Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

453new WordPress flaws this week

394,547entries in the database

15,290 results · page 124 of 306

Nov 16, 2022Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call priCVE-2022-43782 · Websites & servers · Atlassian · reported by security@atlassian.comCritical 9.8
Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the {{usermanagement}} path. This vulnerability can only be exploited by IPs specified under the crowd application allowlist in the Remote Addresses configuration, which is {{none}} by default. The affected versions are all versions 3.x.x, versions 4.x.x before version 4.4.4, and versions 5.x.x before 5.0.3
Product
Crowd Data Center
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Nov 16, 2022A SQL injection vulnerability exits on the Simple Image Gallery System 1.0 application through "id" parameter on the album page.CVE-2021-38819 · Other software · Simple Image Gallery Web App Project · reported by MITREHigh 8.8
A SQL injection vulnerability exits on the Simple Image Gallery System 1.0 application through "id" parameter on the album page.
Product
Simple Image Gallery Web App
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 16, 2022KubeVela is an open source application delivery platform.CVE-2022-39383 · Other software · kubevela · reported by GitHubMedium 4.9
KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're using v1.6, please update the v1.6.1. Users who're using v1.5, please update the v1.5.8. There are no known workarounds for this issue.
Product
kubevela
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 15, 2022LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php.CVE-2022-43279 · Other software · limesurvey · reported by MITREHigh 7.2
LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php.
Product
limesurvey
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record brick-pamphlet-d24.notion.site github.com
Nov 14, 2022The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it.CVE-2022-42977 · Websites & servers · Atlassian · reported by MITREHigh 7.5
The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it. During export, the HTTP request has a fileName parameter that accepts any file on the system (e.g., an SSH private key) to be downloaded.
Product
Confluence Data Center
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Nov 14, 2022GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.CVE-2022-37290 · Other software · Gnome · reported by MITREMedium 5.5
GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.
Product
Nautilus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.gnome.org gitlab.gnome.org
Nov 11, 2022IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting.CVE-2022-40750 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236588.
Product
WebSphere Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Nov 11, 2022Incorrect default permissions in the Intel(R) Support Android application before version v22.02.28 may allow a privileged user to potentially enable informationCVE-2022-36367 · Other software · Intel · reported by secure@intel.comMedium 4.4
Incorrect default permissions in the Intel(R) Support Android application before version v22.02.28 may allow a privileged user to potentially enable information disclosure via local access.
Product
Support
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Nov 11, 2022Uncontrolled resource consumption in the Intel(R) Support Android application before version 22.02.28 may allow an authenticated user to potentially enable deniCVE-2022-30691 · Other software · Intel · reported by secure@intel.comMedium 5.9
Uncontrolled resource consumption in the Intel(R) Support Android application before version 22.02.28 may allow an authenticated user to potentially enable denial of service via local access.
Product
Support
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Nov 10, 2022All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vulnerable to directory traversal through CVE-2022-41607 · Other software · ETIC Telecom · reported by ics-cert@hq.dhs.govMedium 6.2
All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vulnerable to directory traversal through several different methods. This could allow an attacker to read sensitive files from the server, including SSH private keys, passwords, scripts, python objects, database files, and more.
Product
Remote Access Server (RAS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Nov 9, 2022Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services.CVE-2022-39368 · Other software · eclipse-californium · reported by GitHubHigh 8.2
Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In versions prior to 3.7.0, and 2.7.4, Californium is vulnerable to a Denial of Service. Failing handshakes don't cleanup counters for throttling, causing the threshold to be reached without being released again. This results in permanently dropping records. The issue was reported for certificate based handshakes, but may also affect PSK based handshakes. It generally affects client and server as well. This issue is patched in version 3.7.0 and 2.7.4. There are no known workarounds. main: commit 726bac57659410da463dcf404b3e79a7312ac0b9 2.7.x: commit 5648a0c27c2c2667c98419254557a14bac2b1f3f
Product
californium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 9, 2022Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to gain code execution inCVE-2021-26391 · Other software · AMD · reported by psirt@amd.comHigh 7.8
Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to gain code execution in that TA or the OS/kernel.
