Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,050 results · page 20 of 61
Oct 31, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 11.1.0.CVE-2023-5873 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 11.1.0.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2.CVE-2023-5867 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1.CVE-2023-5866 · Other software · thorsten · reported by security@huntr.devMedium 5.7
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2.CVE-2023-5865 · Other software · thorsten · reported by security@huntr.devCritical 9.8
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1.CVE-2023-5864 · Other software · thorsten · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2.CVE-2023-5863 · Other software · thorsten · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Missing Authorization in GitHub repository hamza417/inure prior to Build95.CVE-2023-5862 · Other software · hamza417 · reported by security@huntr.devLow 3.3
Missing Authorization in GitHub repository hamza417/inure prior to Build95.
- Product
- hamza417/inure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.CVE-2023-5861 · Other software · microweber · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.CVE-2023-5833 · Other software · mintplex-labs · reported by security@huntr.devHigh 8.8
Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.CVE-2023-5832 · Other software · mintplex-labs · reported by security@huntr.devCritical 9.1
Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0.CVE-2023-5844 · Other software · pimcore · reported by security@huntr.devHigh 7.2
Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0.
- Product
- pimcore/admin-ui-classic-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2023Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5.CVE-2023-5842 · Other software · dolibarr · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5.
- Product
- dolibarr/dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2023Weak Password Recovery Mechanism for Forgotten Password in GitHub repository linkstackorg/linkstack prior to v4.2.9.CVE-2023-5840 · Other software · linkstackorg · reported by security@huntr.devHigh 8.8
Weak Password Recovery Mechanism for Forgotten Password in GitHub repository linkstackorg/linkstack prior to v4.2.9.
- Product
- linkstackorg/linkstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2023Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.CVE-2023-5839 · Other software · hestiacp · reported by security@huntr.devHigh 7.8
Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2023Insufficient Session Expiration in GitHub repository linkstackorg/linkstack prior to v4.2.9.CVE-2023-5838 · Other software · linkstackorg · reported by security@huntr.devCritical 9.8
Insufficient Session Expiration in GitHub repository linkstackorg/linkstack prior to v4.2.9.
- Product
- linkstackorg/linkstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a stored cross-site scriptiCVE-2023-46650 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins GitHub Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 25, 2023The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI CVE-2023-46102 · Other software · Bosch Rexroth AG · reported by psirt@bosch.comHigh 8.8
The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI device. The protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric key, that can be retrieved reversing both the Android Client application and the server-side web application. This issue allows an attacker able to control a malicious MQTT broker on the same subnet network of the device, to craft malicious messages and send them to the HMI device, executing arbitrary commands on the device itself.
- Product
- ctrlX HMI Web Panel - WR21 (WR2107)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Oct 25, 2023The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication.CVE-2023-45851 · Other software · Bosch Rexroth AG · reported by psirt@bosch.comHigh 8.8
The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication. This issue allows an attacker to force the Android Client application to connect to a malicious MQTT broker, enabling it to send fake messages to the HMI device
- Product
- ctrlX HMI Web Panel - WR21 (WR2107)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Oct 20, 2023Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.CVE-2023-5690 · Other software · modoboa · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.
- Product
- modoboa/modoboa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2023Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.CVE-2023-5689 · Other software · modoboa · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
- Product
- modoboa/modoboa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2023Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.CVE-2023-5688 · Other software · modoboa · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
- Product
- modoboa/modoboa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2023Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3.CVE-2023-5687 · Other software · mosparo · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3.
- Product
- mosparo/mosparo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2023Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.CVE-2023-5686 · Other software · radareorg · reported by security@huntr.devHigh 8.8
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
- Product
- radareorg/radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2023Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects.CVE-2023-45823 · Other software · artifacthub · reported by GitHubHigh 7.5
Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which by using symbolic links in certain kinds of repositories loaded into Artifact Hub, it was possible to read internal files. Artifact Hub indexes content from a variety of sources, including git repositories. When processing git based repositories, Artifact Hub clones the repository and, depending on the artifact kind, reads some files from it. During this process, in some cases, no validation was done to check if the file was a symbolic link. This made possible to read arbitrary files in the system, potentially leaking sensitive information. This issue has been resolved in version `1.16.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordartifacthub.iogithub.com
Oct 19, 2023Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects.CVE-2023-45822 · Other software · artifacthub · reported by GitHubLow 3.7
Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which a default unsafe rego built-in was allowed to be used when defining authorization policies. Artifact Hub includes a fine-grained authorization mechanism that allows organizations to define what actions can be performed by their members. It is based on customizable authorization policies that are enforced by the `Open Policy Agent`. Policies are written using `rego` and their data files are expected to be json documents. By default, `rego` allows policies to make HTTP requests, which can be abused to send requests to internal resources and forward the responses to an external entity. In the context of Artifact Hub, this capability should have been disabled. This issue has been resolved in version `1.16.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordartifacthub.iogithub.com
Oct 19, 2023Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects.CVE-2023-45821 · Other software · artifacthub · reported by GitHubMedium 5.4
Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which the `registryIsDockerHub` function was only checking that the registry domain had the `docker.io` suffix. Artifact Hub allows providing some Docker credentials that are used to increase the rate limit applied when interacting with the Docker Hub registry API to read publicly available content. Due to the incorrect check described above, it'd be possible to hijack those credentials by purchasing a domain which ends with `docker.io` and deploying a fake OCI registry on it. <https://artifacthub.io/> uses some credentials that only have permissions to read public content available in the Docker Hub. However, even though credentials for private repositories (disabled on `artifacthub.io`) are handled in a different way, other Artifact Hub deployments could have been using them for a different purpose. This issue has been resolved in version `1.16.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordartifacthub.iogithub.com
Oct 17, 2023Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.CVE-2023-5626 · Other software · pkp · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.
