Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,482 results · page 15 of 30
Jul 11, 2022IBM SiteProtector Appliance 3.1.1 allows web pages to be stored locally which can be read by another user on the system.CVE-2020-4138 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM SiteProtector Appliance 3.1.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174049.
- Product
- Security SiteProtector System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 5, 2022Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappings.CVE-2022-33744 · Computers, phones & browsers · Linux · reported by security@xen.orgMedium 4.7
Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the related lock held, resulting in a small race window, which can be used by unprivileged guests via PV devices to cause inconsistencies of the rbtree. These inconsistencies can lead to Denial of Service (DoS) of dom0, e.g. by causing crashes or the inability to perform further mappings of other guests' memory pages.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comxenbits.xen.org
Jun 27, 2022Nested Pages: Does not escape and sanitize the some of its settingsCVE-2022-1990 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nested Pages WordPress plugin before 3.1.21 does not escape and sanitize the some of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltered_html is disallowed
- Product
- Nested Pages
- Fixed in
- 3.1.21
- What to do
- Update Nested Pages to 3.1.21 or newer.
Jun 27, 2022Social Share Buttons by Supsystic: Does not perform CSRF checks in it's ajax endpoints and admin pagesCVE-2022-1653 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker to trick any logged in user to manipulate or change the plugin settings, as well as create, delete and rename projects and networks.
- Product
- Social Share Buttons by Supsystic
- Fixed in
- 2.2.4
- What to do
- Update Social Share Buttons by Supsystic to 2.2.4 or newer.
Jun 24, 2022IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 allows web pages to be stored locally which can be read by another user on the system.CVE-2021-20551 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 199149.
- Product
- Jazz Team Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 14, 2022ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/pages/ajax.render.php.CVE-2022-31403 · Other software · Combodo · reported by MITREMedium 6.1
ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/pages/ajax.render.php.
- Product
- Itop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Jun 13, 2022Newsletter: Does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pagesCVE-2022-1756 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.
- Product
- Newsletter
- Fixed in
- 7.4.5
- What to do
- Update Newsletter to 7.4.5 or newer.
Jun 9, 2022x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count.CVE-2022-26362 · Other software · Xen · reported by security@xen.orgMedium 6.4
x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, the logic for acquiring a type reference has a race condition, whereby a safely TLB flush is issued too early and creates a window where the guest can re-establish the read/write mapping before writeability is prohibited.
- Product
- xen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Jun 8, 2022CP Image Store with Slideshow: Does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embedCVE-2022-1692 · WordPress plugins & themes · reported by WPScanCritical 9.8
The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack
- Product
- CP Image Store with Slideshow
- Fixed in
- 1.0.68
- What to do
- Update CP Image Store with Slideshow to 1.0.68 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 6, 2022FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections.CVE-2021-42245 · Other software · Flatcore · reported by MITREMedium 6.1
FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections.
- Product
- Flatcore-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2022In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages (displayed by Internet Explorer core).CVE-2022-32269 · Other software · Realnetworks · reported by MITRECritical 9.8
In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages (displayed by Internet Explorer core). This leads to arbitrary code execution.
- Product
- Realplayer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\pages\sections_save.php namesection2 parameters.CVE-2022-30072 · Other software · Wbce · reported by MITREMedium 5.4
WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\pages\sections_save.php namesection2 parameters.
- Product
- Wbce CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2022Gmedia Photo Gallery: Does not sanitise and escape the Album's name before outputting it in pages/posts with a media embedCVE-2022-0873 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed
- Product
- Gmedia Photo Gallery
- Fixed in
- 1.20.0
- What to do
- Update Gmedia Photo Gallery to 1.20.0 or newer.
May 5, 2022A vulnerability exists where an IBM Robotic Process Automation 21.0.1 regular user is able to obtain view-only access to some admin pages in the Control Center CVE-2022-22415 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
A vulnerability exists where an IBM Robotic Process Automation 21.0.1 regular user is able to obtain view-only access to some admin pages in the Control Center IBM X-Force ID: 223029.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 3, 2022The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that theCVE-2021-22556 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 5.3
The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don’t own, allowing them to control kernel memory from userspace. We recommend upgrading to kernel version 4.1 or beyond.
