Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,397 results · page 17 of 28
May 10, 2022Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityCVE-2022-29141 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 10, 2022Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityCVE-2022-29139 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 10, 2022Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityCVE-2022-29137 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 10, 2022Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityCVE-2022-29131 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 10, 2022Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityCVE-2022-29130 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 10, 2022Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityCVE-2022-29129 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 10, 2022Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityCVE-2022-29128 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 10, 2022Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityCVE-2022-22014 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 10, 2022Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityCVE-2022-22013 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 10, 2022Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityCVE-2022-22012 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 9, 2022A potential security vulnerability has been identified in Integrated Lights-Out 4 (iLO 4).CVE-2022-23704 · Other software · HP · reported by security-alert@hpe.comHigh 7.5
A potential security vulnerability has been identified in Integrated Lights-Out 4 (iLO 4). The vulnerability could allow remote Denial of Service. The vulnerability is resolved in Integrated Lights-Out 4 (iLO 4) 2.80 and later.
- Product
- Integrated Lights-out 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
May 3, 2022A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stoCVE-2022-28599 · Other software · Thedaylightstudio · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger a XSS attack.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2022Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer.CVE-2022-24900 · Other software · onlaj · reported by GitHubCritical 9.9
Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The `os.path.join` call is unsafe for use with untrusted input. When the `os.path.join` call encounters an absolute path, it ignores all the parameters it has encountered till that point and starts working with the new absolute path. Since the "malicious" parameter represents an absolute path, the result of `os.path.join` ignores the static directory completely. Hence, untrusted input is passed via the `os.path.join` call to `flask.send_file` can lead to path traversal attacks. A patch with a fix is available on the `master` branch of the GitHub repository. This can also be fixed by preventing flow of untrusted data to the vulnerable `send_file` function. In case the application logic necessiates this behaviour, one can either use the `flask.safe_join` to join untrusted paths or replace `flask.send_file` calls with `flask.send_from_directory` calls.
- Product
- Piano-LED-Visualizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2022CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.CVE-2022-27985 · Other software · Cuppacms · reported by MITRECritical 9.8
CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcuppacms.com
Apr 15, 2022Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityCVE-2022-26919 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Lightweight Directory Access Protocol (LDAP) Denial of Service VulnerabilityCVE-2022-26831 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022A vulnerability in the data plane microcode of Lightspeed-Plus line cards for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated,CVE-2022-20714 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in the data plane microcode of Lightspeed-Plus line cards for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause the line card to reset. This vulnerability is due to the incorrect handling of malformed packets that are received on the Lightspeed-Plus line cards. An attacker could exploit this vulnerability by sending a crafted IPv4 or IPv6 packet through an affected device. A successful exploit could allow the attacker to cause the Lightspeed-Plus line card to reset, resulting in a denial of service (DoS) condition for any traffic that traverses that line card.
- Product
- Cisco IOS XR Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Apr 11, 2022Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection.CVE-2022-27156 · Other software · Thedaylightstudio · reported by MITREMedium 5.4
Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php.CVE-2022-25485 · Other software · Cuppacms · reported by MITREHigh 7.8
CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Team Circle Image Slider With Lightbox: Does not sanitize and escape the order_pos parameter before outputting it back in an admin pageCVE-2022-0648 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Team Circle Image Slider With Lightbox
- Fixed in
- 1.0.16
- What to do
- Update Team Circle Image Slider With Lightbox to 1.0.16 or newer.
Mar 14, 2022ARI Fancy Lightbox: Does not sanitise and escape the msg parameter before outputting it back in an admin pageCVE-2022-0161 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ARI Fancy Lightbox WordPress plugin before 1.3.9 does not sanitise and escape the msg parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- ARI Fancy Lightbox
- Fixed in
- 1.3.9
- What to do
- Update ARI Fancy Lightbox to 1.3.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 5, 2022Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.CVE-2022-0845 · Other software · pytorchlightning · reported by security@huntr.devCritical 9.8
Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.
- Product
- pytorchlightning/pytorch-lightning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4) firmware version(s): Prior to 2.60.CVE-2022-23701 · Other software · HPE · reported by security-alert@hpe.comMedium 5.3
A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4) firmware version(s): Prior to 2.60. This vulnerability could be remotely exploited to allow an attacker to supply invalid input to the iLO 4 webserver, causing it to respond with a redirect to an attacker-controlled domain. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 4 (iLO 4).
