Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,543 results · page 132 of 391
Sep 28, 2022In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats.CVE-2020-27601 · Other software · Bigbluebutton · reported by MITRELow 3.5
In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-html5/imports/ui/components/chat/service.js.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resCVE-2022-2760 · Other software · Octopus Deploy · reported by security@octopus.comMedium 4.3
In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Sep 28, 2022The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “AdCVE-2022-32170 · Other software · bytebase · reported by vulnerabilitylab@mend.ioMedium 4.3
The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”.
- Product
- bytebase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues CVE-2022-32169 · Other software · bytebase · reported by vulnerabilitylab@mend.ioMedium 4.3
The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is “/issue”.
- Product
- bytebase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022SEO Smart Links: Does not sanitise and escape some of its settingsCVE-2022-3135 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SEO Smart Links
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update SEO Smart Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022OAuth client Single Sign On: Does not have authorisation and CSRFCVE-2022-3119 · WordPress plugins & themes · reported by WPScanHigh 7.5
The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know the correct email address
- Product
- OAuth client Single Sign On
- Fixed in
- 3.0.4
- What to do
- Update OAuth client Single Sign On to 3.0.4 or newer.
Sep 26, 2022Login Block IPs: Does not have CSRF check in placeCVE-2022-3098 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Login Block IPs WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Login Block IPs
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Login Block IPs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022Slider Hero: Does not escape the slider NameCVE-2022-3074 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks.
- Product
- Slider Hero
- Fixed in
- 8.4.4
- What to do
- Update Slider Hero to 8.4.4 or newer.
Sep 26, 2022Generate PDF: Does not sanitise and escape its settingsCVE-2022-3070 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Generate PDF
- Fixed in
- 3.6
- What to do
- Update Generate PDF to 3.6 or newer.
Sep 26, 2022WordLift: Does not sanitise and escape its settingsCVE-2022-3069 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordLift WordPress plugin before 3.37.2 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WordLift
- Fixed in
- 3.37.2
- What to do
- Update WordLift to 3.37.2 or newer.
Sep 26, 2022Simple File List: Does not escape parameters before outputting them back in attributesCVE-2022-3062 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
- Product
- Simple File List
- Fixed in
- 4.4.12
- What to do
- Update Simple File List to 4.4.12 or newer.
Sep 26, 2022Bitcoin / Altcoin Faucet: Does not have any CSRF checkCVE-2022-3025 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bitcoin / Altcoin Faucet WordPress plugin through 1.6.0 does not have any CSRF check when saving its settings, allowing attacker to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
- Product
- Bitcoin / Altcoin Faucet
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Bitcoin / Altcoin Faucet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022Simple Bitcoin Faucets: Does not have any authorisation and CSRF in an AJAX actionCVE-2022-3024 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
- Product
- Simple Bitcoin Faucets
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Simple Bitcoin Faucets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022Ldap WP Login / Active Directory Integration: Does not have any authorisation and CSRF checksCVE-2022-2987 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating it's settings (which are hooked to the init action), allowing unauthenticated attackers to update them. Attackers could set their own LDAP server to be used to authenticated users, therefore bypassing the current authentication
- Product
- Ldap WP Login / Active Directory Integration
- Fixed in
- 3.0.2
- What to do
- Update Ldap WP Login / Active Directory Integration to 3.0.2 or newer.
Sep 26, 2022Download Manager: Does not validate one of its settingsCVE-2022-2926 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the blog directory
- Product
- Download Manager
- Fixed in
- 3.2.55
- What to do
- Update Download Manager to 3.2.55 or newer.
Sep 26, 2022WP Popup Builder: Does not have authorisation and CSRF check in an AJAX actionCVE-2022-2405 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup
- Product
- WP Popup Builder
- Fixed in
- 1.2.9
- What to do
- Update WP Popup Builder to 1.2.9 or newer.
Sep 26, 2022WP Popup Builder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2404 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- WP Popup Builder
- Fixed in
- 1.2.9
- What to do
- Update WP Popup Builder to 1.2.9 or newer.
