment System v1.0 allows attackers to bypass authentication via injecting a crafted payload into the E-mail and Password parameters at /alogin.html.
- Product
- employee_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024A cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the CVE-2023-52059 · Other software · Gestsup · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description text field.
- Product
- Gestsup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settCVE-2023-52430 · Other software · Authcrunch · reported by MITREMedium 6.1
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring.
- Product
- Caddy-security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.trailofbits.comgithub.com
Feb 8, 2024An issue discovered in Egerie Risk Manager v4.0.5 allows attackers to bypass the signature mechanism and tamper with the values inside the JWT payload resultingCVE-2023-27001 · Other software · Egerie · reported by MITREHigh 8.8
An issue discovered in Egerie Risk Manager v4.0.5 allows attackers to bypass the signature mechanism and tamper with the values inside the JWT payload resulting in privilege escalation.
- Product
- Egerie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024 An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username"CVE-2023-42765 · Other software · Westermo · reported by ics-cert@hq.dhs.govMedium 5.4
An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username" parameter in the SNMP configuration.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024Memory corruption when malformed message payload is received from firmware.CVE-2023-43516 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption when malformed message payload is received from firmware.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Feb 6, 2024Information disclosure in Audio while accessing AVCS services from ADSP payload.CVE-2023-33065 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.1
Information disclosure in Audio while accessing AVCS services from ADSP payload.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jan 30, 2024Stored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /index.php?c=install&m=indCVE-2024-22569 · Other software · Poscms · reported by MITREMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /index.php?c=install&m=index&step=2&is_install_db=0.
- Product
- Poscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2024ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs.CVE-2024-1019 · Other software · OWASP ModSecurity · reported by vulnerability@ncsc.chHigh 8.6
ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string component. This results in an impedance mismatch versus RFC compliant back-end applications. The vulnerability hides an attack payload in the path component of the URL from WAF rules inspecting it. A back-end may be vulnerable if it uses the path component of request URLs to construct queries. Integrators and users are advised to upgrade to 3.0.12. The ModSecurity v2 release line is not affected by this vulnerability.
- Product
- ModSecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Jan 25, 2024Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the "Execute CVE-2023-52046 · Other software · Webmin · reported by MITREMedium 4.8
Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the "Execute cron job as" tab Input field.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024A flaw was found in the json payload.CVE-2023-6267 · Other software · Red Hat · reported by Red HatHigh 8.6
A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.
- Product
- Red Hat build of Quarkus 2.13.9.Final
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 23, 2024 A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggereCVE-2023-7238 · Other software · Orthanc · reported by ics-cert@hq.dhs.govHigh 7.1
A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser.
- Product
- Osimis DICOM Web Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024Cross Site Scripting vulnerability in ABO.CMS v.5.9.3 allows an attacker to execute arbitrary code via a crafted payload to the Referer header.CVE-2023-46952 · Other software · Abocms · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in ABO.CMS v.5.9.3 allows an attacker to execute arbitrary code via a crafted payload to the Referer header.
- Product
- Abo.cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the title addition componenCVE-2023-51807 · Other software · Ofcms Project · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the title addition component.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools.CVE-2023-49254 · Other software · Hongdian · reported by cvd@cert.plHigh 8.8
Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools. This is similar to the vulnerability CVE-2021-28151 mitigated on the user interface level by blacklisting characters with JavaScript, however, it can still be exploited by sending POST requests directly.
- Product
- H8951-4G-ESP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2024Synopsys Seeker versions prior to 2023.12.0 are vulnerable to a stored cross-site scripting vulnerability through a specially crafted payload.CVE-2024-0226 · Other software · Synopsys · reported by disclosure@synopsys.comMedium 4.8
Synopsys Seeker versions prior to 2023.12.0 are vulnerable to a stored cross-site scripting vulnerability through a specially crafted payload.
- Product
- Seeker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.synopsys.comcommunity.synopsys.com
Jan 9, 2024A stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadCVE-2022-28975 · Other software · Infoblox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the VLAN View Name field.
- Product
- Nios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpiotrryciak.compiotrryciak.com
Jan 3, 2024A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a payload that could resuCVE-2023-6540 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.5
A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a payload that could result in the disclosure of sensitive information.
- Product
- Lenovo Browser Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiknow.lenovo.com.cniknow.lenovo.com.cn
Jan 2, 2024Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.CVE-2023-33118 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jan 2, 2024Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.CVE-2023-33117 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 19, 2023When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user.CVE-2023-50762 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user. This is because the text was interpreted as a MIME message and the first paragraph was always treated as an email header section. A digitally signed text from a different context, such as a signed GIT commit, could be used to spoof an email message. This vulnerability affects Thunderbird < 115.6.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.