Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,780 results · page 18 of 36
Oct 18, 2023Arduino Create Agent is a package to help manage Arduino development.CVE-2023-43803 · Other software · arduino · reported by GitHubMedium 6.1
Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- arduino-create-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2023Arduino Create Agent is a package to help manage Arduino development.CVE-2023-43802 · Other software · arduino · reported by GitHubHigh 7.1
Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/upload` which handles request with the `filename` parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate their privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- arduino-create-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023SQL injection vulnerability in HelpDezk Community affecting version 1.1.10.CVE-2023-3038 · Other software · HelpDezk · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the rows parameter of the jsonGrid route and extract all the information stored in the application.
- Product
- HelpDezk Community
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Improper authorization vulnerability in HelpDezk Community affecting version 1.1.10.CVE-2023-3037 · Other software · HelpDezk · reported by cve-coordination@incibe.esHigh 8.6
Improper authorization vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to access the platform without authentication and retrieve personal data via the jsonGrid parameter.
- Product
- HelpDezk Community
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023An issue in CatoNetworks CatoClient before v.5.4.0 allows attackers to escalate privileges and winning the race condition (TOCTOU) via the PrivilegedHelperTool CVE-2023-43976 · Other software · Catonetworks · reported by MITREHigh 8.1
An issue in CatoNetworks CatoClient before v.5.4.0 allows attackers to escalate privileges and winning the race condition (TOCTOU) via the PrivilegedHelperTool component.
- Product
- Cato Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcatonetworks.comns-echo.com
Oct 2, 2023Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey parameter in the Help.aspx componeCVE-2023-44012 · Other software · Mojoportal · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey parameter in the Help.aspx component.
- Product
- Mojoportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.18, allows attackers to execute arbitrary CVE-2021-26837 · Other software · Fortra · reported by MITRECritical 9.8
SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.18, allows attackers to execute arbitrary code, escalate privileges, and gain sensitive information.
- Product
- Delivernow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.helpsystems.comsusos.co
Sep 11, 2023In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to a confused deputy.CVE-2023-35682 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Aug 31, 2023Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed.CVE-2023-39912 · Email & office · Zohocorp · reported by MITREMedium 4.9
Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Aug 28, 2023ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\insert.php.CVE-2023-39560 · Other software · Ectouch · reported by MITRECritical 9.8
ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\insert.php.
- Product
- Ectouch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2023A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the "identify -help" command.CVE-2022-48541 · Other software · Imagemagick · reported by MITREHigh 7.1
A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the "identify -help" command.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Aug 22, 2023An issue was discovered in Fresenius Kabi PharmaHelp 5.1.759.0 allows attackers to gain escalated privileges via via capture of user login information.CVE-2022-45611 · Other software · Fresenius-kabi · reported by MITRECritical 9.8
An issue was discovered in Fresenius Kabi PharmaHelp 5.1.759.0 allows attackers to gain escalated privileges via via capture of user login information.
- Product
- Pharmahelp Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfresenius-kabi.comfresenius.com
Aug 14, 2023In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options without the lockscreen PIN due to a missing CVE-2023-21234 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options without the lockscreen PIN due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Aug 11, 2023An issue was discovered in ecma-helpers.c in jerryscript version 2.3.0, allows local attackers to cause a denial of service (DoS) (Null Pointer Dereference).CVE-2020-24187 · Other software · Jerryscript · reported by MITREMedium 5.5
An issue was discovered in ecma-helpers.c in jerryscript version 2.3.0, allows local attackers to cause a denial of service (DoS) (Null Pointer Dereference).
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2023Use of Hard-coded Cryptographic Key vulnerability in Sifir Bes Education and Informatics Kunduz - Homework Helper App allows Authentication Abuse, AuthenticatioCVE-2023-3632 · Other software · Sifir Bes Education and Informatics · reported by iletisim@usom.gov.trCritical 9.8
Use of Hard-coded Cryptographic Key vulnerability in Sifir Bes Education and Informatics Kunduz - Homework Helper App allows Authentication Abuse, Authentication Bypass. This issue affects Kunduz - Homework Helper App: before 6.2.3.