Sep 26, 2022Post SMTP Mailer/Email Log: Does not have proper authorisation in some AJAX actionsCVE-2022-2352 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example.
- Product
- Post SMTP Mailer/Email Log
- Fixed in
- 2.1.7
- What to do
- Update Post SMTP Mailer/Email Log to 2.1.7 or newer.
Sep 26, 2022SVG Support: Does not properly handle SVG added via an URLCVE-2022-1755 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cross-Site Scripting attacks
- Product
- SVG Support
- Fixed in
- 2.5
- What to do
- Update SVG Support to 2.5 or newer.
Sep 26, 2022Scripts Organizer: Does not have capability and CSRF checks in the saveScript AJAX actionCVE-2021-24890 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both unauthenticated and authenticated users, and does not validate user input in any way, which could allow unauthenticated users to put arbitrary PHP code in a file
- Product
- Scripts Organizer
- Fixed in
- 3.0
- What to do
- Update Scripts Organizer to 3.0 or newer.
Full record and what to do →NVD recorddplugins.comwpscan.com
Sep 25, 2022registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstCVE-2022-41343 · Other software · Dompdf Project · reported by MITREHigh 7.5
registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.
- Product
- Dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 since the getReadReceipts Meteor server method does not properly filter uCVE-2022-32228 · Other software · Rocket.chat · reported by support@hackerone.comMedium 4.3
An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 since the getReadReceipts Meteor server method does not properly filter user inputs that are passed to MongoDB queries, allowing $regex queries to enumerate arbitrary Message IDs.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Sep 23, 2022MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) does not sanitize input before memcpyCVE-2022-2970 · Other software · MZ Automation · reported by ics-cert@hq.dhs.govCritical 10
MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) does not sanitize input before memcpy is used, which could allow an attacker to crash the device or remotely execute arbitrary code.
- Product
- libIEC61850
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since it doesn't check the param length before using the sscanf instructionCVE-2022-2070 · Other software · Grandstream · reported by cve-coordination@incibe.esCritical 9.8
In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since it doesn't check the param length before using the sscanf instruction. Because of that, an attacker could create a socket and connect with a remote IP:port by opening a shell and getting full access to the system. The exploit affects daemons dbmng and logsrv that are running on ports 8000 and 8001 by default.
- Product
- Grandstream GSD3710
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordincibe-cert.esincibe-cert.es
Sep 23, 2022an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check the param length beforeCVE-2022-2025 · Other software · Grandstream · reported by cve-coordination@incibe.esCritical 9.8
an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check the param length before use the strcopy instruction. The explotation of this vulnerability may lead an attacker to execute a shell with full access.
- Product
- Grandstream GSD3710
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordincibe-cert.esincibe-cert.es
Sep 23, 2022Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default.CVE-2021-45035 · Other software · Velneo · reported by cve-coordination@incibe.esMedium 6.3
Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.
- Product
- Velneo vClient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoc.velneo.comvelneo.es
Sep 23, 2022Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disCVE-2022-33683 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.9
Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middle attacks, which could leak authentication data, configuration data, and any other data sent by these clients. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack. This issue affects Apache Pulsar Broker and Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.
- Product
- Apache Pulsar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Sep 23, 2022python-jwt is a module for generating and verifying JSON Web Tokens.CVE-2022-39227 · Other software · davedoesdev · reported by GitHubCritical 9.1
python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowing the secret key. Depending on the application, this may for example enable the attacker to spoof other user's identities, hijack their sessions, or bypass authentication. Users should upgrade to version 3.3.4. There are no known workarounds.
- Product
- python-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user CVE-2022-38512 · Other software · Liferay · reported by MITREMedium 6.5
The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.
- Product
- DXP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.liferay.devportal.liferay.dev
Sep 21, 2022The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission befoCVE-2022-39975 · Other software · Liferay · reported by MITREMedium 4.3
The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation.
