Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
981 results · page 14 of 20
Jun 14, 2023A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be exCVE-2023-0010 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 5.4
A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.
- Product
- PAN-OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comsecurity.paloaltonetworks.com
Jun 14, 2023 A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentiCVE-2023-3001 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.8
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file.
- Product
- IGSS Dashboard (DashBoard.exe)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jun 9, 2023Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to the GET request afteCVE-2023-29713 · Other software · Vadesecure · reported by MITREMedium 6.1
Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to the GET request after the /css/ directory.
- Product
- Secure Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfo.vadesecure.comlabs.yarix.com
Jun 9, 2023Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to the X-Rewrite-URL paCVE-2023-29712 · Other software · Vadesecure · reported by MITREMedium 6.1
Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to the X-Rewrite-URL parameter.
- Product
- Secure Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfo.vadesecure.comlabs.yarix.com
May 31, 2023A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload injeCVE-2023-33736 · Other software · Dcatadmin · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.
- Product
- Dcat Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2023A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into CVE-2023-33751 · Other software · Mipjz Project · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter at /app/tag/controller/ApiAdminTagCategory.php.
- Product
- Mipjz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2023A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into CVE-2023-33750 · Other software · Mipjz Project · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description parameter at /index.php?s=/article/ApiAdminArticle/itemAdd.
- Product
- Mipjz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2023The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can result in an out-of-bCVE-2023-23306 · Other software · Garmin · reported by MITRECritical 9.8
The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can result in an out-of-bounds write operation. A malicious application could create a specially crafted `Toybox.Ant.BurstPayload` object, call its `add` method, override arbitrary memory and hijack the execution of the device's firmware.
- Product
- Connect-iq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.garmin.comgithub.com
May 16, 2023A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload iCVE-2023-31544 · Other software · Alkacon · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module.
- Product
- Opencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections via a crafted payload.CVE-2023-29819 · Other software · Webroot · reported by MITREMedium 5.5
An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections via a crafted payload.
- Product
- Secureanywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspenceralessi.comspenceralessi.com
May 9, 2023Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes CVE-2023-31807 · Other software · Chamilo · reported by MITREMedium 5.4
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes function.
- Product
- Chamilo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.chamilo.orgsupport.chamilo.org
May 9, 2023Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress funCVE-2023-31806 · Other software · Chamilo · reported by MITREMedium 5.4
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress function.
- Product
- Chamilo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.chamilo.orgsupport.chamilo.org
May 9, 2023Sngrep v1.6.0 was discovered to contain a stack buffer overflow via the function packet_set_payload at /src/packet.c.CVE-2023-31981 · Other software · Irontec · reported by MITREHigh 7.8
Sngrep v1.6.0 was discovered to contain a stack buffer overflow via the function packet_set_payload at /src/packet.c.
- Product
- Sngrep
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2023A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected iCVE-2023-30094 · Other software · Totaljs · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module.
- Product
- Flow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comedoardoottavianelli.it
May 4, 2023A stored cross-site scripting (XSS) vulnerability in Typecho v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected intCVE-2023-30184 · Other software · Typecho · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Typecho v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter at /index.php/archives/1/comment.
- Product
- Typecho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2023An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload.CVE-2023-30331 · Other software · Beetl Project · reported by MITRECritical 9.8
An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload.
- Product
- Beetl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2023A stored cross-site scripting (XSS) vulnerability in DouPHP v1.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into tCVE-2023-30205 · Other software · Douphp · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in DouPHP v1.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the unique_id parameter in /admin/article.php.
- Product
- Douphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload iCVE-2023-30338 · Other software · Emlog · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Article Title or Article Summary parameters.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Payload is a free and open source headless content management system.CVE-2023-30843 · Other software · payloadcms · reported by GitHubHigh 7.4
Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the CCVE-2022-27979 · Other software · Tooljet · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component.
- Product
- Tooljet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023A cross-site scripting (XSS) vulnerability in Pear-Admin-Boot up to v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2023-30417 · Other software · Pearadmin · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Pear-Admin-Boot up to v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title of a private message.
- Product
- Pear Admin Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023A stored HTML injection vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary code via a crafted payload.CVE-2023-27775 · Other software · Liveaction · reported by MITREMedium 5.4
A stored HTML injection vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary code via a crafted payload.
- Product
- Livesp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected inCVE-2023-26847 · Other software · Opencats · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the state parameter at opencats/index.php?m=candidates.
- Product
- Opencats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopencats.org
Apr 11, 2023A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected inCVE-2023-26846 · Other software · Opencats · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the city parameter at opencats/index.php?m=candidates.
- Product
- Opencats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopencats.org
Apr 4, 2023Cross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login parameter.CVE-2023-27089 · Other software · Ehuacui-bbs Project · reported by MITREHigh 8.2
Cross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login parameter.