- Product
- Kunduz - Homework Helper App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jul 27, 2023Atmail 5.62 allows XSS via the mail/parse.php?file=html/$this-%3ELanguage/help/filexp.html&FirstLoad=1&HelpFile=file.html Search Terms field.CVE-2022-31200 · Other software · Atmail · reported by MITREMedium 6.1
Atmail 5.62 allows XSS via the mail/parse.php?file=html/$this-%3ELanguage/help/filexp.html&FirstLoad=1&HelpFile=file.html Search Terms field.
- Product
- Atmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comportswigger.net
Jul 18, 2023ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers::ProfiledNewScArray().CVE-2023-37141 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5.5
ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers::ProfiledNewScArray().
- Product
- Chakracore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in Media Library Helper plugin <= 1.2.0 versions.CVE-2023-37386 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Media Library Helper plugin <= 1.2.0 versions.
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 14, 2023zenstruck/collections is a set of helpers for iterating/paginating/filtering collections.CVE-2023-37473 · Other software · zenstruck · reported by GitHubHigh 8.5
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit `f4b1c48820` and included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input is not passed to either `EntityRepository::find()` or `query()`.
- Product
- collection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profile due to a missing permission check.CVE-2023-21257 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profile due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Jul 12, 2023The session restore helper crashed whenever there was no parameter sent to the message handler.CVE-2023-37456 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affects Firefox for iOS < 115.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jul 12, 2023In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk formsCVE-2023-38068 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jul 11, 2023RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment.CVE-2023-37271 · Other software · zopefoundation · reported by GitHubHigh 8.4
RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generator expressions, which are allowed inside RestrictedPython. Prior to versions 6.1 and 5.3, an attacker with access to a RestrictedPython environment can write code that gets the current stack frame in a generator and then walk the stack all the way beyond the RestrictedPython invocation boundary, thus breaking out of the restricted sandbox and potentially allowing arbitrary code execution in the Python interpreter. All RestrictedPython deployments that allow untrusted users to write Python code in the RestrictedPython environment are at risk. In terms of Zope and Plone, this would mean deployments where the administrator allows untrusted users to create and/or edit objects of type `Script (Python)`, `DTML Method`, `DTML Document` or `Zope Page Template`. This is a non-default configuration and likely to be extremely rare. The problem has been fixed in versions 6.1 and 5.3.
- Product
- RestrictedPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2023SQL injection vulnerability found in PrestaShop lekerawen_ocs before v.1.4.1 allow a remote attacker to gain privileges via the KerawenHelper::setCartOperationICVE-2023-27845 · Other software · Kerawen · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaShop lekerawen_ocs before v.1.4.1 allow a remote attacker to gain privileges via the KerawenHelper::setCartOperationInfo, and KerawenHelper::resetCheckoutSessionData components.
- Product
- Omnichannel Stocks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkerawen.comsecurity.friendsofpresta.org
Jun 30, 2023com.perimeter81.osx.HelperTool in Perimeter81 10.0.0.19 on macOS allows Local Privilege Escalation (to root) via shell metacharacters in usingCAPath.CVE-2023-33298 · Other software · Perimeter81 · reported by MITREHigh 7.8
com.perimeter81.osx.HelperTool in Perimeter81 10.0.0.19 on macOS allows Local Privilege Escalation (to root) via shell metacharacters in usingCAPath.
- Product
- XPC Helpertool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.perimeter81.comkb.cert.org
Jun 28, 2023AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services.CVE-2023-36467 · Other software · awslabs · reported by GitHubHigh 8
AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do not prevent remote code execution when a user injects Python commands into the ‘Template’ field when configuring a data pipeline. The issue can only be triggered by authenticated users. A fix for this issue is available in data.all version 1.5.2 and later. There is no recommended work around.
- Product
- aws-dataall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2023BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn.CVE-2023-33176 · Other software · bigbluebutton · reported by GitHubMedium 4.8
BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery (SSRF) vulnerability. In an `insertDocument` API request the user is able to supply a URL from which the presentation should be downloaded. This URL was being used without having been successfully validated first. An update to the `followRedirect` method in the `PresentationUrlDownloadService` has been made to validate all URLs to be used for presentation download. Two new properties `presentationDownloadSupportedProtocols` and `presentationDownloadBlockedHosts` have also been added to `bigbluebutton.properties` to allow administrators to define what protocols a URL must use and to explicitly define hosts that a presentation cannot be downloaded from. All URLs passed to `insertDocument` must conform to the requirements of the two previously mentioned properties. Additionally, these URLs must resolve to valid addresses, and these addresses must not be local or loopback addresses. There are no workarounds. Users are advised to upgrade to a patched version of BigBlueButton.