- Product
- Integrated Lights-out
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 24, 2022A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.CVE-2021-44607 · Other software · Thedaylightstudio · reported by MITREMedium 5.4
A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022Prism is a syntax highlighting library.CVE-2022-23647 · Other software · PrismJS · reported by GitHubHigh 7.5
Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted. This bug has been fixed in v1.27.0. As a workaround, do not use the command line plugin on untrusted inputs, or sanitize all code blocks (remove all HTML code text) from all code blocks that use the command line plugin.
- Product
- prism
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog.CVE-2022-23626 · Other software · m1k1o · reported by GitHubHigh 8.5
m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly. Although PHP issued warnings and the upload function returned `false`, the original file (that could contain a malicious payload) was kept on the disk. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
- Product
- blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 1, 2022Nimforum is a lightweight alternative to Discourse written in Nim.CVE-2022-23602 · Other software · Nim-lang · reported by GitHubHigh 7.7
Nimforum is a lightweight alternative to Discourse written in Nim. In versions prior to 2.2.0 any forum user can create a new thread/post with an include referencing a file local to the host operating system. Nimforum will render the file if able. This can also be done silently by using NimForum's post "preview" endpoint. Even if NimForum is running as a non-critical user, the forum.json secrets can be stolen. Version 2.2.0 of NimForum includes patches for this vulnerability. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue.
- Product
- Docutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier): Does not escape the effects parameter before outputting it back in an attribute in an admin pageCVE-2021-25031 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier)
- Fixed in
- 9.7.1
- What to do
- Update Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) to 9.7.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 6, 2022In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -1CVE-2022-22707 · Other software · Lighttpd · reported by MITREMedium 5.9
In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -1), as demonstrated by remote denial of service (daemon crash) in a non-default configuration. The non-default configuration requires handling of the Forwarded header in a somewhat unusual manner. Also, a 32-bit system is much more likely to be affected than a 64-bit system.
- Product
- Lighttpd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredmine.lighttpd.netdebian.org
Dec 23, 2021pytorch-lightning is vulnerable to Deserialization of Untrusted DataCVE-2021-4118 · Other software · pytorchlightning · reported by security@huntr.devHigh 7.8
pytorch-lightning is vulnerable to Deserialization of Untrusted Data
- Product
- pytorchlightning/pytorch-lightning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2021An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specifCVE-2021-34141 · Other software · Numpy · reported by MITREMedium 5.3
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
- Product
- Numpy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2021For certain valid JPEG XL images with a size slightly larger than an integer number of groups (256x256 pixels) when processing the groups out of order the decodCVE-2021-22564 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 4.5
For certain valid JPEG XL images with a size slightly larger than an integer number of groups (256x256 pixels) when processing the groups out of order the decoder can perform an out of bounds copy of image pixels from an image buffer in the heap to another. This copy can occur when processing the right or bottom edges of the image, but only when groups are processed in certain order. Groups can be processed out of order in multi-threaded decoding environments with heavy thread load but also with images that contain the groups in an arbitrary order in the file. It is recommended to upgrade past 0.6.0 or patch with https://github.com/libjxl/libjxl/pull/775
- Product
- libjxl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2021caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.CVE-2011-4119 · Other software · Inria · reported by Red HatCritical 9.8
caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.
- Product
- Caml-light
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgnats.netbsd.orgseclists.org
Oct 18, 2021WordPress PDF Light Viewer: Allows users with Author roles to execute arbitrary OS command on the server via OS Command InjectionCVE-2021-24684 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript.
- Product
- WordPress PDF Light Viewer
- Fixed in
- 1.4.12
- What to do
- Update WordPress PDF Light Viewer to 1.4.12 or newer.
Oct 4, 2021Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure.CVE-2021-41593 · Other software · Lightning Network Daemon Project · reported by MITREHigh 8.6
Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure.
