Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

496new WordPress flaws this week

394,829entries in the database

17,732 results · page 238 of 355

Dec 15, 2023Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal the Windows access toCVE-2021-42797 · Other software · Aveva · reported by MITREHigh 7.5
Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal the Windows access token of the user account configured for accessing external DB resources.
Product
Edge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aveva.com cisa.gov
Dec 15, 2023An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary commandsCVE-2021-42796 · Other software · Aveva · reported by MITRECritical 9.8
An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary commands to be executed.
Product
Edge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aveva.com cisa.gov
Dec 14, 2023Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attackCVE-2023-5592 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comHigh 7.5
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications without integrity checks on the device which may result in a complete loss of integrity.
Product
MULTIPROG
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Dec 14, 2023Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applCVE-2023-46143 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comHigh 7.5
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.
Product
Automation Worx Software Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Dec 14, 2023Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attCVE-2023-46141 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comCritical 9.8
Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.
Product
Automation Worx Software Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Dec 14, 2023Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated CVE-2023-0757 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comCritical 9.8
Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device.
Product
MULTIPROG
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Dec 14, 2023Unauthenticated LFI/SSRF in JCDashboards component for Joomla.CVE-2023-40630 · Other software · joomcode.com · reported by security@joomla.orgCritical 9.8
Unauthenticated LFI/SSRF in JCDashboards component for Joomla.
Product
JCDashboards component for Joomla
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record extensions.joomla.org extensions.joomla.org
Dec 13, 2023A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorizeCVE-2023-41678 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.8
A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands via specifically crafted request.
Product
FortiOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortiguard.com
Dec 12, 2023An issue discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 allows for unauthorized password changes due to no check for current password.CVE-2023-47577 · Other software · Relyum · reported by MITRECritical 9.8
An issue discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 allows for unauthorized password changes due to no check for current password.
Product
Rely-pcie Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record relyum.com relyum.com
Dec 12, 2023The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application accCVE-2015-8314 · Other software · Heartcombo · reported by MITREHigh 7.5
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
Product
Devise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 11, 2023SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential.CVE-2023-49581 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.1
SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By doing so the attacker could increase response times of the AS ABAP, leading to mild impact on availability.
Product
SAP NetWeaver Application Server ABAP and ABAP Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Dec 11, 2023SAP GUI for Windows and SAP GUI for Java - versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, allow an unauthenticated attacker to access infoCVE-2023-49580 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.3
SAP GUI for Windows and SAP GUI for Java - versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to create Layout configurations of the ABAP List Viewer and with this causing a mild impact on integrity and availability, e.g. also increasing the response times of the AS ABAP.
Product
SAP GUI for Windows and SAP GUI for Java
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Dec 11, 2023When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS CVE-2023-46219 · Other software · curl · reported by support@hackerone.comMedium 5.3
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.
Product
curl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record curl.se hackerone.com
Dec 11, 2023An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting requeCVE-2023-42479 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting request to the Biller Direct system. This can result in the disclosure or modification of non-sensitive information.
Product
SAP Biller Direct
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Dec 11, 2023Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read potentially sensitive iCVE-2023-36648 · Other software · Prolion · reported by MITREHigh 8.2
Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read potentially sensitive information and deny service to users by directly reading and writing data in Apache Kafka (as consumer and producer).
Product
Cryptospike
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cvcn.gov.it cvcn.gov.it
Dec 11, 2023Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity ApplicationCVE-2023-48417 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 9.8
Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity Application
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Dec 8, 2023HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthentiCVE-2023-6337 · Other software · HashiCorp · reported by security@hashicorp.comHigh 7.5
HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash. Fixed in Vault 1.15.4, 1.14.8, 1.13.12.
Product
Vault
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.hashicorp.com security.netapp.com
Dec 8, 2023Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboardCVE-2023-45866 · Computers, phones & browsers · Google · reported by MITREMedium 6.3
Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record changelogs.ubuntu.com seclists.org
Dec 7, 2023Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter of index.php page, allowing an externalCVE-2023-5008 · Other software · Kashipara Group · reported by help@fluidattacks.comCritical 9.8
Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control.
Product
Student Information System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com kashipara.com
Dec 7, 2023Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application.CVE-2023-39909 · Other software · Ericsson · reported by MITREHigh 8.8
Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application.
Product
Network Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it gruppotim.it
Dec 7, 2023The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.CVE-2023-39172 · Other software · SENEC · reported by info@cert.vde.comCritical 9.1
The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.
Product
Storage Box V1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Dec 7, 2023In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data.CVE-2023-39167 · Other software · SENEC · reported by info@cert.vde.comHigh 7.5
In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data.
Product
Storage Box V1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Dec 7, 2023A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker to inject a payload via the email parametCVE-2023-48823 · Other software · Mayurik · reported by MITRECritical 9.8
A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker to inject a payload via the email parameter during login.
Product
Courier Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 7, 2023strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charCVE-2023-41913 · Other software · Strongswan · reported by MITRECritical 9.8
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
Product
Strongswan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.fedoraproject.org
Dec 6, 2023System Dashboard: Unauthorized access of dataCVE-2023-5714 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve data key specs.
Product
System Dashboard
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2023System Dashboard: Unauthorized access of dataCVE-2023-5713 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve potentially sensitive option values, and deserialize the content of those values.
Product
System Dashboard
