Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,269 results · page 11 of 26
Nov 14, 2023Visual Studio Code Jupyter Extension Spoofing VulnerabilityCVE-2023-36018 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Code Jupyter Extension Spoofing Vulnerability
- Product
- Jupyter Extension for Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 13, 2023Label Studio is an open source data labeling tool.CVE-2023-47117 · Other software · HumanSignal · reported by GitHubHigh 7.5
Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set filters for filtering tasks. An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper (ORM). Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by character. In addition, Label Studio had a hard coded secret key that an attacker can use to forge a session token of any user by exploiting this ORM Leak vulnerability to leak account password hashes. This vulnerability has been addressed in commit `f931d9d129` which is included in the 1.9.2post0 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- label-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023An issue was discovered in Click Studios Passwordstate before 9811.CVE-2023-47801 · Other software · Clickstudios · reported by MITREMedium 4.7
An issue was discovered in Click Studios Passwordstate before 9811. Existing users (Security Administrators) could use the System Wide API Key to read or delete private password records when specifically used with the PasswordHistory API endpoint. It is also possible to use the Copy/Move Password Record API Key to Copy/Move private password records.
- Product
- Passwordstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclickstudios.com.auclickstudios.com.au
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Stranger Studios Force First and Last Name as Display Name plugin <= 1.2 versions.CVE-2023-28419 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Stranger Studios Force First and Last Name as Display Name plugin <= 1.2 versions.
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 9, 2023Label Studio is a multi-type data labeling and annotation tool with standardized output format.CVE-2023-43791 · Other software · HumanSignal · reported by GitHubCritical 9.8
Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges from a low privilege user to a Django Super Administrator user. The vulnerability was found to affect versions before `1.8.2`, where a patch was introduced.
- Product
- label-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023Cross Site Request Forgery vulnerability in Click Studios (SA) Pty Ltd Passwordstate v.Build 9785 and before allows a local attacker to execute arbitrary code vCVE-2023-43295 · Other software · Clickstudios · reported by MITRELow 3.5
Cross Site Request Forgery vulnerability in Click Studios (SA) Pty Ltd Passwordstate v.Build 9785 and before allows a local attacker to execute arbitrary code via a crafted request.
- Product
- Passwordstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclickstudios.com.auclickstudios.com.au
Oct 11, 2023Out-of-bounds read vulnerability exists in KV STUDIO Ver.CVE-2023-42138 · Other software · KEYENCE CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bounds read vulnerability exists in KV STUDIO Ver. 11.62 and earlier and KV REPLAY VIEWER Ver. 2.62 and earlier. If this vulnerability is exploited, information may be disclosed or arbitrary code may be executed by having a user of KV STUDIO PLAYER open a specially crafted file.
- Product
- KV STUDIO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023Microsoft QUIC Denial of Service VulnerabilityCVE-2023-38171 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft QUIC Denial of Service Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 10, 2023Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2023-36418 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 13, 2023The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of impropeCVE-2023-42468 · Other software · Azmobileapps · reported by MITREMedium 5.3
The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application (without any permissions) can craft an intent targeting com.cutestudio.dialer.activities.DialerActivity via the android.intent.action.CALL action in conjunction with a tel: URI, thereby placing a phone call.
- Product
- Color Phone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2023.NET Core and Visual Studio Denial of Service VulnerabilityCVE-2023-36799 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
.NET Core and Visual Studio Denial of Service Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 12, 2023Visual Studio Remote Code Execution VulnerabilityCVE-2023-36796 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 12, 2023Visual Studio Remote Code Execution VulnerabilityCVE-2023-36794 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 12, 2023Visual Studio Remote Code Execution VulnerabilityCVE-2023-36793 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 12, 2023Visual Studio Remote Code Execution VulnerabilityCVE-2023-36792 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 12, 2023Visual Studio Elevation of Privilege VulnerabilityCVE-2023-36759 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Visual Studio Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 12, 2023Visual Studio Elevation of Privilege VulnerabilityCVE-2023-36758 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 12, 2023Visual Studio Code Remote Code Execution VulnerabilityCVE-2023-36742 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Code Remote Code Execution Vulnerability
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 1, 2023Server Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information.CVE-2023-36088 · Other software · Vesoft · reported by MITREHigh 7.5
Server Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information.
- Product
- Nebulagraph Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2023SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the cCVE-2020-24950 · Other software · Thedaylightstudio · reported by MITREHigh 8.8
SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to function list_items.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2023A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739.CVE-2022-47636 · Other software · Outsystems · reported by MITREHigh 7.8
A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user open a .oml file (OutSystems Modeling Language), the application will load the following DLLs from the same directory av_libGLESv2.dll, libcef.DLL, user32.dll, and d3d10warp.dll. Using a crafted DLL, it is possible to execute arbitrary code in the context of the current logged in user.
- Product
- Service Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Aug 8, 2023Microsoft .NET Core and Visual Studio Denial-of-Service VulnerabilityCVE-2023-38180 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.5
Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).