Product
AMD Radeon RX 5000 Series & PRO W5000 Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record amd.com amd.com
Nov 8, 2022Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabCVE-2022-41214 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.7
Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabled function to delete a file which is otherwise restricted. On successful exploitation an attacker can completely compromise the integrity and availability of the application.
Product
SAP NetWeaver Application Server ABAP and ABAP Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Nov 8, 2022Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabCVE-2022-41212 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.9
Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabled function to read a file which is otherwise restricted. On successful exploitation an attacker can completely compromise the confidentiality of the application.
Product
SAP NetWeaver Application Server ABAP and ABAP Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Nov 8, 2022The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS.CVE-2022-36077 · Other software · electron · reported by GitHubHigh 7.2
The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the redirect target is a SMB URL such as `file://some.website.com/`, then in some cases, Windows will connect to that server and attempt NTLM authentication, which can include sending hashed credentials.This issue has been patched in versions: 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7. Users are recommended to upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the `WebContents.on('will-redirect')` event, for all WebContents as a workaround.
Product
electron
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2022HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability.CVE-2022-38660 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.3
HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user.
Product
HCL Domino
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Nov 4, 2022A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacker to perform a serCVE-2022-20958 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.3
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacker to perform a server-side request forgery (SSRF) attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web interface. A successful exploit could allow the attacker to obtain confidential information from the BroadWorks server and other device on the network. {{value}} ["%7b%7bvalue%7d%7d"])}]]
Product
Cisco BroadWorks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Nov 4, 2022A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an authenticated, remote attacker to perform a serveCVE-2022-20951 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.7
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an authenticated, remote attacker to perform a server-side request forgery (SSRF) attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web interface. A successful exploit could allow the attacker to obtain confidential information from the BroadWorks server and other device on the network. {{value}} ["%7b%7bvalue%7d%7d"])}]]
Product
Cisco BroadWorks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Nov 3, 2022CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases.CVE-2022-42744 · Other software · Auieo · reported by help@fluidattacks.comCritical 9.8
CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not correctly validate the entriesPerPage parameter against SQLi attacks.
Product
Candidats
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record candidats.net fluidattacks.com
Nov 3, 2022"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanteCVE-2022-38712 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. IBM X-Force ID: 234762."
Product
Websphere Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com ibm.com
Nov 3, 2022CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application.CVE-2022-42751 · Other software · Auieo · reported by help@fluidattacks.comHigh 8.8
CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions.
Product
Candidats
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record candidats.net fluidattacks.com
Nov 3, 2022Alpine before 2.25 allows remote attackers to cause a denial of service (application crash) when LIST or LSUB is sent before STARTTLS.CVE-2021-46853 · Other software · Alpine Project · reported by MITREMedium 5.9
Alpine before 2.25 allows remote attackers to cause a denial of service (application crash) when LIST or LSUB is sent before STARTTLS.
Product
Alpine
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.gentoo.org nostarttls.secvuln.info
Nov 1, 2022The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures.CVE-2020-4099 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.9
The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could forge the same digital signature of the app after maliciously modifying the app.
Product
HCL Verse for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Nov 1, 2022phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server.CVE-2022-39369 · Other software · apereo · reported by GitHubHigh 8
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a valid ticket granted for any authorized service in the same SSO realm (CAS server) to authenticate to the service protected by phpCAS. Depending on the settings of the CAS server service registry in worst case this may be any other service URL (if the allowed URLs are configured to "^(https)://.*") or may be strictly limited to known and authorized services in the same SSO federation if proper URL service validation is applied. This vulnerability may allow an attacker to gain access to a victim's account on a vulnerable CASified service without victim's knowledge, when the victim visits attacker's website while being logged in to the same CAS server. phpCAS 1.6.0 is a major version upgrade that starts enforcing service URL discovery validation, because there is unfortunately no 100% safe default config to use in PHP. Starting this version, it is required to pass in an additional service ba
Product
phpCAS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.debian.org
Oct 31, 2022 The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, potentially includiCVE-2022-40296 · Websites & servers · PHP Point of Sale LLC · reported by vdp@themissinglink.com.auCritical 9.8
The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, potentially including internal and local services, leading to attacks in other downstream systems.
Product
PHP Point of Sale
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 31, 2022The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the compCVE-2022-40295 · Websites & servers · PHP Point of Sale LLC · reported by vdp@themissinglink.com.auMedium 4.9
The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the compromise of plaintext passwords via offline attacks.