- Product
- Fuchsia Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfuchsia-review.googlesource.comfuchsia.dev
May 3, 2022A stored cross-site scripting (XSS) vulnerability in Pixelimity 1.0 allows attackers to execute arbitrary web scripts or HTML via the Title field in admin/pagesCVE-2022-28589 · Other software · Pixelimity · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in Pixelimity 1.0 allows attackers to execute arbitrary web scripts or HTML via the Title field in admin/pages.php?action=add_new
- Product
- Pixelimity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2022The Private Domains extension for MediaWiki through 1.37.2 (before 1ad65d4c1c199b375ea80988d99ab51ae068f766) allows CSRF for editing pages that store the extensCVE-2022-29903 · Other software · Mediawiki · reported by MITREMedium 4.3
The Private Domains extension for MediaWiki through 1.37.2 (before 1ad65d4c1c199b375ea80988d99ab51ae068f766) allows CSRF for editing pages that store the extension's configuration. The attacker must trigger a POST request to Special:PrivateDomains.
- Product
- Mediawiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Apr 22, 2022IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should not have access to.CVE-2021-38905 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should not have access to. IBM X-Force ID: 209697.
- Product
- Cognos Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comsecurity.netapp.com
Apr 20, 2022There is no limit to the number of attempts to authenticate for the local configuration pages for the Hills ComNav Version 3002-19 interface, which allows localCVE-2022-26519 · Other software · Interlogix · reported by ics-cert@hq.dhs.govMedium 5.5
There is no limit to the number of attempts to authenticate for the local configuration pages for the Hills ComNav Version 3002-19 interface, which allows local attackers to brute-force credentials.
- Product
- Hills ComNav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorporate.carrier.comcorporate.carrier.com
Apr 19, 2022Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Navigation Pages, Portal, Query).CVE-2022-21458 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Navigation Pages, Portal, Query). Supported versions that are affected are 8.58 and 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- PeopleSoft Enterprise PT PeopleTools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2022Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Navigation Pages, Portal, Query).CVE-2022-21456 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Navigation Pages, Portal, Query). Supported versions that are affected are 8.58 and 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- PeopleSoft Enterprise PT PeopleTools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2022Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection.CVE-2022-1019 · Other software · Automated Logic · reported by ics-cert@hq.dhs.govMedium 5.2
Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to send a maliciously crafted URL which could result in redirecting the user to a malicious webpage or downloading a malicious file.
- Product
- WebCtrl Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorporate.carrier.comcorporate.carrier.com
Apr 18, 2022PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files.CVE-2022-24859 · Other software · py-pdf · reported by GitHubMedium 6.2
PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.
- Product
- PyPDF2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2022Ad Injection: Does not properly sanitize the body of the adverts injected into the pagesCVE-2022-0661 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set.
- Product
- Ad Injection
- Affected
- up to 1.2.0.19
- What to do
- Affects up to 1.2.0.19. Update Ad Injection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2022Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media).CVE-2022-23976 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media).
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 12, 2022A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages.CVE-2022-26589 · Other software · Pluck-cms · reported by MITREMedium 6.5
A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages.
- Product
- Pluck
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_pages.phpCVE-2022-28032 · Other software · Thedigitalcraft · reported by MITRECritical 9.8
AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_pages.php
- Product
- Atomcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9CVE-2022-1148 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to steal a user's access token on an attacker-controlled private GitLab Pages website and reuse that token on the victim's other private websites
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an aCVE-2022-1121 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to cause unlimited resource consumption.
- Product
- GitLab Pages
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Insights from Google PageSpeed: Does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboardCVE-2022-0431 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting
- Product
- Insights from Google PageSpeed
- Fixed in
- 4.0.4
- What to do
- Update Insights from Google PageSpeed to 4.0.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 31, 2022A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config, and (2) index.php pages.CVE-2021-42867 · Other software · Htmly · reported by MITREMedium 4.8
A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config, and (2) index.php pages.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2022Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages parameter.CVE-2022-26646 · Other software · Oretnom23 · reported by MITRECritical 9.8
Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages parameter.
- Product
- Banking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2022In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication.CVE-2021-46009 · Other software · Totolink · reported by MITRECritical 9.8
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without cookies.