- Product
- .NET Core and Visual Studio
- On CISA’s list since
- Aug 9, 2023 (federal fix deadline Aug 30, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comlists.fedoraproject.org
Aug 8, 2023ASP.NET Core SignalR and Visual Studio Information Disclosure VulnerabilityCVE-2023-35391 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.2
ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023.NET Core and Visual Studio Denial of Service VulnerabilityCVE-2023-38178 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET Core and Visual Studio Denial of Service Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023Visual Studio Tools for Office Runtime Spoofing VulnerabilityCVE-2023-36897 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Visual Studio Tools for Office Runtime Spoofing Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023.NET and Visual Studio Remote Code Execution VulnerabilityCVE-2023-35390 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
.NET and Visual Studio Remote Code Execution Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comlists.fedoraproject.org
Aug 7, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla.CVE-2023-38045 · Other software · admiror-design-studio.com · reported by security@joomla.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script Elements.
- Product
- Admiror Gallery component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Jul 27, 2023An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or CVE-2022-43703 · Computers, phones & browsers · Arm Ltd · reported by arm-security@arm.comHigh 7.8
An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files.
- Product
- Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF),
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.arm.comintel.com
Jul 27, 2023When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to executCVE-2022-43702 · Computers, phones & browsers · Arm Ltd · reported by arm-security@arm.comHigh 7.8
When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execute malicious code.
- Product
- Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF),
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.arm.comintel.com
Jul 27, 2023When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause exeCVE-2022-43701 · Computers, phones & browsers · Arm Ltd · reported by arm-security@arm.comHigh 7.8
When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause execution of malicious code.
- Product
- Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF),
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.arm.comintel.com
Jul 20, 2023Omnis Studio 10.22.00 has incorrect access control.CVE-2023-38335 · Other software · Omnis · reported by MITREMedium 5.3
Omnis Studio 10.22.00 has incorrect access control. It advertises a feature for making Omnis libraries "always private" - this is supposed to be an irreversible operation. However, due to implementation issues, "always private" Omnis libraries can be opened by the Omnis Studio browser by bypassing specific checks. This violates the expected behavior of an "irreversible operation".
- Product
- Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 20, 2023Omnis Studio 10.22.00 has incorrect access control.CVE-2023-38334 · Other software · Omnis · reported by MITREMedium 6.5
Omnis Studio 10.22.00 has incorrect access control. It advertises an irreversible feature for locking classes within Omnis libraries: it should be no longer possible to delete, view, change, copy, rename, duplicate, or print a locked class. Due to implementation issues, locked classes in Omnis libraries can be unlocked, and thus further analyzed and modified by Omnis Studio. This allows for further analyzing and also deleting, viewing, changing, copying, renaming, duplicating, or printing previously locked Omnis classes. This violates the expected behavior of an "irreversible operation."
- Product
- Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 11, 2023Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution VulnerabilityCVE-2023-36867 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability
- Product
- Visual Studio Code - GitHub Pull Requests and Issues Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 11, 2023ASP.NET and Visual Studio Security Feature Bypass VulnerabilityCVE-2023-33170 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
ASP.NET and Visual Studio Security Feature Bypass Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comlists.fedoraproject.org
Jul 11, 2023.NET and Visual Studio Elevation of Privilege VulnerabilityCVE-2023-33127 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
.NET and Visual Studio Elevation of Privilege Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Reservation.Studio Reservation.Studio widget plugin <= 1.0.11 versions.CVE-2023-25468 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Reservation.Studio Reservation.Studio widget plugin <= 1.0.11 versions.
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 3, 2023File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigatiCVE-2020-22153 · Other software · Thedaylightstudio · reported by MITRECritical 9.8
File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigation function.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2023Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description CVE-2020-22152 · Other software · Thedaylightstudio · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords of the pages function.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2023Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload fCVE-2020-22151 · Other software · Thedaylightstudio · reported by MITRECritical 9.8
Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023.NET and Visual Studio Denial of Service VulnerabilityCVE-2023-32030 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET and Visual Studio Denial of Service Vulnerability
- Product
- Microsoft .NET Framework 4.8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 14, 2023.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityCVE-2023-29331 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 14, 2023.NET, .NET Framework, and Visual Studio Elevation of Privilege VulnerabilityCVE-2023-24936 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 14, 2023.NET, .NET Framework, and Visual Studio Remote Code Execution VulnerabilityCVE-2023-24897 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 14, 2023.NET, .NET Framework, and Visual Studio Remote Code Execution VulnerabilityCVE-2023-24895 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
- Product
- .NET 7.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 13, 2023Visual Studio Code Spoofing VulnerabilityCVE-2023-33144 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.6
Visual Studio Code Spoofing Vulnerability
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 13, 2023Visual Studio Information Disclosure VulnerabilityCVE-2023-33139 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Visual Studio Information Disclosure Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 13, 2023.NET and Visual Studio Elevation of Privilege VulnerabilityCVE-2023-33135 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
.NET and Visual Studio Elevation of Privilege Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 13, 2023.NET and Visual Studio Remote Code Execution VulnerabilityCVE-2023-33128 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
.NET and Visual Studio Remote Code Execution Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 13, 2023.NET and Visual Studio Remote Code Execution VulnerabilityCVE-2023-33126 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
.NET and Visual Studio Remote Code Execution Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 13, 2023.NET and Visual Studio Elevation of Privilege VulnerabilityCVE-2023-32032 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
.NET and Visual Studio Elevation of Privilege Vulnerability
- Product
- .NET 7.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.