Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
90 results · page 2 of 2
Jun 21, 2022Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_string_offset at src/njs_string.c.CVE-2022-31307 · Network & remote access · F5 · reported by MITREMedium 5.5
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_string_offset at src/njs_string.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_convert_to_slow_array at src/njs_array.c.CVE-2022-31306 · Network & remote access · F5 · reported by MITREMedium 5.5
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_convert_to_slow_array at src/njs_array.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_set_number at src/njs_value.h.CVE-2022-30503 · Websites & servers · Nginx · reported by MITREMedium 5.5
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_set_number at src/njs_value.h.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_prototype_sort at src/njs_array.c.CVE-2022-29780 · Websites & servers · Nginx · reported by MITREMedium 5.5
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_prototype_sort at src/njs_array.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_value_own_enumerate at src/njs_value.c.CVE-2022-29779 · Websites & servers · Nginx · reported by MITREMedium 5.5
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_value_own_enumerate at src/njs_value.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2022Nginx NJS v0.7.3 was discovered to contain a stack overflow in the function njs_default_module_loader at /src/njs/src/njs_module.c.CVE-2022-29379 · Network & remote access · F5 · reported by MITRECritical 9.8
Nginx NJS v0.7.3 was discovered to contain a stack overflow in the function njs_default_module_loader at /src/njs/src/njs_module.c. NOTE: multiple third parties dispute this report, e.g., the behavior is only found in unreleased development code that was not part of the 0.7.2, 0.7.3, or 0.7.4 release
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Nginx NJS v0.7.2 was discovered to contain a segmentation violation via njs_lvlhsh_bucket_find at njs_lvlhsh.c.CVE-2022-29369 · Network & remote access · F5 · reported by MITREHigh 7.5
Nginx NJS v0.7.2 was discovered to contain a segmentation violation via njs_lvlhsh_bucket_find at njs_lvlhsh.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022NGINX NJS 0.7.2 was discovered to contain a NULL pointer dereference via the component njs_vmcode_array at /src/njs_vmcode.c.CVE-2022-28049 · Network & remote access · F5 · reported by MITREMedium 5.5
NGINX NJS 0.7.2 was discovered to contain a NULL pointer dereference via the component njs_vmcode_array at /src/njs_vmcode.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022nginx njs 0.7.2 is vulnerable to Buffer Overflow.CVE-2022-27008 · Network & remote access · F5 · reported by MITREHigh 7.5
nginx njs 0.7.2 is vulnerable to Buffer Overflow. Type confused in Array.prototype.concat() when a slow array appended element is fast array.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022nginx njs 0.7.2 is affected suffers from Use-after-free in njs_function_frame_alloc() when it try to invoke from a restored frame saved with njs_function_frame_CVE-2022-27007 · Network & remote access · F5 · reported by MITRECritical 9.8
nginx njs 0.7.2 is affected suffers from Use-after-free in njs_function_frame_alloc() when it try to invoke from a restored frame saved with njs_function_frame_save().
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njs_await_fulfilled.CVE-2022-25139 · Network & remote access · F5 · reported by MITRECritical 9.8
njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njs_await_fulfilled.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerability in njs_promise_perform_then().CVE-2021-46463 · Network & remote access · F5 · reported by MITRECritical 9.8
njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerability in njs_promise_perform_then().
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njs_object_set_prototype in /src/njs_object.c.CVE-2021-46462 · Network & remote access · F5 · reported by MITREHigh 7.5
njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njs_object_set_prototype in /src/njs_object.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.CVE-2021-46461 · Websites & servers · Nginx · reported by MITRECritical 9.8
njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2021An issue was discovered in the binjs_io crate through 2021-01-03 for Rust.CVE-2021-45683 · Other software · Binjs IO Project · reported by MITRECritical 9.8
An issue was discovered in the binjs_io crate through 2021-01-03 for Rust. The Read method may read from uninitialized memory locations.
- Product
- Binjs IO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Jan 1, 2021zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution (because nodeIntegration in webPreferences is true).CVE-2020-35717 · Other software · Electronjs · reported by MITRECritical 9
zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution (because nodeIntegration in webPreferences is true).
