Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,454 results · page 14 of 30
Sep 11, 2023QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.bloCVE-2023-42467 · Other software · Qemu · reported by MITREMedium 5.5
QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately.
- Product
- Qemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2023An issue was discovered with ImageMagick 7.1.0-4 via Division by zero in function ReadEnhMetaFile of coders/emf.c.CVE-2021-40211 · Other software · Imagemagick · reported by MITREHigh 7.5
An issue was discovered with ImageMagick 7.1.0-4 via Division by zero in function ReadEnhMetaFile of coders/emf.c.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023In decideCancelProvisioningDialog of AdminIntegratedFlowPrepareActivity.java, there is a possible way to bypass factory reset protections due to a logic error iCVE-2023-21275 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In decideCancelProvisioningDialog of AdminIntegratedFlowPrepareActivity.java, there is a possible way to bypass factory reset protections due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Aug 10, 2023Incorrect default permissions in some Intel(R) SDP Tool software before version 1.4 build 5 may allow an authenticated user to potentially enable escalation of CVE-2023-31246 · Other software · Intel · reported by secure@intel.comMedium 6.7
Incorrect default permissions in some Intel(R) SDP Tool software before version 1.4 build 5 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Server Debug And Provisioning Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2023 A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.CVE-2023-20588 · Other software · AMD · reported by psirt@amd.comMedium 5.5
A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.
- Product
- EPYC™ 7001 Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jul 24, 2023 Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage.CVE-2023-22428 · Other software · Gallagher · reported by disclosures@gallagher.comHigh 7.6
Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage. This issue affects Command Centre: vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), vEL8.60 prior to vEL8.60.2347 (MR6), vEL8.50 prior to vEL8.50.2831(MR8), vEL8.40 and prior.
- Product
- Command Centre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.comsecurity.gallagher.com
Jul 19, 2023In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.CVE-2023-3638 · Other software · GeoVision · reported by ics-cert@hq.dhs.govCritical 9.8
In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.
- Product
- GV-ADR2701
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023Vulnerability in Oracle Essbase (component: Security and Provisioning).CVE-2023-22010 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 2.2
Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.4.3.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).
- Product
- Hyperion Essbase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023The vulnerability could be locally exploited to allow escalation of privilege.CVE-2023-30906 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.5
The vulnerability could be locally exploited to allow escalation of privilege.
- Product
- HPE Intelligent Provisioning (IP) for Gen9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Jul 13, 2023Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encodedCVE-2023-2003 · Other software · Unitronics · reported by cve-coordination@incibe.esCritical 9.1
Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encoded malicious code in the device's data tables via the PCOM protocol, which can then be retrieved by a client and executed on the device.
- Product
- Vision1210
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackplayers.comincibe.es
Jul 7, 2023Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function.CVE-2021-32494 · Other software · radare2 · reported by patrick@puiterwijk.orgCritical 10
Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. This allow attackers to create malicious inputs that can cause denial of service.
- Product
- radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2023Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagVerifyProvisioning integer overflow and resultant buffer overflow.CVE-2022-48335 · Other software · Widevine · reported by MITRECritical 9.8
Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagVerifyProvisioning integer overflow and resultant buffer overflow.
- Product
- Trusted Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberintel.escyberintel.es
Jun 23, 2023AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFoCVE-2023-35165 · Other software · aws · reported by GitHubMedium 6.6
AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages `aws-cdk-lib` 2.0.0 until 2.80.0 and `@aws-cdk/aws-eks` 1.57.0 until 1.202.0, `eks.Cluster` and `eks.FargateCluster` constructs create two roles, `CreationRole` and `default MastersRole`, that have an overly permissive trust policy. The first, referred to as the `CreationRole`, is used by lambda handlers to create the cluster and deploy Kubernetes resources (e.g `KubernetesManifest`, `HelmChart`, ...) onto it. Users with CDK version higher or equal to 1.62.0 (including v2 users) may be affected. The second, referred to as the `default MastersRole`, is provisioned only if the `mastersRole` property isn't provided and has permissions to execute `kubectl` commands on the cluster. Users with CDK version higher or equal to 1.57.0 (including v2 users) may be affected. The issue has been fixed in `@aws-cdk/aws-eks` v1.202.0 and `aws-cdk-lib` v2.80.0. These versions no longer use the account root principal. Instead, they restrict the trust policy to the specific roles of lambda handlers that need it. T
- Product
- aws-cdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2023Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities.CVE-2023-28810 · Network & remote access · hikvision · reported by hsrc@hikvision.comMedium 4.3
Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify device network configuration by sending specific data packets to the vulnerable interface within the same local network.
- Product
- DS-K1T804AXX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhikvision.comhikvision.com
Jun 15, 2023Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in.CVE-2023-28809 · Network & remote access · hikvision · reported by hsrc@hikvision.comHigh 7.5
Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user.
