Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,223 results · page 23 of 45
Jun 13, 2022Useful Banner Manager: Does not perform CSRF checks on POST requests to its admin pageCVE-2022-1694 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form.
- Product
- Useful Banner Manager
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Useful Banner Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2022Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.CVE-2022-28330 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comhttpd.apache.org
Jun 9, 2022Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requeCVE-2022-26377 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comhttpd.apache.org
Jun 9, 2022Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner.CVE-2021-27786 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information when the Access-Control-Allow-Credentials is enabled.
- Product
- HCL OneTest Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 9, 2022A Server-Side Request Forgery (SSRF) in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via injecCVE-2022-31386 · Other software · Nbnbk Project · reported by MITRECritical 9.1
A Server-Side Request Forgery (SSRF) in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the URL parameter.
- Product
- Nbnbk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/take_action.php?id=.CVE-2022-31984 · Other software · Online Fire Reporting System Project · reported by MITREHigh 7.2
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/take_action.php?id=.
- Product
- Online Fire Reporting System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/manage_request&id=.CVE-2022-31983 · Other software · Online Fire Reporting System Project · reported by MITREHigh 7.2
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/manage_request&id=.
- Product
- Online Fire Reporting System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/view_request&id=.CVE-2022-31982 · Other software · Online Fire Reporting System Project · reported by MITREHigh 7.2
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/view_request&id=.
- Product
- Online Fire Reporting System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2022github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs).CVE-2022-29220 · Other software · fastify · reported by GitHubMedium 6.5
github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs). Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set to `dependabot[bot]` to determine if the PR is a legit PR. Theoretically, an owner of a seemingly valid and legit action in the pipeline can check if the PR is created by dependabot and if their own action has enough permissions to modify the PR in the pipeline. If so, they can modify the PR by adding a second seemingly valid and legit commit to the PR, as they can set arbitrarily the username and email in for commits in git. Because the bot only checks if the actor is valid, it would pass the malicious changes through and merge the PR automatically, without getting noticed by project maintainers. It would probably not be possible to determine where the malicious commit came from, as it would only say `dependabot[bot]` and the corresponding email-address. Version 3.2.0 contains a patch for this issue.
- Product
- github-action-merge-dependabot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2022JivoChat Live Chat: Does not properly check CSRF tokens on POST requests to the plugins admin pageCVE-2022-0642 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.
- Product
- JivoChat Live Chat
- Fixed in
- 1.3.5.4
- What to do
- Update JivoChat Live Chat to 1.3.5.4 or newer.
May 26, 2022Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests.CVE-2022-24414 · Other software · Dell · reported by security_alert@emc.comHigh 7.6
Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attacks.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multCVE-2022-29361 · Other software · Palletsprojects · reported by MITRECritical 9.8
Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project
- Product
- Werkzeug
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2022An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on arbCVE-2021-43094 · Other software · Openmrs · reported by MITRECritical 9.8
An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on arbitrary parameters in patient.page.
- Product
- Openmrs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordissues.openmrs.orgopenmrs.org
May 7, 2022A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server.CVE-2022-29180 · Other software · charmbracelet · reported by GitHubMedium 5.9
A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server. This has been patched and is available in release [v0.12.1](https://github.com/charmbracelet/charm/releases/tag/v0.12.1). We recommend that all users running self-hosted `charm` instances update immediately. This vulnerability was found in-house and we haven't been notified of any potential exploiters. ### Additional notes * Encrypted user data uploaded to the Charm server is safe as Charm servers cannot decrypt user data. This includes filenames, paths, and all key-value data. * Users running the official Charm [Docker images](https://github.com/charmbracelet/charm/blob/main/docker.md) are at minimal risk because the exploit is limited to the containerized filesystem.
- Product
- charm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and resCVE-2022-29167 · Computers, phones & browsers · mozilla · reported by GitHubHigh 7.4
Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.
- Product
- hawk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022On F5 BIG-IP 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when multiple route domains are configured, undisclosed requests to big3d cCVE-2022-29480 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 5.3
On F5 BIG-IP 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when multiple route domains are configured, undisclosed requests to big3d can cause an increase in CPU resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
May 5, 2022On F5 BIG-IP 16.1.x versions prior to 16.1.2 and 15.1.x versions prior to 15.1.5.1, when the DNS resolver configuration is used, undisclosed requests can cause CVE-2022-28706 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 5.9
On F5 BIG-IP 16.1.x versions prior to 16.1.2 and 15.1.x versions prior to 15.1.5.1, when the DNS resolver configuration is used, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
May 5, 2022On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause an increase in memory CVE-2022-28701 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
May 4, 2022An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP GET requests.CVE-2022-23443 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.5
An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP GET requests.
