Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,620 results · page 17 of 33
Oct 14, 2022Reader.Read does not set a limit on the maximum size of file headers.CVE-2022-2879 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
- Product
- archive/tar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py.CVE-2022-42902 · Other software · Linaro · reported by MITREHigh 8.8
In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server.
- Product
- Lava
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.lavasoftware.orggit.lavasoftware.org
Oct 11, 2022The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-41383 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
- Product
- D8s-archives
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022IBM Common Cryptographic Architecture (CCA 5.x MTM for 4767 and CCA 7.x MTM for 4769) could allow a local user to cause a denial of service due to improper inpuCVE-2022-22423 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM Common Cryptographic Architecture (CCA 5.x MTM for 4767 and CCA 7.x MTM for 4769) could allow a local user to cause a denial of service due to improper input validation. IBM X-Force ID: 223596.
- Product
- CCA for MTM 4767
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 19, 2022The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38881 · Other software · D8s-archives Project · reported by MITRECritical 9.8
The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
- Product
- D8s-archives
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/apply.CVE-2022-38539 · Other software · Archerydms · reported by MITRECritical 9.8
Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/apply.
- Product
- Archery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordannouncements.bybit.comgithub.com
Aug 23, 2022An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of thCVE-2021-31566 · Other software · Libarchive · reported by Red HatHigh 7.8
An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.
- Product
- Libarchive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 23, 2022An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link.CVE-2021-23177 · Other software · Libarchive · reported by Red HatHigh 7.8
An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to change the ACL of a file on the system and gain more privileges.
- Product
- Libarchive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 12, 2022In HierarchicalUri.readFrom of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation.CVE-2022-20338 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In HierarchicalUri.readFrom of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This could lead to a local escalation of privilege, preventing processes from validating URIs correctly, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-171966843
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Aug 10, 2022Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archivCVE-2022-30631 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.
- Product
- compress/gzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that useCVE-2021-46778 · Other software · AMD · reported by psirt@amd.comMedium 5.6
Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that use simultaneous multithreading (SMT). By measuring the contention level on scheduler queues an attacker may potentially leak sensitive information.
- Product
- AMD Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2022All versions of package git-archive are vulnerable to Command Injection via the exports function.CVE-2020-28422 · Other software · Git-archive Project · reported by report@snyk.ioMedium 6.4
All versions of package git-archive are vulnerable to Command Injection via the exports function.
- Product
- Git-archive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.snyk.iosecurity.snyk.io
Jul 12, 2022Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.CVE-2022-29900 · Other software · AMD · reported by psirt@amd.comMedium 6.5
Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.
- Product
- AMD Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Jul 8, 2022mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process.CVE-2022-35410 · Other software · 0xacab · reported by MITREHigh 7.5
mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process. This primarily affects mat2 web instances, in which clients could obtain sensitive information via a crafted archive.
- Product
- Mat2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2022File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-2CVE-2021-29281 · Other software · GFI · reported by MITRECritical 9.8
File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-2014-2217, and CVE-2017-11317.
- Product
- Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaminbohio.comcwe.mitre.org
Jun 23, 2022Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller CVE-2022-34177 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.
- Product
- Jenkins Pipeline: Input Step Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouCVE-2022-1665 · Other software · Redhat · reported by Red HatHigh 8.2
A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing the attacker to load another non-trusted code.
- Product
- Enterprise Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Jun 15, 2022Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure vCVE-2022-21125 · Other software · Siemens · reported by secure@intel.comMedium 5.5
Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comxenbits.xen.org
Jun 13, 2022Biscuit is an authentication and authorization token for microservices architectures.CVE-2022-31053 · Other software · biscuit-auth · reported by GitHubCritical 9.8
Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. There are no known workarounds for this issue.
