Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,571 results · page 138 of 392
Jul 11, 2022WP-Paginate: Does not escape one of its settingsCVE-2022-2050 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP-Paginate WordPress plugin before 2.1.9 does not escape one of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- WP-Paginate
- Fixed in
- 2.1.9
- What to do
- Update WP-Paginate to 2.1.9 or newer.
Jul 11, 2022Comment License: Does not have CSRF check in placeCVE-2022-1957 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Comment License
- Fixed in
- 1.4.0
- What to do
- Update Comment License to 1.4.0 or newer.
Jul 11, 2022Shortcut Macros: Does not have authorisation and CSRF checks in placeCVE-2022-1956 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which could allow any authenticated users, such as subscriber, to update them.
- Product
- Shortcut Macros
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Shortcut Macros to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2022core plugin for kitestudio: Does not sanitise and escape some parameters before outputting them back in a response of an AJAX actionCVE-2022-1951 · WordPress plugins & themes · reported by WPScanMedium 6.1
The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected Cross-Site Scripting.
- Product
- core plugin for kitestudio
- Fixed in
- 2.3.1
- What to do
- Update core plugin for kitestudio to 2.3.1 or newer.
Jul 11, 2022Awin Data Feed: Does not sanitise and escape a headerCVE-2022-1938 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a header when processing request to generate analytics data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against a logged in admin viewing the plugin's settings
- Product
- Awin Data Feed
- Fixed in
- 1.8
- What to do
- Update Awin Data Feed to 1.8 or newer.
Jul 11, 2022Awin Data Feed: Does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1937 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting
- Product
- Awin Data Feed
- Fixed in
- 1.8
- What to do
- Update Awin Data Feed to 1.8 or newer.
Jul 11, 2022Shortcodes and extra features for Phlox: Does not sanitise and escape a parameter before outputting it back in the responseCVE-2022-1910 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting
- Product
- Shortcodes and extra features for Phlox
- Fixed in
- 2.9.8
- What to do
- Update Shortcodes and extra features for Phlox to 2.9.8 or newer.
Jul 11, 2022Popup Builder: Does not escape and sanitize some settingsCVE-2022-1894 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Builder WordPress plugin before 4.1.11 does not escape and sanitize some settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltred_html is disallowed
- Product
- Popup Builder
- Fixed in
- 4.1.11
- What to do
- Update Popup Builder to 4.1.11 or newer.
Jul 11, 2022pagebar: Does not have CSRF check in placeCVE-2022-1757 · WordPress plugins & themes · reported by WPScanMedium 5.4
The pagebar WordPress plugin before 2.70 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of sanitisation in some of them, it could also lead to Stored XSS issues
- Product
- pagebar
- Fixed in
- 2.70
- What to do
- Update pagebar to 2.70 or newer.
Jul 11, 2022Rename wp-login.php: Does not have CSRF check in placeCVE-2022-1732 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Rename wp-login.php
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Rename wp-login.php to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2022Sharebar: Does not have CSRF check in placeCVE-2022-1626 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sharebar WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and also lead to Stored Cross-Site Scripting issue due to the lack of sanitisation and escaping in some of them
- Product
- Sharebar
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Sharebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2022Admin Management Xtended: Does not have CSRF checks in some of its AJAX actionsCVE-2022-1599 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status (draft, published), slug, post date, comment status (enabled, disabled) and more.
- Product
- Admin Management Xtended
- Fixed in
- 2.4.5
- What to do
- Update Admin Management Xtended to 2.4.5 or newer.
Jul 11, 2022WooCommerce - Product Importer: Does not sanitise and escape the imported data before outputting it back in the pageCVE-2022-1546 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce - Product Importer WordPress plugin through 1.5.2 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- WooCommerce - Product Importer
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update WooCommerce - Product Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2022WP Event Manager: Does not sanitise and escape its search before outputting it back in an attribute on the event dashboardCVE-2022-1474 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Event Manager WordPress plugin before 3.1.28 does not sanitise and escape its search before outputting it back in an attribute on the event dashboard, leading to a Reflected Cross-Site Scripting
- Product
- WP Event Manager
- Fixed in
- 3.1.28
- What to do
- Update WP Event Manager to 3.1.28 or newer.
Jul 11, 2022FoxyShop: Does not sanitise and escape a parameter before outputting it back in an admin pageCVE-2022-1220 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FoxyShop WordPress plugin before 4.8.2 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- FoxyShop
- Fixed in
- 4.8.2
- What to do
- Update FoxyShop to 4.8.2 or newer.
Jul 11, 2022Pricing Deals for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1057 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
- Product
- Pricing Deals for WooCommerce
- Affected
- up to 2.0.2.02
- What to do
- Affects up to 2.0.2.02. Update Pricing Deals for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2022Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command).CVE-2022-32294 · Email & office · Zimbra · reported by MITRECritical 9.8
Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartext on port UDP 514 (aka the syslog port). NOTE: a third party reports that this cannot be reproduced.
- Product
- Collaboration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2022Digital Guardian Agent 7.7.4.0042 allows an administrator (who ordinarily does not have a supported way to uninstall the product) to disable some of the agent fCVE-2022-35412 · Other software · Digitalguardian · reported by MITREMedium 5.1
Digital Guardian Agent 7.7.4.0042 allows an administrator (who ordinarily does not have a supported way to uninstall the product) to disable some of the agent functionality and then exfiltrate files to an external USB device.
