Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,571 results · page 136 of 392
Aug 8, 2022Easy Username Updater: Does not implement CSRF checksCVE-2022-2355 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin
- Product
- Easy Username Updater
- Fixed in
- 1.0.5
- What to do
- Update Easy Username Updater to 1.0.5 or newer.
Aug 8, 2022Website File Changes Monitor: Does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins)CVE-2022-2269 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins), leading to an SQL injection
- Product
- Website File Changes Monitor
- Fixed in
- 1.8.3
- What to do
- Update Website File Changes Monitor to 1.8.3 or newer.
Aug 4, 2022Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell.CVE-2022-25168 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).
- Product
- Apache Hadoop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgsecurity.netapp.com
Aug 1, 2022IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies.CVE-2022-34307 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 229436.
- Product
- CICS TX Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 1, 2022YaySMTP: Does not have capability check before displaying the Mailer Credentials in JS code for the settingsCVE-2022-2370 · WordPress plugins & themes · reported by WPScanMedium 6.5
The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them
- Product
- YaySMTP
- Fixed in
- 2.2.1
- What to do
- Update YaySMTP to 2.2.1 or newer.
Aug 1, 2022YaySMTP: Does not have capability check in an AJAX actionCVE-2022-2369 · WordPress plugins & themes · reported by WPScanMedium 4.3
The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs of the plugin
- Product
- YaySMTP
- Fixed in
- 2.2.1
- What to do
- Update YaySMTP to 2.2.1 or newer.
Aug 1, 2022Flexi Quote Rotator: Does not sanitise and escape its settingsCVE-2022-2328 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flexi Quote Rotator WordPress plugin through 0.9.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Flexi Quote Rotator
- Affected
- up to 0.9.4
- What to do
- Affects up to 0.9.4. Update Flexi Quote Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022Invitation Based Registrations: Does not sanitise and escape some of its settingsCVE-2022-2325 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Invitation Based Registrations WordPress plugin through 2.2.84 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Invitation Based Registrations
- Affected
- up to 2.2.84
- What to do
- Affects up to 2.2.84. Update Invitation Based Registrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022WordPress Popup: Does not sanitise and escape some of its settingsCVE-2022-2305 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Popup WordPress plugin through 1.9.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WordPress Popup
- Affected
- up to 1.9.3.8
- What to do
- Affects up to 1.9.3.8. Update WordPress Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022Featured Image from URL (FIFU): Does not validateCVE-2022-2278 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not validate, sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Featured Image from URL (FIFU)
- Fixed in
- 4.0.1
- What to do
- Update Featured Image from URL (FIFU) to 4.0.1 or newer.
Aug 1, 2022Simple Membership: Does not properly validate the membership_level parameterCVE-2022-2273 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.
- Product
- Simple Membership
- Fixed in
- 4.1.3
- What to do
- Update Simple Membership to 4.1.3 or newer.
Aug 1, 2022GiveWP: Does not have CSRF in placeCVE-2022-2260 · WordPress plugins & themes · reported by WPScanMedium 6.5
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the database many times which leads to overwhelm the target's CPU.
- Product
- GiveWP
- Fixed in
- 2.21.3
- What to do
- Update GiveWP to 2.21.3 or newer.
Aug 1, 2022Featured Image from URL (FIFU): Does not have CSRF check in placeCVE-2022-2241 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of validation, sanitisation and escaping in some of them, it could also lead to Stored XSS issues
- Product
- Featured Image from URL (FIFU)
- Fixed in
- 4.0.1
- What to do
- Update Featured Image from URL (FIFU) to 4.0.1 or newer.
Aug 1, 2022GiveWP: Does not properly sanitise and escape the currency settingsCVE-2022-2215 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- GiveWP
- Fixed in
- 2.21.3
- What to do
- Update GiveWP to 2.21.3 or newer.
Aug 1, 2022Advanced WordPress Reset: Does not escape some generated URLs before outputting them back in href attributes of admin dashboard pagesCVE-2022-2181 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
- Product
- Advanced WordPress Reset
- Fixed in
- 1.6
- What to do
- Update Advanced WordPress Reset to 1.6 or newer.
Aug 1, 2022Microsoft Advertising Universal Event Tracking (UET): Does not sanitise and escape its settingsCVE-2022-2170 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Due to the nature of this plugin, well crafted XSS can also leak into the frontpage.
- Product
- Microsoft Advertising Universal Event Tracking (UET)
- Fixed in
- 1.0.4
- What to do
- Update Microsoft Advertising Universal Event Tracking (UET) to 1.0.4 or newer.
Aug 1, 2022Youzify: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1950 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
- Product
- Youzify
- Fixed in
- 1.2.0
- What to do
- Update Youzify to 1.2.0 or newer.
Aug 1, 2022Copyright Proof: Does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated usersCVE-2022-1906 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled.
- Product
- Copyright Proof
- Affected
- up to 4.16
- What to do
- Affects up to 4.16. Update Copyright Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022Project Source Code Download: Does not protect its backup generation and download functionalitiesCVE-2022-1585 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php.
- Product
- Project Source Code Download
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Project Source Code Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022Event Timeline: Does not sanitize and escape Timeline TextCVE-2022-1324 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Event Timeline
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Event Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022Login with phone number: Does not sanitise and escape plugin settingsCVE-2022-0598 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Login with phone number
- Fixed in
- 1.3.8
- What to do
- Update Login with phone number to 1.3.8 or newer.
Jul 27, 2022VISAM VBASE version 11.6.0.6 does not neutralize or incorrectly neutralizes user-controllable input before the data is placed in output used as a public-facing CVE-2021-42535 · Other software · VISAM · reported by ics-cert@hq.dhs.govMedium 5.3
VISAM VBASE version 11.6.0.6 does not neutralize or incorrectly neutralizes user-controllable input before the data is placed in output used as a public-facing webpage.