- Product
- biscuit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeprint.iacr.orggithub.com
Jun 2, 2022libjpeg 1.63 has a heap-based buffer over-read in HierarchicalBitmapRequester::FetchRegion in hierarchicalbitmaprequester.cpp because the MCU size can be differCVE-2022-31796 · Other software · Jpeg · reported by MITREMedium 6.5
libjpeg 1.63 has a heap-based buffer over-read in HierarchicalBitmapRequester::FetchRegion in hierarchicalbitmaprequester.cpp because the MCU size can be different between allocation and use.
- Product
- Libjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerabiCVE-2022-1664 · Other software · Debian · reported by security@debian.orgCritical 9.8
Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.
- Product
- dpkg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.dpkg.orggit.dpkg.org
May 25, 2022In Archibus Web Central before 26.2, multiple SQL Injection vulnerabilities occur in dwr/call/plaincall/workflow.runWorkflowRule.dwr.CVE-2022-28862 · Other software · Archibus · reported by MITRECritical 9.8
In Archibus Web Central before 26.2, multiple SQL Injection vulnerabilities occur in dwr/call/plaincall/workflow.runWorkflowRule.dwr. Through the injection of arbitrary SQL statements, a potential attacker can modify query syntax and perform unauthorized (and unexpected) operations against the remote database. This is fixed in all recent versions, such as version 26.2.
- Product
- Web Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.ittelecomitalia.com
May 25, 2022In Apache Archiva, any registered user can reset password for any users.CVE-2022-29405 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
- Product
- Apache Archiva
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchiva.apache.orgarchiva.apache.org
May 1, 2022All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crCVE-2022-25842 · Other software · Alibabagroup · reported by report@snyk.ioMedium 6.9
All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). The attacker can overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine.
- Product
- One-java-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2022A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation.CVE-2021-26629 · Other software · tobesoft Co.,Ltd · reported by vuln@krcert.or.krHigh 8.8
A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .xzip archive file is decompressed, an arbitrary file can be d in the parent path by using the path traversal pattern ‘..\’.
- Product
- XPLATFORM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Apr 18, 2022SearchIQ: Contains a flag to disable the verification of CSRF noncesCVE-2022-0780 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SearchIQ WordPress plugin before 3.9 contains a flag to disable the verification of CSRF nonces, granting unauthenticated attackers access to the siq_ajax AJAX action and allowing them to perform Cross-Site Scripting attacks due to the lack of sanitisation and escaping in the customCss parameter
- Product
- SearchIQ
- Fixed in
- 3.9
- What to do
- Update SearchIQ to 3.9 or newer.
Apr 12, 2022An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to which access should be rCVE-2022-27669 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.5
An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to which access should be restricted. This may result in an escalation of privileges.
- Product
- SAP NetWeaver Application Server for Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Apr 12, 2022SQL injection vulnerability in Topics Searching feature of Roothub 2.6.0 allows unauthorized attackers to execute arbitrary SQL commands via the "s" parameter rCVE-2022-27473 · Other software · Roothub Project · reported by MITRECritical 9.8
SQL injection vulnerability in Topics Searching feature of Roothub 2.6.0 allows unauthorized attackers to execute arbitrary SQL commands via the "s" parameter remotely.
- Product
- Roothub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures.CVE-2022-24815 · Other software · jhipster · reported by GitHubHigh 8.1
JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures. SQL Injection vulnerability in entities for applications generated with the option "reactive with Spring WebFlux" enabled and an SQL database using r2dbc. Applications created without "reactive with Spring WebFlux" and applications with NoSQL databases are not affected. Users who have generated a microservice Gateway using the affected version may be impacted as Gateways are reactive by default. Currently, SQL injection is possible in the findAllBy(Pageable pageable, Criteria criteria) method of an entity repository class generated in these applications as the where clause using Criteria for queries are not sanitized and user input is passed on as it is by the criteria. This issue has been patched in v7.8.1. Users unable to upgrade should be careful when combining criterias and conditions as the root of the issue lies in the `EntityManager.java` class when creating the where clause via `Conditions.just(criteria.toString())`. `just` accepts the literal string provided. Criteria's `toString` method returns a plain string and this combination is vulnerable to
- Product
- generator-jhipster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated userCVE-2022-0919 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who booked it.