- Product
- Fortinet FortiSOAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
May 2, 2022Improved Host header checks to reject requests not sent to a well-known local hostname or IP, or the server-specified hostname.CVE-2021-4138 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
Improved Host header checks to reject requests not sent to a well-known local hostname or IP, or the server-specified hostname.
- Product
- geckodriver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orggithub.com
Apr 28, 2022A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests viaCVE-2022-28117 · Other software · Naviwebs · reported by MITREMedium 4.9
A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter.
- Product
- Navigate CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comnavigatecms.com
Apr 28, 2022Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired CVE-2021-43939 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govHigh 8.8
Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired endpoints.
- Product
- SmartPTT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload CVE-2021-43934 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govCritical 9.8
Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files.
- Product
- SmartPTT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traveCVE-2021-43930 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govMedium 4.9
Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system.
- Product
- SmartPTT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2022A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for a legitimate user, CVE-2022-29701 · Other software · Zammad · reported by MITREHigh 7.5
A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for a legitimate user, leading to a possible Denial of Service (DoS) via a large amount of generated e-mail messages.
- Product
- Zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2022The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.CVE-2021-36203 · Other software · Johnnson Controls · reported by productsecurity@jci.comMedium 5.3
The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.
- Product
- Metasys System Configuration Tool (SCT)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2022The affected product is vulnerable to a network-based attack by threat actors sending unimpeded requests to the receiving server, which could cause a denial-of-CVE-2021-43933 · Other software · FANUC · reported by ics-cert@hq.dhs.govMedium 6.1
The affected product is vulnerable to a network-based attack by threat actors sending unimpeded requests to the receiving server, which could cause a denial-of-service condition due to lack of heap memory resources.
- Product
- ROBOGUIDE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests.CVE-2022-27479 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Apr 12, 2022Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent),CVE-2022-29047 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them.
- Product
- Jenkins Pipeline: Shared Groovy Libraries Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2022A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the COCVE-2022-22519 · Other software · CODESYS · reported by info@cert.vde.comHigh 7.5
A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system.
- Product
- CODESYS Control RTE (SL)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
Apr 6, 2022Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Transmitting Write Requests and Chars.CVE-2020-27375 · Other software · Drtrustusa · reported by MITREMedium 6.5
Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Transmitting Write Requests and Chars.
- Product
- Icheck Connect BP Monitor BP Testing 118 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrtrust.innvermaa.medium.com
Mar 23, 2022Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests.CVE-2021-44040 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.
- Product
- Apache Traffic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgdebian.org
Mar 22, 2022In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of tCVE-2022-25518 · Other software · Tecnoteca · reported by MITREMedium 6.5
In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of the users who login to the application by querying the database table.
- Product
- Cmdbuild
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcmdbuild.orgcmdbuild.org
Mar 19, 2022The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a RCVE-2022-24125 · Other software · Fromsoftware · reported by MITREHigh 8.8
The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a RequestSendMessageToPlayers request. For example, ability to send a push message to hundreds of thousands of machines is only restricted on the client side, and can thus be bypassed with a modified client.
- Product
- Dark Souls III
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfromsoftware.jpgithub.com
Mar 14, 2022Contact Form Submissions: Does not sanitise and escape additional fields in contact form requests before outputting them in the related submissionCVE-2022-0248 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission
- Product
- Contact Form Submissions
- Fixed in
- 1.7.3
- What to do
- Update Contact Form Submissions to 1.7.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 10, 2022PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests.CVE-2022-0813 · Websites & servers · phpMyAdmin · reported by cve-coordination@incibe.esMedium 5.3
PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.