- Product
- VBASE Pro-RT/ Server-RT (Web Remote)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2022The connection establishment algorithm found in Rockwell Automation CompactLogix 5370 and ControlLogix 5570 versions 33 and prior does not sufficiently manage iCVE-2020-6998 · Other software · Rockwell Automation · reported by ics-cert@hq.dhs.govMedium 5.8
The connection establishment algorithm found in Rockwell Automation CompactLogix 5370 and ControlLogix 5570 versions 33 and prior does not sufficiently manage its control flow during execution, creating an infinite loop. This may allow an attacker to send specially crafted CIP packet requests to a controller, which may cause denial-of-service conditions in communications with other products.
- Product
- Armor Compact GuardLogix 5370 controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.custhelp.comcisa.gov
Jul 27, 2022Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a reflCVE-2022-36922 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a reflected cross-site scripting (XSS) vulnerability.
- Product
- Jenkins Lucene-Search Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022Jenkins Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read CVE-2022-36918 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
- Product
- Jenkins Buckminster Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/ReadCVE-2022-36915 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents.
- Product
- Jenkins Android Signing Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022Jenkins Files Found Trigger Plugin 1.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with OverallCVE-2022-36914 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Files Found Trigger Plugin 1.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
- Product
- Jenkins Files Found Trigger Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackers with Overall/Read pCVE-2022-36913 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
- Product
- Jenkins Openstack Heat Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read pCVE-2022-36910 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them.
- Product
- Jenkins Lucene-Search Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact veCVE-2022-36905 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Maven Metadata Plugin for Jenkins CI server Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with OverCVE-2022-36904 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
- Product
- Jenkins Repository Connector Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulting in a stored croCVE-2022-36902 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Dynamic Extended Choice Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control CVE-2022-36900 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.2
Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control agent processes to retrieve Java system properties.
- Product
- Jenkins Compuware zAdviser API Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to contrCVE-2022-36899 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.2
Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control agent processes to retrieve Java system properties.
- Product
- Jenkins Compuware ISPW Operations Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022Jenkins rpmsign-plugin Plugin 0.5.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read CVE-2022-36893 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins rpmsign-plugin Plugin 0.5.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents.
- Product
- Jenkins rpmsign-plugin Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022Jenkins rhnpush-plugin Plugin 0.5.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read CVE-2022-36892 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins rhnpush-plugin Plugin 0.5.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents.
- Product
- Jenkins rhnpush-plugin Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers wCVE-2022-36890 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
- Product
- Jenkins Deployer Framework Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowinCVE-2022-36889 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.
- Product
- Jenkins Deployer Framework Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle CVE-2022-36881 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.1
Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.
- Product
- Jenkins Git client Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 26, 2022The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the deCVE-2021-33057 · Other software · Tencent · reported by MITREHigh 7.5
The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the device's physical location. An attacker can use qq.createMapContext to create a MapContext object, use MapContext.moveToLocation to move the center of the map to the device's location, and use MapContext.getCenterLocation to get the latitude and longitude of the current map center.
- Product
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a pCVE-2022-30706 · Other software · Twinkle Toes Software · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
- Product
- Booked
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpbookedscheduler.com
Jul 25, 2022A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header.CVE-2021-40336 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comMedium 5
A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into the user’s web browser, such as to steal the session cookies. Thus, an attacker who successfully makes an MSM user who has already established a session to MSM web interface clicks a forged link to the MSM web interface, e.g., the link is sent per E-Mail, could trick the user into downloading malicious software onto his computer. This issue affects: Hitachi Energy MSM V2.2 and prior versions.
- Product
- MSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jul 25, 2022A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionaCVE-2021-40335 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comMedium 5
A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery (CSRF), which if exploited could lead an attacker to gain unauthorized access to the web application and perform an unwanted operation on it without the knowledge of the legitimate user. An attacker, who successfully makes an MSM user who has already established a session to MSM web interface clicks a forged link to the MSM web interface, e.g., link is sent per E-Mail, could perform harmful command on MSM through its web server interface. This issue affects: Hitachi Energy MSM V2.2 and prior versions.
- Product
- MSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jul 25, 2022Simple Page Transition: Does not sanitise and escape some of its settingsCVE-2022-2341 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Page Transition WordPress plugin through 1.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Page Transition
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Simple Page Transition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 25, 2022W-DALIL: Does not sanitise and escape some of its fieldsCVE-2022-2340 · WordPress plugins & themes · reported by WPScanMedium 4.8
The W-DALIL WordPress plugin through 2.0 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- W-DALIL
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update W-DALIL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 25, 2022Allow SVG Files: Does not sanitise uploaded SVG filesCVE-2022-2299 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads
- Product
- Allow SVG Files
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Allow SVG Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 25, 2022Request a Quote: Does not validate uploaded CSV filesCVE-2022-2240 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it
- Product
- Request a Quote
- Affected
- up to 2.3.7
- What to do
- Affects up to 2.3.7. Update Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 25, 2022Request a Quote: Does not sanitise and escape some of its settingsCVE-2022-2239 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Request a Quote
- Fixed in
- 2.3.9
- What to do
- Update Request a Quote to 2.3.9 or newer.
Jul 25, 2022Unyson: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2219 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Unyson WordPress plugin before 2.7.27 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Unyson
- Fixed in
- 2.7.27
- What to do
- Update Unyson to 2.7.27 or newer.
Jul 25, 2022WP Video Lightbox: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2022-2189 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- WP Video Lightbox
- Fixed in
- 1.9.5
- What to do
- Update WP Video Lightbox to 1.9.5 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.