- Product
- bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the application.CVE-2023-1724 · Other software · Ladybirdweb · reported by help@fluidattacks.comHigh 7.3
Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the application. This occurs because the application is vulnerable to stored XSS.
- Product
- Faveo Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Jun 23, 2023JS Help Desk: Authorization Bypass Through User-Controlled KeyCVE-2023-23679 · WordPress plugins & themes · reported by PatchstackMedium 4.6
Authorization Bypass Through User-Controlled Key vulnerability in JS Help Desk js-support-ticket allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk: from n/a through 2.7.7.
- Product
- JS Help Desk
- Affected
- up to 2.7.7
- What to do
- Affects up to 2.7.7. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 12, 2023In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk formsCVE-2023-35053 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
May 25, 2023Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations.CVE-2023-30615 · Other software · dfir-iris · reported by GitHubMedium 6.3
Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations . The vulnerability in allows an attacker to inject malicious scripts into the application, which are then executed when a user visits the affected locations. This can lead to unauthorized access, data theft, or other malicious activities. An attacker need to be authenticated on the application to exploit this vulnerability. The issue was patched in version 2.2.1 of iris-web.
- Product
- iris-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023In verifyReplacingVersionCode of InstallPackageHelper.java, there is a possible way to downgrade system apps below system image version due to a logic error in CVE-2023-21116 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In verifyReplacingVersionCode of InstallPackageHelper.java, there is a possible way to downgrade system apps below system image version due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-256202273
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
May 15, 2023In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion.CVE-2023-21110 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-258422365
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
May 15, 2023Help Desk WP: Does not sanitise and escape some parametersCVE-2023-1019 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Help Desk WP WordPress plugin through 1.2.0 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks.
- Product
- Help Desk WP
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Help Desk WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 4, 2023An issue in the helper tool of Mailbutler GmbH Shimo VPN Client for macOS v5.0.4 allows attackers to bypass authentication via PID re-use.CVE-2023-30328 · Other software · Mailbutler · reported by MITRECritical 9.8
An issue in the helper tool of Mailbutler GmbH Shimo VPN Client for macOS v5.0.4 allows attackers to bypass authentication via PID re-use.
- Product
- Shimo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
May 2, 2023Ruby Help Desk: Does not ensure that the ticket being modified belongs to the user making the requestCVE-2023-1125 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add files and replies to tickets other than their own.
- Product
- Ruby Help Desk
- Fixed in
- 1.3.4
- What to do
- Update Ruby Help Desk to 1.3.4 or newer.
May 1, 2023Triton is a Minecraft plugin for Spigot and BungeeCord that helps you translate your Minecraft server.CVE-2023-30859 · Other software · tritonmc · reported by GitHubHigh 7.2
Triton is a Minecraft plugin for Spigot and BungeeCord that helps you translate your Minecraft server. The CustomPayload packet allows you to execute commands on the spigot/bukkit console. When you enable bungee mode in the config it will enable the bungee bridge and the server will begin to broadcast the 'triton:main' plugin channel. Using this plugin channel you are able to send a payload packet containing a byte (2) and a string (any spigot command). This could be used to make yourself a server operator and be used to extract other user information through phishing (pretending to be an admin), many servers use essentials so the /geoip command could be available to them, etc. This could also be modified to allow you to set the servers language, set another players language, etc. This issue affects those who have bungee enabled in config. This issue has been fixed in version 3.8.4.
- Product
- Triton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpers.c.CVE-2023-30406 · Other software · Jerryscript · reported by MITREMedium 5.5
Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpers.c.