- Product
- Lightning Network Daemon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoinmagazine.comgithub.com
Oct 4, 2021Blockstream c-lightning through 0.10.1 allows loss of funds because of dust HTLC exposure.CVE-2021-41592 · Other software · Elementsproject · reported by MITRECritical 9.4
Blockstream c-lightning through 0.10.1 allows loss of funds because of dust HTLC exposure.
- Product
- C-lightning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoinmagazine.comgithub.com
Sep 29, 2021Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of unchecked prerequisites related to TCP or UDP porCVE-2020-18685 · Websites & servers · Atlassian · reported by MITRECritical 9.8
Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of unchecked prerequisites related to TCP or UDP ports, or group or table IDs.
- Product
- Floodlight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Sep 29, 2021Floodlight through 1.2 has an integer overflow in checkFlow in StaticFlowEntryPusherResource.java via priority or port number.CVE-2020-18684 · Websites & servers · Atlassian · reported by MITRECritical 9.8
Floodlight through 1.2 has an integer overflow in checkFlow in StaticFlowEntryPusherResource.java via priority or port number.
- Product
- Floodlight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Sep 29, 2021Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of undefined fields mishandling.CVE-2020-18683 · Websites & servers · Atlassian · reported by MITRECritical 9.8
Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of undefined fields mishandling.
- Product
- Floodlight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Sep 17, 2021nLight ECLYPSE (nECY) system Controllers running software prior to 1.17.21245.754 contain a default key vulnerability.CVE-2021-40825 · Other software · Acuitybrands · reported by MITREHigh 8.6
nLight ECLYPSE (nECY) system Controllers running software prior to 1.17.21245.754 contain a default key vulnerability. The nECY does not force a change to the key upon the initial configuration of an affected device. nECY system controllers utilize an encrypted channel to secure SensorViewTM configuration and monitoring software and nECY to nECY communications. Impacted devices are at risk of exploitation. A remote attacker with IP access to an impacted device could submit lighting control commands to the nECY by leveraging the default key. A successful attack may result in the attacker gaining the ability to modify lighting conditions or gain the ability to update the software on lighting devices. The impacted key is referred to as the SensorView Password in the nECY nLight Explorer Interface and the Gateway Password in the SensorView application. An attacker cannot authenticate to or modify the configuration or software of the nECY system controller.
- Product
- Nlight Eclypse System Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinsights.acuitybrands.comacuitybrands.com
Sep 17, 2021ZRender is a lightweight graphic library providing 2d draw for Apache ECharts.CVE-2021-39227 · Other software · ecomfe · reported by GitHubMedium 6.2
ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.
- Product
- zrender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/itemsCVE-2021-38727 · Other software · Thedaylightstudio · reported by MITRECritical 9.8
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comstreamable.com
Sep 9, 2021Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.phpCVE-2021-38725 · Other software · Thedaylightstudio · reported by MITREMedium 5.3
Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/itemsCVE-2021-38723 · Other software · Thedaylightstudio · reported by MITREHigh 8.8
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerabilityCVE-2021-38721 · Other software · Thedaylightstudio · reported by MITREMedium 6.5
FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2021Highlight: Does not sanitise its CustomCSS settingCVE-2021-24591 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Highlight
- Fixed in
- 0.9.3
- What to do
- Update Highlight to 0.9.3 or newer.
Sep 6, 2021A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, CVE-2021-24393 · WordPress plugins & themes · reported by WPScanHigh 7.2
A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- Comment Highlighter
- Affected
- up to 0.13
- What to do
- Affects up to 0.13. Update Comment Highlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 31, 2021Use of a hard-coded cryptographic key in MIK.starlight 7.9.5.24363 allows local users to decrypt credentials via unspecified vectors.CVE-2021-36234 · Other software · Unit4 · reported by MITREMedium 5.5
Use of a hard-coded cryptographic key in MIK.starlight 7.9.5.24363 allows local users to decrypt credentials via unspecified vectors.
- Product
- Mik.starlight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2021The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticated attacker to read arbitrary files from the filesCVE-2021-36233 · Other software · Unit4 · reported by MITREMedium 6.5
The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticated attacker to read arbitrary files from the filesystem by specifying the file path.
- Product
- Mik.starlight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2021Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate privileges.CVE-2021-36232 · Other software · Unit4 · reported by MITREHigh 8.8
Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate privileges.
- Product
- Mik.starlight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.