- Product
- phpMyAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgincibe-cert.es
Mar 3, 2022OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSearch.php, ChooseRequestSearch.php.CVE-2021-40635 · Other software · Os4ed · reported by MITREHigh 7.5
OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSearch.php, ChooseRequestSearch.php. An attacker can inject a SQL query to extract information from the database.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2022A security vulnerability in the Spectrum Scale 5.0 and 5.1 allows a non-root user to overflow the mmfsd daemon with requests and preventing the daemon to servicCVE-2020-4925 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
A security vulnerability in the Spectrum Scale 5.0 and 5.1 allows a non-root user to overflow the mmfsd daemon with requests and preventing the daemon to service other requests. IBM X-Force ID: 191599.
- Product
- Spectrum Scale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 28, 2022A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted FTP requests.CVE-2020-22845 · Network & remote access · Mikrotik · reported by MITREHigh 7.5
A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted FTP requests.
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commikrotik.com
Feb 28, 2022A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted SMB requests.CVE-2020-22844 · Network & remote access · Mikrotik · reported by MITREHigh 7.5
A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted SMB requests.
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commikrotik.com
Feb 25, 2022In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions.CVE-2022-24337 · Other software · Jetbrains · reported by MITREMedium 6.5
In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Feb 25, 2022HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP requests in a manner that may capture sensitivCVE-2022-25374 · Other software · Hashicorp · reported by MITREHigh 7.5
HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP requests in a manner that may capture sensitive data. Fixed in v202202-1.
- Product
- Terraform Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Feb 24, 2022The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests.CVE-2020-14504 · Other software · Rockwell Automation · reported by ics-cert@hq.dhs.govMedium 5.3
The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attacker can send a crafted request that may allow for modification of the configuration settings.
- Product
- 1734-AENTR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (InCVE-2022-0732 · Other software · 1Byte · reported by cret@cert.orgHigh 7.5
The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.
- Product
- Copy9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgkb.cert.org
Feb 18, 2022A Use after Free vulnerability exists in IOBit Advanced SystemCare 15 pro via requests sent in sequential order using the IOCTL driver codes, which could let a CVE-2021-44968 · Other software · Iobit · reported by MITREHigh 7.8
A Use after Free vulnerability exists in IOBit Advanced SystemCare 15 pro via requests sent in sequential order using the IOCTL driver codes, which could let a malicious user execute arbitrary code or a Denial of Service (system crash). IOCTL list: iobit_ioctl = [0x8001e01c, 0x8001e020, 0x8001e024, 0x8001e040,0x8001e044, 0x8001e048, 0x8001e04c, 0x8001e000, 0x8001e004, 0x8001e008, 0x8001e00c, 0x8001e010, 0x8001e014, 0x8001e018]
- Product
- Advanced Systemcare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022Action Pack is a framework for handling and responding to web requests.CVE-2022-23633 · Other software · rails · reported by GitHubHigh 7.4
Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.
- Product
- rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Feb 9, 2022A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users.CVE-2021-22954 · Other software · Concretecms · reported by support@hackerone.comHigh 8.8
A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orgdocumentation.concretecms.org
Feb 8, 2022Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.CVE-2021-45326 · Other software · Gitea · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.iogithub.com
Feb 1, 2022NextScripts: Social Networks Auto-Poster: Does not sanitise and escape logged requests before outputting them in the related admin dashboardCVE-2021-24975 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests before outputting them in the related admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting issue
- Product
- NextScripts: Social Networks Auto-Poster
- Fixed in
- 4.3.24
- What to do
- Update NextScripts: Social Networks Auto-Poster to 4.3.24 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 1, 2022treq is an HTTP library inspired by requests but written on top of Twisted's Agents.CVE-2022-23607 · Other software · twisted · reported by GitHubMedium 6.5
treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods (`treq.get`, `treq.post`, etc.) and `treq.client.HTTPClient` constructor accept cookies as a dictionary. Such cookies are not bound to a single domain, and are therefore sent to *every* domain ("supercookies"). This can potentially cause sensitive information to leak upon an HTTP redirect to a different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the latter will receive the cookie `session`. Treq 2021.1.0 and later bind cookies given to request methods (`treq.request`, `treq.get`, `HTTPClient.request`, `HTTPClient.get`, etc.) to the origin of the *url* parameter. Users are advised to upgrade. For users unable to upgrade Instead of passing a dictionary as the *cookies* argument, pass a `http.cookiejar.CookieJar` instance with properly domain- and scheme-scoped cookies in it.
- Product
- treq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.