- Product
- A3100r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022Pz-LinkCard: Does not sanitise and escape multiple parameters before outputting them back in admin dashboard pagesCVE-2021-25012 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues
- Product
- Pz-LinkCard
- Affected
- up to 2.4.4.4
- What to do
- Affects up to 2.4.4.4. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2022Multiple Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) vulnerabilities discovered in AMP for WP – Accelerated Mobile Pages WordPress pluCVE-2021-23209 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Multiple Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) vulnerabilities discovered in AMP for WP – Accelerated Mobile Pages WordPress plugin (versions <= 1.0.77.32).
- Affected
- up to 1.0.77.32
- What to do
- Affects up to 1.0.77.32. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 18, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 versions.CVE-2021-23150 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 versions.
- Affected
- up to 1.0.77.31
- What to do
- Affects up to 1.0.77.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 18, 2022A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06 that coulCVE-2020-25197 · Other software · GE · reported by ics-cert@hq.dhs.govCritical 9.8
A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06 that could allow an authenticated remote attacker to execute arbitrary code on the system.
- Product
- Reason RT43X Clocks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govgegridsolutions.com
Mar 14, 2022sysend.js is a library that allows a user to send messages between pages that are open in the same browser.CVE-2022-24762 · Other software · jcubic · reported by GitHubMedium 6.5
sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same browser. This issue has been patched in sysend.js version 1.10.0. The only currently known workaround is to avoid sending communications that a user does not want to have intercepted via sysend messages.
- Product
- sysend.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Flexi: Does not sanitise and escape various parameters before outputting them back in some pages suchCVE-2022-0449 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Flexi
- Fixed in
- 4.20
- What to do
- Update Flexi to 4.20 or newer.
Mar 11, 2022A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.CVE-2021-44667 · Other software · Alibaba · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.
- Product
- Nacos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2022An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users.CVE-2022-24349 · Other software · Zabbix · reported by security@zabbix.comMedium 4.6
An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.
- Product
- Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.debian.org
Mar 9, 2022Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks.CVE-2022-22511 · Other software · WAGO · reported by info@cert.vde.comMedium 5.4
Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been compromised.
- Product
- Compact Controller CC100 (751-9301)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Mar 1, 2022ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR).CVE-2022-24718 · Other software · Finastra · reported by GitHubHigh 7.6
ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.4, a path traversal issue can occur when providing untrusted input to the `svg` property as an argument to the `build(MessagePageOptions)` function. While there is no known workaround at this time, there is a patch in version 0.1.4.
- Product
- ssr-pages
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2022ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR).CVE-2022-24717 · Other software · Finastra · reported by GitHubMedium 6.1
ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.5, a cross site scripting (XSS) issue can occur when providing untrusted input to the `redirect.link` property as an argument to the `build(MessagePageOptions)` function. While there is no known workaround at this time, there is a patch in version 0.1.5.
- Product
- ssr-pages
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.CVE-2022-25018 · Other software · Pluxml · reported by MITREHigh 8.8
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022WP User: Does not sanitise and escape some parameters in pages where the [wp_user] shortcode is usedCVE-2021-25034 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading to Reflected Cross-Site Scripting issues
- Product
- WP User
- Fixed in
- 7.0
- What to do
- Update WP User to 7.0 or newer.
Feb 19, 2022WikiDocs version 0.1.18 has multiple reflected XSS vulnerabilities on different pages.CVE-2022-23376 · Other software · Wikidocs · reported by MITREMedium 6.1
WikiDocs version 0.1.18 has multiple reflected XSS vulnerabilities on different pages.
- Product
- Wikidocs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddemo.wikidocs.itgithub.com
Feb 17, 2022A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site.CVE-2021-41599 · Other software · GitHub · reported by product-cna@github.comHigh 8.8
A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.0.21, 3.1.13, 3.2.5. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Feb 14, 2022Custom Popup Builder: Autoload data from its popup on every pagesCVE-2022-0214 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog
- Product
- Custom Popup Builder
- Fixed in
- 1.3.1
- What to do
- Update Custom Popup Builder to 1.3.1 or newer.
Feb 14, 2022Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themiCVE-2022-0200 · WordPress plugins & themes · reported by WPScanMedium 5.4
Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
- Fixed in
- 1.1.7
- What to do
- Update the plugin to 1.1.7 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.