- Product
- Zonote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2020njs through 0.4.3, used in NGINX, allows control-flow hijack in njs_value_property in njs_value.c.CVE-2020-24349 · Network & remote access · F5 · reported by MITREMedium 5.5
njs through 0.4.3, used in NGINX, allows control-flow hijack in njs_value_property in njs_value.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Aug 13, 2020njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_json_stringify_iterator in njs_json.c.CVE-2020-24348 · Network & remote access · F5 · reported by MITREMedium 5.5
njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_json_stringify_iterator in njs_json.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Aug 13, 2020njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_lvlhsh_level_find in njs_lvlhsh.c.CVE-2020-24347 · Network & remote access · F5 · reported by MITREMedium 5.5
njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_lvlhsh_level_find in njs_lvlhsh.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Aug 13, 2020njs through 0.4.3, used in NGINX, has a use-after-free in njs_json_parse_iterator_call in njs_json.c.CVE-2020-24346 · Network & remote access · F5 · reported by MITREHigh 7.8
njs through 0.4.3, used in NGINX, has a use-after-free in njs_json_parse_iterator_call in njs_json.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Jul 16, 2019njs through 0.3.3, used in NGINX, has a heap-based buffer over-read in nxt_vsprintf in nxt/nxt_sprintf.c during error handling, as demonstrated by an njs_regexpCVE-2019-13617 · Network & remote access · F5 · reported by MITREMedium 6.5
njs through 0.3.3, used in NGINX, has a heap-based buffer over-read in nxt_vsprintf in nxt/nxt_sprintf.c during error handling, as demonstrated by an njs_regexp_literal call that leads to an njs_parser_lexer_error call and then an njs_parser_scope_error call.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orggithub.com
Jun 29, 2019njs through 0.3.3, used in NGINX, has a buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c.CVE-2019-13067 · Network & remote access · F5 · reported by MITRECritical 9.8
njs through 0.3.3, used in NGINX, has a buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c. This issue occurs after the fix for CVE-2019-12207 is in place.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2019njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in njs_function_native_call in njs/njs_function.c.CVE-2019-12208 · Network & remote access · F5 · reported by MITRECritical 9.8
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in njs_function_native_call in njs/njs_function.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2019njs through 0.3.1, used in NGINX, has a heap-based buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c.CVE-2019-12207 · Network & remote access · F5 · reported by MITRECritical 9.8
njs through 0.3.1, used in NGINX, has a heap-based buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2019njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in nxt_utf8_encode in nxt_utf8.c.CVE-2019-12206 · Network & remote access · F5 · reported by MITRECritical 9.8
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in nxt_utf8_encode in nxt_utf8.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2019njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.push after a resize, related to njs_array_prototype_push in njs/njs_array.CVE-2019-11839 · Network & remote access · F5 · reported by MITRECritical 9.8
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.push after a resize, related to njs_array_prototype_push in njs/njs_array.c, because of njs_array_expand size mishandling.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2019njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.splice after a resize, related to njs_array_prototype_splice in njs/njs_arCVE-2019-11838 · Network & remote access · F5 · reported by MITRECritical 9.8
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.splice after a resize, related to njs_array_prototype_splice in njs/njs_array.c, because of njs_array_expand size mishandling.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2019njs through 0.3.1, used in NGINX, has a segmentation fault in String.prototype.toBytes for negative arguments, related to nxt_utf8_next in nxt/nxt_utf8.h and njCVE-2019-11837 · Network & remote access · F5 · reported by MITREHigh 7.5
njs through 0.3.1, used in NGINX, has a segmentation fault in String.prototype.toBytes for negative arguments, related to nxt_utf8_next in nxt/nxt_utf8.h and njs_string_offset in njs/njs_string.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2018GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, CVE-2018-15685 · Other software · Electronjs · reported by MITREHigh 8.1
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.
- Product
- Electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordelectronjs.orgexploit-db.com
Jun 6, 2018Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions ofCVE-2017-16151 · Other software · HackerOne · reported by support@hackerone.comCritical 9.8
Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless of whether the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled.
- Product
- electron node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordelectron.atom.ionodesecurity.io
Jun 4, 2018gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks.CVE-2017-16040 · Other software · HackerOne · reported by support@hackerone.comHigh 8.1
gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
- Product
- gfe-sass node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Mar 23, 2018Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can resulCVE-2018-1000136 · Other software · Electronjs · reported by MITREHigh 8.1
Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.
- Product
- Electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordelectronjs.orgtrustwave.com
Mar 7, 2018Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute.CVE-2018-1000118 · Other software · Electronjs · reported by MITREHigh 8.8
Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.
- Product
- Electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordelectronjs.orggithub.com
Sep 6, 2017TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashes via a cross-site sCVE-2015-3454 · Other software · Vulcanjs · reported by MITREHigh 7.5
TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashes via a cross-site scripting attack.
- Product
- Vulcan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Aug 9, 2017The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, whichCVE-2014-6393 · Other software · Openjsf · reported by MITREMedium 6.1
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.
- Product
- Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comnodesecurity.io
Apr 12, 2017JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack.CVE-2016-6348 · Other software · Redhat · reported by MITREMedium 6.1
JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack.
- Product
- Resteasy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Jan 23, 2017Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via CVE-2015-8856 · Other software · Openjsf · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via a crafted file or directory name.
- Product
- Serve-index
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Nov 21, 2011Buffer overflow in MiniSmtp 3.0.11818 in NJStar Communicator allows remote attackers to execute arbitrary code via a crafted packet.CVE-2011-4040 · Other software · Njstar · reported by cret@cert.orgHigh 10
Buffer overflow in MiniSmtp 3.0.11818 in NJStar Communicator allows remote attackers to execute arbitrary code via a crafted packet.
- Product
- Njstar Communicator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Feb 18, 2011Cross-site scripting (XSS) vulnerability in the nonjs interface (interfaces/nonjs.pm) in CGI:IRC before 0.5.10 allows remote attackers to inject arbitrary web sCVE-2011-0050 · Other software · Cgiirc · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the nonjs interface (interfaces/nonjs.pm) in CGI:IRC before 0.5.10 allows remote attackers to inject arbitrary web script or HTML via the R parameter.
- Product
- Cgi\
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2006Stack-based buffer overflow in NJStar Chinese and Japanese Word Processor 4.x and 5.x before 5.10 allows user-assisted attackers to execute arbitrary code via fCVE-2006-0807 · Other software · Njstar · reported by MITREMedium 5.1
Stack-based buffer overflow in NJStar Chinese and Japanese Word Processor 4.x and 5.x before 5.10 allows user-assisted attackers to execute arbitrary code via font names in NJStar (.njx) documents.
- Product
- Chinese Word Processor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.