- Product
- DS-K1T804AXX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comhikvision.com
Jun 13, 2023On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with networCVE-2023-24546 · Other software · Arista · reported by psirt@arista.comHigh 8.1
On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to CloudVision to get broader access to telemetry and configuration data within the system than intended. This advisory impacts the Arista CloudVision Portal product when run on-premise. It does not impact CloudVision as-a-Service.
- Product
- Cloudvision Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Command Injection due to improper sanitization of special characters for the NAS storage test function.CVE-2023-31996 · Other software · Hanwhavision · reported by MITREHigh 8.8
Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Command Injection due to improper sanitization of special characters for the NAS storage test function.
- Product
- Ane-l6012r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhanwhavisionamerica.comhanwhavision.com
May 22, 2023Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Cross Site Scripting (XSS).CVE-2023-31995 · Other software · Hanwhavision · reported by MITREMedium 5.4
Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Cross Site Scripting (XSS).
- Product
- Ane-l6012r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhanwhavisionamerica.comhanwhavision.com
May 22, 2023Certain Hanwha products are vulnerable to Denial of Service (DoS).CVE-2023-31994 · Other software · Hanwhavision · reported by MITREMedium 5.3
Certain Hanwha products are vulnerable to Denial of Service (DoS). ck vector is: When an empty UDP packet is sent to the listening service, the service thread results in a non-functional service (DoS) via WS Discovery and Hanwha proprietary discovery services. This affects IP Camera ANE-L7012R 1.41.01 and IP Camera XNV-9082R 2.10.02.
- Product
- Ane-l6012r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhanwhavisionamerica.comhanwhavision.com
May 10, 2023An issue was found in Genesys CIC Polycom phone provisioning TFTP Server all version allows a remote attacker to execute arbitrary code via the login crednetialCVE-2023-29930 · Other software · Genesys · reported by MITREHigh 8.8
An issue was found in Genesys CIC Polycom phone provisioning TFTP Server all version allows a remote attacker to execute arbitrary code via the login crednetials to the TFTP server configuration page.
- Product
- Tftp Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhelp.genesys.com
May 4, 2023An issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for windows, which contains improper permissions within the default installation and alloCVE-2023-23059 · Other software · Geovision · reported by MITRECritical 9.8
An issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for windows, which contains improper permissions within the default installation and allows attackers to execute arbitrary code and gain escalated privileges.
- Product
- Gv-edge Recording Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
May 3, 2023 When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh.CVE-2023-28742 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.2
When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2023Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending any frames.CVE-2022-33281 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending any frames.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Apr 26, 2023Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes.CVE-2023-30841 · Other software · metal3-io · reported by GitHubMedium 6
Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.
- Product
- baremetal-operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Drupal 9.3 implemented a generic entity access API for entity revisions.CVE-2022-25274 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.4
Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual items of node and media content. This vulnerability only affects sites using Drupal's revision system.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023Git is a revision control system.CVE-2023-29007 · Other software · git · reported by GitHubHigh 7
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.
- Product
- git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023Git is a revision control system.CVE-2023-25652 · Other software · git · reported by GitHubHigh 7.5
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists.
- Product
- git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Apr 21, 2023NVIDIA CUDA Toolkit for Linux and Windows contains a vulnerability in cuobjdump, where a division-by-zero error may enable a user to cause a crash, which may leCVE-2023-25511 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA Toolkit for Linux and Windows contains a vulnerability in cuobjdump, where a division-by-zero error may enable a user to cause a crash, which may lead to a limited denial of service.
- Product
- NVIDIA CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Apr 18, 2023Vulnerability in Oracle Essbase (component: Security and Provisioning).CVE-2023-21944 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
- Product
- Hyperion Essbase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023Vulnerability in Oracle Essbase (component: Security and Provisioning).CVE-2023-21943 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
- Product
- Hyperion Essbase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023Vulnerability in Oracle Essbase (component: Security and Provisioning).CVE-2023-21942 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
- Product
- Hyperion Essbase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission.CVE-2023-28808 · Network & remote access · hikvision · reported by hsrc@hikvision.comCritical 9.1
Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.
- Product
- DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhikvision.comhikvision.com
Mar 23, 2023A vulnerability in the access point (AP) joining process of the Control and Provisioning of Wireless Access Points (CAPWAP) protocol of Cisco IOS XE Software foCVE-2023-20100 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.8
A vulnerability in the access point (AP) joining process of the Control and Provisioning of Wireless Access Points (CAPWAP) protocol of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error that occurs when certain conditions are met during the AP joining process. An attacker could exploit this vulnerability by adding an AP that is under their control to the network. The attacker then must ensure that the AP successfully joins an affected wireless controller under certain conditions. Additionally, the attacker would need the ability to restart a valid AP that was previously connected to the controller. A successful exploit could allow the attacker to cause the affected device to restart unexpectedly, resulting in a DoS condition.