Product
PHP Point of Sale
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 31, 2022 The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then trCVE-2022-40294 · Websites & servers · PHP Point of Sale LLC · reported by vdp@themissinglink.com.auHigh 8.8
The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then triggered in exported data viewers.
Product
PHP Point of Sale
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 31, 2022 The application was vulnerable to a session fixation that could be used hijack accounts.CVE-2022-40293 · Websites & servers · PHP Point of Sale LLC · reported by vdp@themissinglink.com.auCritical 9.8
The application was vulnerable to a session fixation that could be used hijack accounts.
Product
PHP Point of Sale
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 31, 2022 The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the systeCVE-2022-40292 · Websites & servers · PHP Point of Sale LLC · reported by vdp@themissinglink.com.auMedium 5.3
The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the system.
Product
PHP Point of Sale
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 31, 2022 The application was vulnerable to Cross-Site Request Forgery (CSRF) attacks, allowing an attacker to coerce users into sending malicious requests to the site tCVE-2022-40291 · Websites & servers · PHP Point of Sale LLC · reported by vdp@themissinglink.com.auHigh 8.8
The application was vulnerable to Cross-Site Request Forgery (CSRF) attacks, allowing an attacker to coerce users into sending malicious requests to the site to delete their account, or in rare circumstances, hijack their account and create other admin accounts.
Product
PHP Point of Sale
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 31, 2022 The application was vulnerable to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the barcode generation functionality, allowing attacCVE-2022-40290 · Websites & servers · PHP Point of Sale LLC · reported by vdp@themissinglink.com.auMedium 6.1
The application was vulnerable to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the barcode generation functionality, allowing attackers to generate an unsafe link that could compromise users.
Product
PHP Point of Sale
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 31, 2022 The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the upload and download functionality, which could be leveraged to escaCVE-2022-40289 · Websites & servers · PHP Point of Sale LLC · reported by vdp@themissinglink.com.auCritical 9
The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the upload and download functionality, which could be leveraged to escalate privileges or compromise any accounts they can coerce into observing the targeted files.
Product
PHP Point of Sale
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 31, 2022 The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the user profile data fields, which could be leveraged to escalate privCVE-2022-40288 · Websites & servers · PHP Point of Sale LLC · reported by vdp@themissinglink.com.auCritical 9
The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the user profile data fields, which could be leveraged to escalate privileges within and compromise any account that views their user profile.
Product
PHP Point of Sale
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 31, 2022 The application was found to be vulnerable to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in messaging functionality, leading to privilegeCVE-2022-40287 · Websites & servers · PHP Point of Sale LLC · reported by vdp@themissinglink.com.auCritical 9
The application was found to be vulnerable to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in messaging functionality, leading to privilege escalation or a compromise of a targeted account.
Product
PHP Point of Sale
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 31, 2022 The application was vulnerable to multiple instances of SQL injection (authenticated and unauthenticated) through a vulnerable parameter.CVE-2022-3059 · Other software · Schoolbox Pty Ltd · reported by vdp@themissinglink.com.auHigh 8.6
The application was vulnerable to multiple instances of SQL injection (authenticated and unauthenticated) through a vulnerable parameter. Due to the stacked query support, complex SQL commands could be crafted and injected into the vulnerable parameter and using a sleep based inferential SQL injection it was possible to extract data from the database.
Product
Schoolbox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 31, 2022 Multiple instances of XSS (stored and reflected) was found in the application.CVE-2022-39020 · Other software · Schoolbox Pty Ltd · reported by vdp@themissinglink.com.auHigh 7.6
Multiple instances of XSS (stored and reflected) was found in the application. For example, features such as student assessment submission, file upload, news, ePortfolio and calendar event creation were found to be vulnerable to cross-site scripting.
Product
Schoolbox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 31, 2022 Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the applicationCVE-2022-39019 · Other software · M-Files · reported by vdp@themissinglink.com.auMedium 6.3
Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server.
