Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,282 results · page 14 of 26
May 15, 2023An issue in the dfe_qexp_list component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.CVE-2023-31612 · Other software · Openlinksw · reported by MITREHigh 7.5
An issue in the dfe_qexp_list component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- Product
- Virtuoso
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023An issue in the __libc_longjmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.CVE-2023-31611 · Other software · Openlinksw · reported by MITREHigh 7.5
An issue in the __libc_longjmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- Product
- Virtuoso
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023An issue in the _IO_default_xsputn component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statemenCVE-2023-31610 · Other software · Openlinksw · reported by MITREHigh 7.5
An issue in the _IO_default_xsputn component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- Product
- Virtuoso
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023An issue in the dfe_unit_col_loci component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statementCVE-2023-31609 · Other software · Openlinksw · reported by MITREHigh 7.5
An issue in the dfe_unit_col_loci component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- Product
- Virtuoso
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023An issue in the artm_div_int component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.CVE-2023-31608 · Other software · Openlinksw · reported by MITREHigh 7.5
An issue in the artm_div_int component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- Product
- Virtuoso
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023An issue in the __libc_malloc component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.CVE-2023-31607 · Other software · Openlinksw · reported by MITREHigh 7.5
An issue in the __libc_malloc component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- Product
- Virtuoso
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2023The parameters nutzer_titel, nutzer_vn, and nutzer_nn in the user profile, and langID and ONLINEID in direct links, in evasys before 8.2 Build 2286 and 9.x befoCVE-2023-31434 · Other software · Evasys · reported by MITREMedium 5.4
The parameters nutzer_titel, nutzer_vn, and nutzer_nn in the user profile, and langID and ONLINEID in direct links, in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 do not validate input, which allows authenticated attackers to inject HTML Code and XSS payloads in multiple locations.
- Product
- Evasys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute page.CVE-2022-38841 · Network & remote access · Linksys · reported by MITREHigh 8.8
Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute page.
- Product
- E8450 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdrive.google.com
Apr 11, 2023The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a CVE-2023-29112 · Network & remote access · SAP · reported by cna@sap.comLow 3.7
The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.
- Product
- Application Interface Framework (Message Monitoring)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Apr 10, 2023SilverwareGames.io versions before 1.2.19 allow users with access to the game upload panel to edit download links for games uploaded by other developers.CVE-2023-29192 · Other software · mesosoi · reported by GitHubLow 2.7
SilverwareGames.io versions before 1.2.19 allow users with access to the game upload panel to edit download links for games uploaded by other developers. This has been fixed in version 1.2.19.
- Product
- silverwaregames-io-issue-tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023Directory Traversal vulnerability found in B3log Wide allows a an attacker to escalate privileges via symbolic links.CVE-2020-19279 · Other software · Wide Project · reported by MITRECritical 9.8
Directory Traversal vulnerability found in B3log Wide allows a an attacker to escalate privileges via symbolic links.
- Product
- Wide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments.CVE-2022-47502 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.8
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution.
- Product
- Apache OpenOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Mar 14, 2023KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevatCVE-2023-28144 · Other software · Kdab · reported by MITREHigh 7
KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevate_perf_privileges.sh chown calls.
- Product
- Hotspot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
Mar 13, 2023Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3.0.2 versions.CVE-2023-25973 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3.0.2 versions.
- Affected
- up to 6.3.0.2
- What to do
- Affects up to 6.3.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 27, 2023A validation issue existed in the handling of symlinks.CVE-2022-22582 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in Security Update 2022-003 Catalina, macOS Big Sur 11.6.5, macOS Monterey 12.3. A local user may be able to write arbitrary files.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Feb 21, 2023Easy Affiliate Links: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embeddedCVE-2023-0375 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Affiliate Links WordPress plugin before 3.7.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Easy Affiliate Links
- Fixed in
- 3.7.1
- What to do
- Update Easy Affiliate Links to 3.7.1 or newer.
Jan 16, 2023A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symbolic links on external storage media.CVE-2022-45440 · Network & remote access · Zyxel · reported by security@zyxel.com.twMedium 4.4
A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symbolic links on external storage media. A local authenticated attacker with administrator privileges could abuse this vulnerability to access the root file system by creating a symbolic link on external storage media, such as a USB flash drive, and then logging into the FTP server on a vulnerable device.