- Fixed in
- 7.6.3
- What to do
- Update the plugin to 7.6.3 or newer.
Mar 28, 2022Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.CVE-2022-26280 · Other software · Libarchive · reported by MITREMedium 6.5
Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.
- Product
- Libarchive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Mar 28, 2022An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary upladedCVE-2021-43099 · Other software · Diyhi · reported by MITREMedium 4.9
An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary upladed zip file without checking filenames. The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe).
- Product
- BBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2022Rockwell Automation Connected Components Workbench v12.00.00 and prior does not sanitize paths specified within the .ccwarc archive file during extraction.CVE-2021-27473 · Other software · Rockwell Automation · reported by ics-cert@hq.dhs.govMedium 6.1
Rockwell Automation Connected Components Workbench v12.00.00 and prior does not sanitize paths specified within the .ccwarc archive file during extraction. This type of vulnerability is also commonly referred to as a Zip Slip. A local, authenticated attacker can create a malicious .ccwarc archive file that, when opened by Connected Components Workbench, will allow the attacker to gain the privileges of the software. If the software is running at SYSTEM level, the attacker will gain admin level privileges. User interaction is required for this exploit to be successful.
- Product
- Connected Components Workbench
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.custhelp.comcisa.gov
Mar 23, 2022A deserialization vulnerability exists in how the ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serializCVE-2021-27466 · Other software · Rockwell Automation · reported by ics-cert@hq.dhs.govCritical 10
A deserialization vulnerability exists in how the ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.
- Product
- FactoryTalk AssetCentre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordidp.rockwellautomation.comcisa.gov
Mar 23, 2022The ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication.CVE-2021-27464 · Other software · Rockwell Automation · reported by ics-cert@hq.dhs.govCritical 10
The ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements.
- Product
- FactoryTalk AssetCentre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordidp.rockwellautomation.comcisa.gov
Mar 17, 2022Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacker to read any documents via the downloadCVE-2021-46107 · Other software · Ligeo-archives · reported by MITREHigh 7.5
Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacker to read any documents via the download features.
- Product
- Ligeo Basics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordowasp.orgraw.githubusercontent.com
Mar 16, 2022Cross-site Scripting (XSS) vulnerability in ArchivistaBox webclient allows an attacker to craft a malicious link, executing JavaScript in the context of a victiCVE-2021-42552 · Other software · Archivista GmbH · reported by vulnerability@ncsc.chMedium 6.1
Cross-site Scripting (XSS) vulnerability in ArchivistaBox webclient allows an attacker to craft a malicious link, executing JavaScript in the context of a victim's browser. This issue affects all ArchivistaBox versions prior to 2022/I.
- Product
- ArchivistaBox webclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Bareos is open source software for backup, archiving, and recovery of data for operating systems.CVE-2022-24756 · Other software · bareos · reported by GitHubHigh 7.5
Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, a failed PAM authentication will leak a small amount of memory. An attacker that is able to use the PAM Console (i.e. by knowing the shared secret or via the WebUI) can flood the Director with failing login attempts which will eventually lead to an out-of-memory condition in which the Director will not work anymore. Bareos Director versions 21.1.0, 20.0.6 and 19.2.12 contain a Bugfix for this problem. Users who are unable to upgrade may disable PAM authentication as a workaround.
- Product
- bareos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Bareos is open source software for backup, archiving, and recovery of data for operating systems.CVE-2022-24755 · Other software · bareos · reported by GitHubHigh 8.1
Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, it will skip authorization checks completely. Expired accounts and accounts with expired passwords can still login. This problem will affect users that have PAM enabled. Currently there is no authorization (e.g. check for expired or disabled accounts), but only plain authentication (i.e. check if username and password match). Bareos Director versions 21.1.0, 20.0.6 and 19.2.12 implement the authorization check that was previously missing. The only workaround is to make sure that authentication fails if the user is not authorized.