- Product
- Ehuacui-bbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023Cross Site Scripting vulnerability found in ZblogCN ZblogPHP v.1.0 allows a local attacker to execute arbitrary code via a crafted payload in title parameter ofCVE-2020-23327 · Other software · Zblogcn · reported by MITREMedium 6.1
Cross Site Scripting vulnerability found in ZblogCN ZblogPHP v.1.0 allows a local attacker to execute arbitrary code via a crafted payload in title parameter of the module management model.
- Product
- Zblogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023A cross-site scripting (XSS) vulnerability in File Management Project 1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injeCVE-2023-27245 · Other software · File Management System Project · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in File Management Project 1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Edit User module.
- Product
- File Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023A cross-site scripting (XSS) vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadCVE-2023-27054 · Other software · Mirotalk · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the settings module.
- Product
- Mirotalk P2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.CVE-2022-45003 · Other software · Getgophish · reported by MITREHigh 7.5
Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.
- Product
- Gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compastebin.com
Mar 21, 2023A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentiaCVE-2023-27978 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.8
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
- Product
- IGSS Data Server(IGSSdataServer.exe)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Mar 13, 2023OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload.CVE-2023-25279 · Other software · Dlink · reported by MITRECritical 9.8
OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload.
- Product
- Dir-820l Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Memory corruption in WLAN HAL while arbitrary value is passed in WMI UTF command payload.CVE-2022-25655 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Memory corruption in WLAN HAL while arbitrary value is passed in WMI UTF command payload.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Feb 21, 2023Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length.CVE-2023-23009 · Other software · Libreswan · reported by MITREMedium 6.5
Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length.
- Product
- Libreswan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Feb 17, 2023A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URCVE-2023-24369 · Other software · Ujcms · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter under the Add New Articles function.
- Product
- Ujcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into thCVE-2023-22975 · Other software · Jflyfox · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html.
- Product
- Jfinal CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a crafted payload injeCVE-2022-47872 · Other software · Maccms · reported by MITREHigh 8.8
A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a crafted payload injected into the Name parameter under the Interface address module.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2023In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.CVE-2022-4898 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.4
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was taken to prevent the possibility of the support link being susceptible to XSS
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Jan 27, 2023Improper File Permissions in NetScout nGeniusONE 6.3.2 build 904 allows authenticated remote users to gain permissions via a crafted payload.CVE-2022-44715 · Other software · Netscout · reported by MITREHigh 8.8
Improper File Permissions in NetScout nGeniusONE 6.3.2 build 904 allows authenticated remote users to gain permissions via a crafted payload.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Jan 20, 2023In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.CVE-2023-24026 · Other software · Misp-project · reported by MITREMedium 6.1
In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023Multiple cross-site scripting (XSS) vulnerabilities in ReQlogic v11.3 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected inCVE-2022-41441 · Other software · Reqlogic · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in ReQlogic v11.3 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the POBatch and WaitDuration parameters.
- Product
- Reqlogic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comokankurtulus.com.tr
Jan 17, 2023Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not validate the length of RTLS report payloads during commCVE-2022-41989 · Other software · Sewio · reported by ics-cert@hq.dhs.govCritical 9
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not validate the length of RTLS report payloads during communication. This allows an attacker to send an exceedingly long payload, resulting in an out-of-bounds write to cause a denial-of-service condition or code execution.
- Product
- RTLS Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2023A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injCVE-2022-46622 · Other software · Judging Management System Project · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter.
- Product
- Judging Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2023A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadCVE-2022-44870 · Other software · Maccms · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the AD Management module.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded.CVE-2022-38653 · Other software · HCL Software · reported by psirt@hcl.comLow 2
In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded.
- Product
- HCL Digital Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 15, 2022A cross-site scripting (XSS) vulnerability in Expense Tracker 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into CVE-2022-45033 · Other software · Oretnom23 · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Expense Tracker 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Chat text field.
- Product
- Expense Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.CVE-2022-34297 · Other software · Yiiframework · reported by MITREMedium 5.4
Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.
- Product
- GII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 6, 2022Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website.CVE-2022-43363 · Other software · Telegram · reported by MITREMedium 6.1
Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. NOTE: some third parties have been unable to discern any relationship between the Pastebin information and a possible XSS finding.
- Product
- Telegram
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.telegram.orgpastebin.com
Nov 25, 2022PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in CVE-2022-37721 · Other software · Pyrocms · reported by MITRECritical 9
PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation.
- Product
- Pyrocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.integrity.ptlabs.integrity.pt
Nov 23, 2022A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads.CVE-2022-41875 · Other software · airbnb · reported by GitHubCritical 10
A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially crafted JSON payloads may lead to RCE (remote code execution) on the attacked system running Optica. The vulnerability was patched in v. 0.10.2, where the call to the function `oj.load` was changed to `oj.safe_load`.
- Product
- optica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and getCVE-2022-38145 · Other software · Silverstripe · reported by MITREMedium 5.4
Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and get it executed in the versioned history compare view.
- Product
- Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.silverstripe.orgsilverstripe.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.