- Product
- pkp/ojs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2023github.com/crewjam/saml is a saml library for the go language.CVE-2023-45683 · Other software · crewjam · reported by GitHubHigh 7.1
github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting (XSS) in the IdP context during the redirection at the end of a SAML SSO Flow. Consequently, an attacker may perform any authenticated action as the victim once the victim’s browser loaded the SAML IdP initiated SSO link for the malicious service provider. Note: SP registration is commonly an unrestricted operation in IdPs, hence not requiring particular permissions or publicly accessible to ease the IdP interoperability. This issue is fixed in version 0.4.14. Users unable to upgrade may perform external validation of URLs provided in SAML metadata, or restrict the ability for end-users to upload arbitrary metadata.
- Product
- saml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2023Denial of Service in GitHub repository gpac/gpac prior to 2.3.0-DEV.CVE-2023-5595 · Other software · gpac · reported by security@huntr.devMedium 5.5
Denial of Service in GitHub repository gpac/gpac prior to 2.3.0-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2023 SQL Injection in GitHub repository librenms/librenms prior to 23.10.0.CVE-2023-5591 · Other software · librenms · reported by security@huntr.devMedium 6.5
SQL Injection in GitHub repository librenms/librenms prior to 23.10.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2023NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.0.CVE-2023-5590 · Other software · seleniumhq · reported by security@huntr.devHigh 7.5
NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.0.
- Product
- seleniumhq/selenium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2023NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3.0-DEV.CVE-2023-5586 · Other software · gpac · reported by security@huntr.devHigh 7.8
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3.0-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2023Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22.CVE-2023-4829 · Other software · froxlor · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2023Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.CVE-2023-4517 · Other software · hestiacp · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2023Allocation of Resources Without Limits or Throttling in GitHub repository vriteio/vrite prior to 0.3.0.CVE-2023-5573 · Other software · vriteio · reported by security@huntr.devMedium 6.5
Allocation of Resources Without Limits or Throttling in GitHub repository vriteio/vrite prior to 0.3.0.
- Product
- vriteio/vrite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2023Server-Side Request Forgery (SSRF) in GitHub repository vriteio/vrite prior to 0.3.0.CVE-2023-5572 · Other software · vriteio · reported by security@huntr.devCritical 9.8
Server-Side Request Forgery (SSRF) in GitHub repository vriteio/vrite prior to 0.3.0.
- Product
- vriteio/vrite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2023Improper Input Validation in GitHub repository vriteio/vrite prior to 0.3.0.CVE-2023-5571 · Other software · vriteio · reported by security@huntr.devHigh 7.5
Improper Input Validation in GitHub repository vriteio/vrite prior to 0.3.0.
- Product
- vriteio/vrite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2023Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1.CVE-2023-5564 · Other software · froxlor · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2023Denial of Service in JSON-Java versions up to and including 20230618.CVE-2023-5072 · Other software · https://github.com/stleary/JSON-java · reported by cve-coordination@google.comHigh 7.5
Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.
- Product
- n/a
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 12, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194.CVE-2023-5556 · Other software · structurizr · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194.
- Product
- structurizr/onpremises
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2023Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4.CVE-2023-5555 · Other software · frappe · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4.
- Product
- frappe/lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2023Use After Free in GitHub repository vim/vim prior to v9.0.2010.CVE-2023-5535 · Other software · vim · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository vim/vim prior to v9.0.2010.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2023Incorrect Authorization in GitHub repository tiann/kernelsu prior to v0.6.9.CVE-2023-5521 · Other software · tiann · reported by security@huntr.devCritical 9.8
Incorrect Authorization in GitHub repository tiann/kernelsu prior to v0.6.9.
- Product
- tiann/kernelsu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2023Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-5520 · Other software · gpac · reported by security@huntr.devHigh 7.7
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.CVE-2023-5511 · Other software · snipe · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023Cross-Site Request Forgery (CSRF) in GitHub repository chiefonboarding/chiefonboarding prior to v2.0.47.CVE-2023-5498 · Other software · chiefonboarding · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository chiefonboarding/chiefonboarding prior to v2.0.47.
- Product
- chiefonboarding/chiefonboarding
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.CVE-2023-5452 · Other software · snipe · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2023NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960.CVE-2023-5441 · Other software · vim · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Out-of-bounds Read in GitHub repository gpac/gpac prior to v2.2.2-DEV.CVE-2023-5377 · Other software · gpac · reported by security@huntr.devHigh 7.1
Out-of-bounds Read in GitHub repository gpac/gpac prior to v2.2.2-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.CVE-2023-5375 · Other software · mosparo · reported by security@huntr.devMedium 6.1
Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.
- Product
- mosparo/mosparo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.