- Product
- Cisco IOS XE Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Mar 9, 2023Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e.CVE-2023-0623 · Other software · Horner Automation · reported by ics-cert@hq.dhs.govHigh 7.8
Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in writes past the end of allocated data structures. An attacker could leverage these vulnerabilities to execute arbitrary code in the context of the current process.
- Product
- Cscape Envision RV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e.CVE-2023-0622 · Other software · Horner Automation · reported by ics-cert@hq.dhs.govHigh 7.8
Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in writes past the end of allocated data structures. An attacker could leverage these vulnerabilities to execute arbitrary code in the context of the current process.
- Product
- Cscape Envision RV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds read vulnerability when parsing project (i.e.CVE-2023-0621 · Other software · Horner Automation · reported by ics-cert@hq.dhs.govHigh 7.8
Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds read vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in reads past the end of allocated data structures. An attacker could leverage these vulnerabilities to execute arbitrary code in the context of the current process.
- Product
- Cscape Envision RV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023eVision Responsive Column Layout Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0064 · WordPress plugins & themes · reported by WPScanMedium 5.4
The eVision Responsive Column Layout Shortcodes WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- eVision Responsive Column Layout Shortcodes
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update eVision Responsive Column Layout Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26039 · Other software · ZoneMinder · reported by GitHubHigh 7.1
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl() in (/web/api/app/Controller/HostController.php). Any authenticated user can construct an api command to execute any shell command as the web user. This issue is patched in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26038 · Other software · ZoneMinder · reported by GitHubMedium 5.4
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via web/ajax/modal.php, where an arbitrary php file path can be passed in the request and loaded. This issue is patched in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26037 · Other software · ZoneMinder · reported by GitHubHigh 8.9
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an SQL Injection. The minTime and maxTime request parameters are not properly validated and could be used execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26036 · Other software · ZoneMinder · reported by GitHubHigh 8.1
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via /web/index.php. By controlling $view, any local file ending in .php can be executed. This is supposed to be mitigated by calling detaintPath, however dentaintPath does not properly sandbox the path. This can be exploited by constructing paths like "..././", which get replaced by "../". This issue is patched in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26035 · Other software · ZoneMinder · reported by GitHubHigh 7.2
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id. This issue is fixed in This issue is fixed in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26034 · Other software · ZoneMinder · reported by GitHubCritical 9.6
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are affected by a SQL Injection vulnerability. The (blind) SQL Injection vulnerability is present within the `filter[Query][terms][0][attr]` query string parameter of the `/zm/index.php` endpoint. A user with the View or Edit permissions of Events may execute arbitrary SQL. The resulting impact can include unauthorized data access (and modification), authentication and/or authorization bypass, and remote code execution.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26032 · Other software · ZoneMinder · reported by GitHubHigh 8.9
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain SQL Injection via malicious jason web token. The Username field of the JWT token was trusted when performing an SQL query to load the user. If an attacker could determine the HASH key used by ZoneMinder, they could generate a malicious JWT token and use it to execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-25825 · Other software · ZoneMinder · reported by GitHubHigh 7.7
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 are vulnerable to Cross-site Scripting. Log entries can be injected into the database logs, containing a malicious referrer field. This is unescaped when viewing the logs in the web ui. This issue is patched in version 1.36.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Server-side request forgery in the CVAT software maintained by Intel(R) before version 2.0.1 may allow an authenticated user to potentially enable information dCVE-2022-27234 · Other software · Intel · reported by secure@intel.comMedium 4.3
Server-side request forgery in the CVAT software maintained by Intel(R) before version 2.0.1 may allow an authenticated user to potentially enable information disclosure via network access.
- Product
- Computer Vision Annotation Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2023Git for Windows is the Windows port of the revision control system Git.CVE-2023-23618 · Other software · git-for-windows · reported by GitHubHigh 8.6
Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windows, it potentially runs executables from the current directory inadvertently, which can be exploited with some social engineering to trick users into running untrusted code. A patch is available in version 2.39.2. As a workaround, avoid using `gitk` (or Git GUI's "Visualize History" functionality) in clones of untrusted repositories.
- Product
- git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2023Git for Windows is the Windows port of the revision control system Git.CVE-2023-22743 · Other software · git-for-windows · reported by GitHubHigh 7.2
Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a subdirectory of a specific name living next to the Git for Windows installer, Windows can be tricked into side-loading said DLL. This potentially allows users with local write access to place malicious payloads in a location where automated upgrades might run the Git for Windows installer with elevation. Version 2.39.2 contains a patch for this issue. Some workarounds are available. Never leave untrusted files in the Downloads folder or its sub-folders before executing the Git for Windows installer, or move the installer into a different directory before executing it.
- Product
- git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordattack.mitre.orggithub.com
Feb 14, 2023Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.CVE-2023-23946 · Other software · git · reported by GitHubMedium 6.2
Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.
- Product
- git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2023Git is a revision control system.CVE-2023-22490 · Other software · git · reported by GitHubMedium 5.5
Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`. Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it does not contain suspicious module URLs.
- Product
- git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.