- Product
- AX7501-B0 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023ImageLinks Interactive Image Builder for: Does not sanitise and escape some of its settingsCVE-2022-4393 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ImageLinks Interactive Image Builder for WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- ImageLinks Interactive Image Builder for
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update ImageLinks Interactive Image Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023An arbitrary code execution vulnerability exisits in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006.CVE-2022-43973 · Network & remote access · Linksys · reported by trellixpsirt@trellix.comHigh 7.2
An arbitrary code execution vulnerability exisits in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. The Check_TSSI function within the httpd binary uses unvalidated user input in the construction of a system command. An authenticated attacker with administrator privileges can leverage this vulnerability over the network via a malicious POST request to /apply.cgi to execute arbitrary commands on the underlying Linux operating system as root.
- Product
- WRT54GL Wireless-G Broadband Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023A null pointer dereference vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006.CVE-2022-43972 · Network & remote access · Linksys · reported by trellixpsirt@trellix.comMedium 6.5
A null pointer dereference vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. A null pointer dereference in the soap_action function within the upnp binary can be triggered by an unauthenticated attacker via a malicious POST request invoking the AddPortMapping action.
- Product
- WRT54GL Wireless-G Broadband Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023An arbitrary code exection vulnerability exists in Linksys WUMC710 Wireless-AC Universal Media Connector with firmware <= 1.0.02 (build3).CVE-2022-43971 · Network & remote access · Linksys · reported by trellixpsirt@trellix.comHigh 7.2
An arbitrary code exection vulnerability exists in Linksys WUMC710 Wireless-AC Universal Media Connector with firmware <= 1.0.02 (build3). The do_setNTP function within the httpd binary uses unvalidated user input in the construction of a system command. An authenticated attacker with administrator privileges can leverage this vulnerability over the network via a malicious GET or POST request to /setNTP.cgi to execute arbitrary commands on the underlying Linux operating system as root.
- Product
- Linksys WUMC710 Wireless-AC Universal Media Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023A buffer overflow vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006.CVE-2022-43970 · Network & remote access · Linksys · reported by trellixpsirt@trellix.comHigh 7.2
A buffer overflow vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. A stack-based buffer overflow in the Start_EPI function within the httpd binary allows an authenticated attacker with administrator privileges to execute arbitrary commands on the underlying Linux operating system as root. This vulnerablity can be triggered over the network via a malicious POST request to /apply.cgi.
- Product
- WRT54GL Wireless-G Broadband Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2023SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks.CVE-2022-36943 · Other software · ZipArchive · reported by cve-assign@fb.comHigh 8.1
SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item.
- Product
- SSZipArchive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored cCVE-2022-45380 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins JUnit Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Nov 14, 2022Update description and links DMA transactions which are targeted at input buffers used for the software SMI handler used by the FvbServicesRuntimeDxe driver couCVE-2022-31243 · Other software · Insyde · reported by MITREMedium 6.4
Update description and links DMA transactions which are targeted at input buffers used for the software SMI handler used by the FvbServicesRuntimeDxe driver could cause SMRAM corruption through a TOCTOU attack.. "DMA transactions which are targeted at input buffers used for the software SMI handler used by the FvbServicesRuntimeDxe driver could cause SMRAM corruption. This issue was discovered by Insyde engineering based on the general description provided by Intel's iSTARE group. Fixed in Kernel 5.2: 05.27.21. Kernel 5.3: 05.36.21. Kernel 5.4: 05.44.21. Kernel 5.5: 05.52.21 https://www.insyde.com/security-pledge/SA-2022044
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.cominsyde.com
Nov 1, 2022This issue was addressed with improved validation of symlinks.CVE-2022-32905 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted DMG file may lead to arbitrary code execution with system privileges.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Oct 19, 2022Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in buildCVE-2022-43409 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Pipelines.
- Product
- Jenkins Pipeline: Supporting APIs Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 10, 2022Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links.CVE-2022-42725 · Computers, phones & browsers · Linuxmint · reported by MITREHigh 7.5
Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links.
- Product
- Warpinator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Sep 26, 2022SEO Smart Links: Does not sanitise and escape some of its settingsCVE-2022-3135 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SEO Smart Links
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update SEO Smart Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 16, 2022HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to CVE-2021-42948 · Other software · Digitaldruid · reported by MITRELow 3.7
HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's.
- Product
- Hoteldruid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to code reuse), the /SysInfo.htm URI does noCVE-2022-35572 · Network & remote access · Linksys · reported by MITREHigh 7.5
On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to code reuse), the /SysInfo.htm URI does not require a session ID. This web page calls a show_sysinfo function which retrieves WPA passwords, SSIDs, MAC Addresses, serial numbers, WPS Pins, and hardware/firmware versions, and prints this information into the web page. This web page is visible when remote management is enabled. A user who has access to the web interface of the device can extract these secrets. If the device has remote management enabled and is connected directly to the internet, this vulnerability is exploitable over the internet without interaction.