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2023System Dashboard: Unauthorized access of dataCVE-2023-5712 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive global value information.
Product
System Dashboard
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2023System Dashboard: Unauthorized access of dataCVE-2023-5711 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information provided by PHP info.
Product
System Dashboard
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2023System Dashboard: Unauthorized access of dataCVE-2023-5710 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information such as database credentials.
Product
System Dashboard
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2023Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "hCVE-2023-45285 · Other software · Go toolchain · reported by security@golang.orgHigh 7.5
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
Product
cmd/go
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record go.dev go.dev
Dec 6, 2023Vulnerability of unauthorized file access in the Settings app.CVE-2023-49248 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Vulnerability of unauthorized file access in the Settings app. Successful exploitation of this vulnerability may cause unauthorized file access.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Dec 6, 2023Unauthorized access vulnerability in the card management module.CVE-2023-49246 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com https
Dec 6, 2023Unauthorized access vulnerability in the Huawei Share module.CVE-2023-49245 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Unauthorized access vulnerability in the Huawei Share module. Successful exploitation of this vulnerability may affect service confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Dec 6, 2023Vulnerability of unauthorized access to email attachments in the email module.CVE-2023-49243 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Vulnerability of unauthorized access to email attachments in the email module. Successful exploitation of this vulnerability may affect service confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Dec 6, 2023Unauthorized access vulnerability in the launcher module.CVE-2023-49240 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Unauthorized access vulnerability in the launcher module. Successful exploitation of this vulnerability may affect service confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Dec 6, 2023Unauthorized access vulnerability in the card management module.CVE-2023-49239 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Dec 6, 2023Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a speciallyCVE-2023-46688 · Other software · Implem Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL.
Product
Pleasanter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp pleasanter.org
Dec 6, 2023Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to incorrect filtering.CVE-2023-48849 · Other software · Ruijie · reported by MITRECritical 9.8
Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to incorrect filtering.
Product
Rg-eg1000c Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 1, 2023IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tCVE-2023-38268 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 260585.
Product
InfoSphere Information Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Nov 30, 2023In Delta Electronics InfraSuite Device Master v.1.0.7, A vulnerability exists that allows an unauthenticated attacker to disclose user information through a sinCVE-2023-47279 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.5
In Delta Electronics InfraSuite Device Master v.1.0.7, A vulnerability exists that allows an unauthenticated attacker to disclose user information through a single UDP packet, obtain plaintext credentials, or perform NTLM relaying.
Product
InfraSuite Device Master
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Nov 30, 2023ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these.CVE-2023-46326 · Other software · Zstack · reported by MITREHigh 8.8
ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these. This leads to privilege escalation.
Product
Zstack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 30, 2023 KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.CVE-2023-5909 · Other software · PTC · reported by ics-cert@hq.dhs.govHigh 7.5
KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.
Product
KEPServerEX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Nov 30, 2023In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute code with local administrator pCVE-2023-47207 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9.8
In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute code with local administrator privileges.
Product
InfraSuite Device Master
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Nov 30, 2023In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute arbitrary code through a singleCVE-2023-39226 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9.8
In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute arbitrary code through a single UDP packet.
Product
InfraSuite Device Master
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Nov 30, 2023Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attaCVE-2023-6376 · Other software · Henschen & Associates · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 5.3
Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attacker to access restricted documents.
Product
court document management software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com techcrunch.com
Nov 30, 2023Tyler Technologies Court Case Management Plus may store backups in a location that can be accessed by a remote, unauthenticated attacker.CVE-2023-6375 · Other software · Tyler Technologies · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 5.3
Tyler Technologies Court Case Management Plus may store backups in a location that can be accessed by a remote, unauthenticated attacker. Backups may contain sensitive information such as database credentials.
Product
Court Case Management Plus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com techcrunch.com
Nov 30, 2023Tyler Technologies Magistrate Court Case Management Plus allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the PDFVieCVE-2023-6354 · Other software · Tyler Technologies · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 5.3
Tyler Technologies Magistrate Court Case Management Plus allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the PDFViewer.aspx 'filename' parameter.
Product
Magistrate Court Case Management Plus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com techcrunch.com
Nov 30, 2023Tyler Technologies Civil and Criminal Electronic Filing allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the Upload.CVE-2023-6353 · Other software · Tyler Technologies · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 5.3
Tyler Technologies Civil and Criminal Electronic Filing allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the Upload.aspx 'enky' parameter.
Product
Civil and Criminal Electronic Filing
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com techcrunch.com
Nov 30, 2023Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate directories using the tiffserver/te003.aspx or te004.aspx 'CVE-2023-6344 · Other software · Tyler Technologies · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 5.3
Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate directories using the tiffserver/te003.aspx or te004.aspx 'ifolder' parameter. This behavior is related to the use of a deprecated version of Aquaforest TIFF Server, possibly 2.x. The vulnerable Aquaforest TIFF Server feature was removed on or around 2023-11-01. Insecure configuration issues in Aquaforest TIFF Server are identified separately as CVE-2023-6352. CVE-2023-6343 is related to or partially caused by CVE-2023-6352.
Product
Court Case Management Plus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com techcrunch.com
Nov 30, 2023Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate and access sensitive files using the tiffserver/tssp.aspx 'CVE-2023-6343 · Other software · Tyler Technologies · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 5.3
Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate and access sensitive files using the tiffserver/tssp.aspx 'FN' and 'PN' parameters. This behavior is related to the use of a deprecated version of Aquaforest TIFF Server, possibly 2.x. The vulnerable Aquaforest TIFF Server feature was removed on or around 2023-11-01. Insecure configuration issues in Aquaforest TIFF Server are identified separately as CVE-2023-6352. CVE-2023-6343 is similar to CVE-2020-9323. CVE-2023-6343 is related to or partially caused by CVE-2023-6352.
Product
Court Case Management Plus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com techcrunch.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.