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2023mindsdb is a Machine Learning platform to help developers build AI solutions.CVE-2023-30620 · Other software · mindsdb · reported by GitHubHigh 7.5
mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extractall()` from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the vulnerability is called a TarSlip or a ZipSlip variant. An attacker may leverage this vulnerability to overwrite any local file which the server process has access to. There is no risk of file exposure with this vulnerability. This issue has been addressed in release `23.2.1.0 `. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- mindsdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2023@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks.CVE-2023-27495 · Other software · fastify · reported by GitHubMedium 5.3
@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions. @fastify/csrf-protection supports an optional userInfo parameter that binds the CSRF token to the user. This parameter has been introduced to prevent cookie-tossing attacks as a fix for CVE-2021-29624. Whenever userInfo parameter is missing, or its value can be predicted for the target user account, network and same-site attackers can 1. fixate a _csrf cookie in the victim's browser, and 2. forge CSRF tokens that are valid for the victim's session. This allows attackers to bypass the CSRF protection mechanism. As a fix, @fastify/csrf-protection starting from version 6.3.0 (and v4.1.0) includes a server-defined secret hmacKey that cryptographically binds the CSRF token to the value of the _csrf cookie and the userInfo parameter, making tokens non-spoofable by attackers. This protection is effective as long as the userInfo parameter is unique for each user. This is patched in versions 6.3.0 and v4.1.0. Users a
- Product
- csrf-protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2023In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop.CVE-2023-21087 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop. This could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-261723753
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 19, 2023In onNullBinding of CallScreeningServiceHelper.java, there is a possible way to record audio without showing a privacy indicator due to a permissions bypass.CVE-2023-21083 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onNullBinding of CallScreeningServiceHelper.java, there is a possible way to record audio without showing a privacy indicator due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-252762941
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 4, 2023Helpy version 2.8.0 allows an unauthenticated remote attacker to exploit an XSS stored in the application.CVE-2023-0357 · Other software · Helpy.io · reported by help@fluidattacks.comMedium 6.1
Helpy version 2.8.0 allows an unauthenticated remote attacker to exploit an XSS stored in the application. This is possible because the application does not correctly validate the attachments sent by customers in the ticket.
- Product
- Helpy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Mar 24, 2023angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment variables.CVE-2023-28444 · Other software · kyubisation · reported by GitHubCritical 9.9
angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment variables. angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a ngssc.json file in the output directory. During deployment of an Angular based app, the environment variables based on the variables from ngssc.json are inserted into the apps index.html (or defined index file). With version 15.0.0 the environment variable detection was widened to the entire project, relative to the angular.json file from the Angular CLI. In a monorepo setup, this could lead to environment variables intended for a backend/service to be detected and written to the ngssc.json, which would then be populated and exposed via index.html. This has NO IMPACT, in a plain Angular project that has no backend component. This vulnerability has been mitigated in version 15.1.0, by adding an option `searchPattern` which restricts the detection file range by default. As a workaround, manually edit or create ngssc.json or run script after ngssc.j
- Product
- angular-server-side-configuration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection.CVE-2023-25350 · Other software · Ladybirdweb · reported by MITREHigh 8.8
Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection. When the user logs in through the login box, he has no judgment on the validity of the user's input data. The parameters passed from the front end to the back end are controllable, which will lead to SQL injection.
- Product
- Faveo Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 24, 2023In load_png_image of ExynosHWCHelper.cpp, there is a possible out of bounds write due to improper input validation.CVE-2023-21050 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In load_png_image of ExynosHWCHelper.cpp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-244423702References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 24, 2023In multiple functions of BackupHelper.java, there is a possible way for an app to get permissions previously granted to another app with the same package name dCVE-2023-21035 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of BackupHelper.java, there is a possible way for an app to get permissions previously granted to another app with the same package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-184847040
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 24, 2023In parse_printerAttributes of ipphelper.c, there is a possible out of bounds read due to a string without a null-terminator.CVE-2023-21028 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In parse_printerAttributes of ipphelper.c, there is a possible out of bounds read due to a string without a null-terminator. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-180680572
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 24, 2023In multiple functions of SnoozeHelper.java, there is a possible failure to persist settings due to an uncaught exception.CVE-2023-20993 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of SnoozeHelper.java, there is a possible failure to persist settings due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-261588851
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 23, 2023The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhCVE-2023-28333 · Other software · Moodle · reported by patrick@puiterwijk.orgCritical 9.8
The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.fedoraproject.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.