Product
Hubshare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 31, 2022conduit-hyper integrates a conduit application with the hyper server.CVE-2022-39294 · Other software · conduit-rust · reported by GitHubHigh 7.5
conduit-hyper integrates a conduit application with the hyper server. Prior to version 0.4.2, `conduit-hyper` did not check any limit on a request's length before calling [`hyper::body::to_bytes`](https://docs.rs/hyper/latest/hyper/body/fn.to_bytes.html). An attacker could send a malicious request with an abnormally large `Content-Length`, which could lead to a panic if memory allocation failed for that request. In version 0.4.2, `conduit-hyper` sets an internal limit of 128 MiB per request, otherwise returning status 400 ("Bad Request"). This crate is part of the implementation of Rust's [crates.io](https://crates.io/), but that service is not affected due to its existing cloud infrastructure, which already drops such malicious requests. Even with the new limit in place, `conduit-hyper` is not recommended for production use, nor to directly serve the public Internet.
Product
conduit-hyper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 28, 2022Impact varies for each individual vulnerability in the application.CVE-2022-3741 · Other software · chatwoot · reported by security@huntr.devCritical 9.8
Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output Status Code to separate accounts that are generated and waiting for email verification. \n\nFor the sign in directories, it is possible to brute force login attempts to either login portal, which could lead to account compromise.
Product
chatwoot/chatwoot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Oct 27, 2022Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page.CVE-2022-42993 · Other software · Password Storage Application Project · reported by MITREMedium 5.4
Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page.
Product
Password Storage Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 26, 2022Twisted is an event-based framework for internet applications.CVE-2022-39348 · Other software · twisted · reported by GitHubMedium 5.4
Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
Product
twisted
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 25, 2022Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and user passwords in the debug statements.CVE-2022-28170 · Other software · Broadcom · reported by sirt@brocade.comMedium 6.5
Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and user passwords in the debug statements. This could allow a local user to extract the passwords from a debug file.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com
Oct 25, 2022@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to iCVE-2022-39350 · Other software · DependencyTrack · reported by GitHubMedium 5.4
@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of providing vulnerability details in markdown format, the Dependency-Track frontend renders them using the JavaScript library Showdown. Showdown does not have any XSS countermeasures built in, and versions before 4.6.1 of the Dependency-Track frontend did not encode or sanitize Showdown's output. This made it possible for arbitrary JavaScript included in vulnerability details via HTML attributes to be executed in context of the frontend. Actors with the `VULNERABILITY_MANAGEMENT` permission can exploit this weakness by creating or editing a custom vulnerability and providing XSS payloads in any of the following fields: Description, Details, Recommendation, or References. The payload will be executed for users with the `VIEW_PORTFOLIO` permission when browsing to the modified vulnerability's page. Alternatively, malicious JavaScript could be introduced via any of the vulnerability databases mirrored by Dependency-Track. However, this attack vect
Product
frontend
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.dependencytrack.org github.com
Oct 25, 2022GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow.CVE-2022-39321 · Other software · actions · reported by GitHubHigh 8.8
GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands was discovered in versions prior to 2.296.2, 2.293.1, 2.289.4, 2.285.2, and 2.283.4 that allows an input to escape the environment variable and modify that docker command invocation directly. Jobs that use container actions, job containers, or service containers alongside untrusted user inputs in environment variables may be vulnerable. The Actions Runner has been patched, both on `github.com` and hotfixes for GHES and GHAE customers in versions 2.296.2, 2.293.1, 2.289.4, 2.285.2, and 2.283.4. GHES and GHAE customers may want to patch their instance in order to have their runners automatically upgrade to these new runner versions. As a workaround, users may consider removing any container actions, job containers, or service containers from their jobs until they are able to upgrade their runner versions.
Product
runner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 25, 2022Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.CVE-2022-34870 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.
Product
Apache Geode
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Oct 21, 2022A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation.CVE-2022-42944 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Product
Autocad
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record autodesk.com autodesk.com
Oct 21, 2022A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation.CVE-2022-42943 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Product
Autocad
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record autodesk.com autodesk.com
Oct 21, 2022A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation.CVE-2022-42942 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Product
Autocad
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record autodesk.com autodesk.com
Oct 21, 2022A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation.CVE-2022-42941 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Product
Autocad
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record autodesk.com autodesk.com
Oct 21, 2022A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability.CVE-2022-42940 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Product
Autocad
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record autodesk.com autodesk.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.