- Product
- bareos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration.CVE-2022-22141 · Other software · Yokogawa Electric Corporation · reported by vultures@jpcert.or.jpHigh 7.8
'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.
- Product
- CENTUM CS 3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb-material3.yokogawa.comweb-material3.yokogawa.com
Mar 10, 2022NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams.CVE-2022-26652 · Computers, phones & browsers · Linuxfoundation · reported by MITREMedium 6.5
NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.
- Product
- Nats-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comadvisories.nats.io
Mar 10, 2022SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive.CVE-2022-26100 · Network & remote access · SAP SE · reported by cna@sap.comCritical 9.8
SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive. As a result, the SAPCAR process may crash, and the attacker may obtain privileged access to the system.
- Product
- SAPCAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddam.sap.comlaunchpad.support.sap.com
Mar 6, 2022Open Redirect in GitHub repository archivy/archivy prior to 1.7.0.CVE-2022-0697 · Other software · archivy · reported by security@huntr.devMedium 6.1
Open Redirect in GitHub repository archivy/archivy prior to 1.7.0.
- Product
- archivy/archivy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2022An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code vCVE-2022-24254 · Other software · Extensis · reported by MITREHigh 8.8
An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file.
- Product
- Portfolio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsnyk.iowhiteoaksecurity.com
Feb 10, 2022A vulnerability in the audit log of Cisco DNA Center could allow an authenticated, local attacker to view sensitive information in clear text.CVE-2022-20630 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.4
A vulnerability in the audit log of Cisco DNA Center could allow an authenticated, local attacker to view sensitive information in clear text. This vulnerability is due to the unsecured logging of sensitive information on an affected system. An attacker with administrative privileges could exploit this vulnerability by accessing the audit logs through the CLI. A successful exploit could allow the attacker to retrieve sensitive information that includes user credentials.
- Product
- Cisco Digital Network Architecture Center (DNA Center)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Feb 9, 2022Out of bounds read under complex microarchitectural condition in memory subsystem for some Intel Atom(R) Processors may allow authenticated user to potentially CVE-2021-33120 · Other software · Intel · reported by secure@intel.comMedium 5.4
Out of bounds read under complex microarchitectural condition in memory subsystem for some Intel Atom(R) Processors may allow authenticated user to potentially enable information disclosure or cause denial of service via network access.
- Product
- Atom P5942b Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022update_code in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive.CVE-2022-24676 · Other software · Hyphp · reported by MITREHigh 8.8
update_code in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive.
- Product
- Hybbs2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously.CVE-2022-23627 · Other software · JustArchiNET · reported by GitHubMedium 5
ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced in version V5.2.2.2, the program didn't adequately verify effective access of the user sending proxy (i.e. `[Bots]`) commands. In particular, a proxy-like command sent to bot `A` targeting bot `B` has incorrectly verified user's access against bot `A` - instead of bot `B`, to which the command was originally designated. This in result allowed access to resources beyond those configured, being a security threat affecting confidentiality of other bot instances. A successful attack exploiting this bug requires a significant access granted explicitly by original owner of the ASF process prior to that, as attacker has to control at least a single bot in the process to make use of this inadequate access verification loophole. The issue is patched in ASF V5.2.2.5, V5.2.3.2 and future versions. Users are advised to update as soon as possible.
- Product
- ArchiSteamFarm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attackers to execute arbitrCVE-2022-24262 · Other software · Voipmonitor · reported by MITREHigh 8.8
The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attackers to execute arbitrary commands via a crafted file in the web root.
- Product
- Voipmonitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkerbit.iovoipmonitor.org
Feb 1, 2022Junrar is an open source java RAR archive library.CVE-2022-23596 · Other software · Junrar Project · reported by GitHubHigh 7.5
Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.
- Product
- Junrar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.