- Product
- DXP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.liferay.devportal.liferay.dev
Sep 21, 2022Jenkins BigPanda Notifier Plugin 1.4.0 and earlier does not mask the BigPanda API key on the global configuration form, increasing the potential for attackers tCVE-2022-41248 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins BigPanda Notifier Plugin 1.4.0 and earlier does not mask the BigPanda API key on the global configuration form, increasing the potential for attackers to observe and capture it.
- Product
- Jenkins BigPanda Notifier Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Sep 21, 2022Jenkins View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abusedCVE-2022-41244 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.1
Jenkins View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a man-in-the-middle attack to intercept these connections.
- Product
- Jenkins View26 Test-Reporting Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Jenkins SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a manCVE-2022-41243 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.1
Jenkins SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a man-in-the-middle attack to intercept these connections.
- Product
- Jenkins SmallTest Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2022-41241 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comCritical 9.1
Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Product
- Jenkins RQM Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Jenkins Walti Plugin 1.0.1 and earlier does not escape the information provided by the Walti API, resulting in a stored cross-site scripting (XSS) vulnerabilityCVE-2022-41240 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Walti Plugin 1.0.1 and earlier does not escape the information provided by the Walti API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide malicious API responses from Walti.
- Product
- Jenkins Walti Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause, CVE-2022-41239 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
- Product
- Jenkins DotCi Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executioCVE-2022-41237 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comCritical 9.8
Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
- Product
- Jenkins DotCi Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to triggCVE-2022-41234 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trigger jobs that are configured to be triggerable via Rundeck.
- Product
- Jenkins Rundeck Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Jenkins Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints, allowing attackers with Item/Read permissCVE-2022-41233 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints, allowing attackers with Item/Read permission to obtain information about build artifacts of a given job, if the optional Run/Artifacts permission is enabled.
- Product
- Jenkins Rundeck Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtaCVE-2022-41230 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain names and URLs of Jenkins servers that the plugin is configured to publish builds to, as well as builds pending for publication to those Jenkins servers.
- Product
- Jenkins Build-Publisher Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build sCVE-2022-41229 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build step, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins NS-ND Integration Performance Publisher Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2022-41226 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comCritical 9.8
Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Product
- Jenkins Compuware Common Configuration Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site sCVE-2022-41225 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control API responses by Anchore engine.
- Product
- Jenkins Anchore Container Image Scanner Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting iCVE-2022-41224 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022NEX-Forms: Does not properly sanitise and escape user input before using it in SQL statementsCVE-2022-3142 · WordPress plugins & themes · reported by WPScanHigh 8.8
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
- Product
- NEX-Forms
- Fixed in
- 7.9.7
- What to do
- Update NEX-Forms to 7.9.7 or newer.
Full record and what to do →NVD recordpacketstormsecurity.commedium.com
Sep 19, 2022Gettext override translations: Does not sanitise and escape some of its settingsCVE-2022-3036 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Gettext override translations WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Gettext override translations
- Fixed in
- 2.0.0
- What to do
- Update Gettext override translations to 2.0.0 or newer.
Sep 19, 2022Slickr Flickr: Does not sanitise and escape its settingsCVE-2022-3021 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slickr Flickr WordPress plugin through 2.8.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Slickr Flickr
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update Slickr Flickr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2022Safe Software FME Server v2021.2.5 and below does not employ server-side validation.CVE-2022-38341 · Other software · Safe · reported by MITREHigh 7.1
Safe Software FME Server v2021.2.5 and below does not employ server-side validation.
- Product
- FME Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.safe.comcycura.com
Sep 19, 2022BadgeOS: Does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated usersCVE-2022-2958 · WordPress plugins & themes · reported by WPScanHigh 8.8
The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections
- Product
- BadgeOS
- Fixed in
- 3.7.1.3
- What to do
- Update BadgeOS to 3.7.1.3 or newer.
Sep 19, 2022Zephyr Project Manager: Does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated usersCVE-2022-2840 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
- Product
- Zephyr Project Manager
- Fixed in
- 3.2.5
- What to do
- Update Zephyr Project Manager to 3.2.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.