- Product
- Digital Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtenforums.com
Jul 7, 2022In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in caseCVE-2022-2191 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgHigh 7.5
In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.
- Product
- Eclipse Jetty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Jul 7, 2022When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.CVE-2022-32208 · Other software · Siemens · reported by support@hackerone.comMedium 5.9
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jul 6, 2022Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF.CVE-2022-32533 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue
- Product
- Apache Portals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Jul 4, 2022Gallery: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1946 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
- Product
- Gallery
- Fixed in
- 2.0.0
- What to do
- Update Gallery to 2.0.0 or newer.
Jul 4, 2022WP Contact Slider: Does not sanitize and escape the Text to Display settings of slidersCVE-2022-1301 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow high privileged users such as editor and above to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- WP Contact Slider
- Fixed in
- 2.4.7
- What to do
- Update WP Contact Slider to 2.4.7 or newer.
Jul 4, 2022Redirection for Contact Form 7: Does not escape a link generated before outputting it in an attributeCVE-2022-0250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting
- Product
- Redirection for Contact Form 7
- Fixed in
- 2.5.0
- What to do
- Update Redirection for Contact Form 7 to 2.5.0 or newer.
Jul 4, 2022Ninja Forms Contact Form: Does not sanitize and escape some imported dataCVE-2021-25066 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.10
- What to do
- Update Ninja Forms Contact Form to 3.6.10 or newer.
Jul 4, 2022Ninja Forms Contact Form: Does not sanitise and escape field labelsCVE-2021-25056 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.10
- What to do
- Update Ninja Forms Contact Form to 3.6.10 or newer.
Jun 30, 2022PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances.CVE-2022-23725 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comHigh 7.7
PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances.
- Product
- PingID Windows Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.compingidentity.com
Jun 30, 2022PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file.CVE-2022-23720 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comHigh 7.5
PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID Windows Login user endpoints. Using sensitive full permissions properties file outside of a privileged trust boundary leads to an increased risk of exposure or discovery, and an attacker could leverage these credentials to perform administrative actions against PingID APIs or endpoints.
- Product
- PingID Windows Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.compingidentity.com
Jun 30, 2022PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests.CVE-2022-23719 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comHigh 7.2
PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java service using multiple attack vectors. A successful attack can lead to code executed as SYSTEM by the PingID Windows Login application, or even a denial of service for offline security key authentication.
- Product
- PingID Windows Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.compingidentity.com
Jun 30, 2022Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/CVE-2022-34818 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/Read permission to disable jobs.
- Product
- Jenkins Failed Job Deactivator Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/ReaCVE-2022-34814 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration page listing pending requests.
- Product
- Jenkins Request Rename Or Delete Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permiCVE-2022-34798 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials.
- Product
- Jenkins Deployment Dashboard Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stored cross-site scriCVE-2022-34795 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
- Product
- Jenkins Deployment Dashboard Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2022-34793 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Product
- Jenkins Recipe Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scriCVE-2022-34791 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Validating Email Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scripting (XSS) vulneraCVE-2022-34790 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins eXtreme Feedback Panel Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability explCVE-2022-34788 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.
- Product
- Jenkins Matrix Reloaded Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting (XSS) vulCVE-2022-34787 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control the reason a queue item is blocked.
- Product
- Jenkins Project Inheritance Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting (XSS)CVE-2022-34786 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
- Product
- Jenkins Rich Text Publisher Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to oCVE-2022-34785 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them.
- Product
- Jenkins build-metrics Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploCVE-2022-34784 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Build/Update permission.
- Product
- Jenkins build-metrics Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackerCVE-2022-34783 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Plot Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-CVE-2022-34777 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins GitLab Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022ApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and is susceptible to an open redirector attack.CVE-2020-26877 · Other software · Apifest · reported by MITREMedium 6.1
ApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and is susceptible to an open redirector attack. Specifically, it directly sends an authorization code to the redirect URI submitted with the authorization request, without checking whether the redirect URI is registered by the client who initiated the request. This allows an attacker to craft a request with a manipulated redirect URI (redirect_uri parameter), which is under the attacker's control, and consequently obtain the leaked authorization code when the server redirects the client to the manipulated redirect URI with an authorization code. NOTE: this is similar to CVE-2019-3778.
- Product
- Oauth 2.0 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022DCMTK through 3.6.6 does not handle memory free properly.CVE-2021-41690 · Other software · Offis · reported by MITREHigh 7.5
DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sending specific requests to the dcmqrdb program can incur a memory leak. An attacker can use it to launch a DoS attack.
- Product
- Dcmtk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022DCMTK through 3.6.6 does not handle string copy properly.CVE-2021-41689 · Other software · dcmtk · reported by MITREHigh 7.5
DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack.
- Product
- dcmtk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022DCMTK through 3.6.6 does not handle memory free properly.CVE-2021-41688 · Other software · Offis · reported by MITREHigh 7.5
DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still used in other locations. Sending specific requests to the dcmqrdb program will incur a double free. An attacker can use it to launch a DoS attack.
- Product
- Dcmtk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022DCMTK through 3.6.6 does not handle memory free properly.CVE-2021-41687 · Other software · Offis · reported by MITREHigh 7.5
DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker can use it to launch a DoS attack.
- Product
- Dcmtk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters.CVE-2022-2140 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govHigh 8.8
Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters.
- Product
- SmartICS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attackCVE-2022-2106 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govLow 3.8
Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attacks and specify arbitrary files.
- Product
- SmartICS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.