- Product
- E5350 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2022A vulnerability in the messaging interface of Cisco Webex App, formerly Webex Teams, could allow an unauthenticated, remote attacker to manipulate links or otheCVE-2022-20863 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the messaging interface of Cisco Webex App, formerly Webex Teams, could allow an unauthenticated, remote attacker to manipulate links or other content within the messaging interface. This vulnerability exists because the affected software does not properly handle character rendering. An attacker could exploit this vulnerability by sending messages within the application interface. A successful exploit could allow the attacker to modify the display of links or other content within the interface, potentially allowing the attacker to conduct phishing or spoofing attacks.
- Product
- Cisco Webex Meetings Desktop App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Aug 31, 2022Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow a denial-of-service condition.CVE-2022-2898 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govMedium 6.1
Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow a denial-of-service condition.
- Product
- ScadaPro Server and Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow privilege escalation..CVE-2022-2897 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govHigh 7.8
Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow privilege escalation..
- Product
- ScadaPro Server and Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2022Linksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej_get_web_page_name.CVE-2022-38555 · Network & remote access · Linksys · reported by MITRECritical 9.8
Linksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej_get_web_page_name.
- Product
- E1200 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateWanLinkspyMulti.CVE-2022-37072 · Other software · H3c · reported by MITRECritical 9.8
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateWanLinkspyMulti.
- Product
- Gr-1200w Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2022The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the hostCVE-2022-34960 · Network & remote access · Mikrotik · reported by MITRECritical 9.8
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the host device. This allows the attacker to mount any arbitrary file to any location on the host.
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service.CVE-2022-38132 · Network & remote access · Linksys · reported by info@cybellum.comHigh 8.2
Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router's web interface can execute arbitrary OS commands. The username and password fields are not sanitized correctly and are used as URL construction arguments, allowing URL redirection to an arbitrary server, downloading an arbitrary script file, and eventually executing the file in the device. This issue affects: Linksys MR8300 Router 1.0.
- Product
- MR8300 Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloads.linksys.comdownloads.linksys.com
Aug 22, 2022Auto-hyperlink URLs: Does not set rel="noopener noreferer" on generated linksCVE-2022-2600 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener DOM object.
- Product
- Auto-hyperlink URLs
- Affected
- up to 5.4.1
- What to do
- Affects up to 5.4.1. Update Auto-hyperlink URLs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 7, 2022In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses.CVE-2021-44791 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.
- Product
- Apache Druid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jun 27, 2022Mihdan: No External Links: Does not sanitise and escape some of its settingsCVE-2022-1095 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mihdan: No External Links WordPress plugin before 5.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Mihdan: No External Links
- Fixed in
- 5.0.2
- What to do
- Update Mihdan: No External Links to 5.0.2 or newer.
Jun 20, 2022Amazon Einzeltitellinks: Does not have CSRF check in placeCVE-2022-1830 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- Amazon Einzeltitellinks
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Amazon Einzeltitellinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Ocean Extra: Does not escape generated linksCVE-2021-25104 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue
- Product
- Ocean Extra
- Fixed in
- 1.9.5
- What to do
- Update Ocean Extra to 1.9.5 or newer.
Jun 13, 2022RB Internal Links: Does not have CSRF check in placeCVE-2022-1759 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, as well as perform Stored Cross-Site Scripting attacks due to the lack of sanitisation and escaping
- Product
- RB Internal Links
- Affected
- up to 2.0.16
- What to do
- Affects up to 2.0.16. Update RB Internal Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 12, 2022Deno <=1.14.0 file sandbox does not handle symbolic links correctly.CVE-2021-41641 · Other software · Deno · reported by MITREHigh 8.4
Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory.
- Product
- Deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackers.report
May 30, 2022External Links in New Window / New Tab: Does not ensure windowCVE-2022-1583 · WordPress plugins & themes · reported by WPScanMedium 6.5
The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur.
- Product
- External Links in New Window / New Tab
- Fixed in
- 1.43
- What to do
- Update External Links in New Window / New Tab to 1.43 or newer.
May 30, 2022External Links in New Window / New Tab: Does not properly escape URLs it concatenates to onclick event handlersCVE-2022-1582 · WordPress plugins & themes · reported by WPScanMedium 6.1
The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible.
- Product
- External Links in New Window / New Tab
- Fixed in
- 1.43
- What to do
- Update External Links in New Window / New Tab to 1.43 or newer.
May 26, 2022A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks.CVE-2022-26704 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.4. An app may be able to gain elevated privileges.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
May 26, 2022An issue in the handling of symlinks was addressed with improved validation.CVE-2022-26688 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.4
An issue in the handling of symlinks was addressed with improved validation. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A malicious app with root privileges may be able to modify the contents of system files.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Links/del.CVE-2022-29681 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Links/del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.