Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,050 results · page 24 of 61
Jul 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10.CVE-2023-3531 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-3523 · Other software · gpac · reported by security@huntr.devHigh 7.1
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4.CVE-2023-3521 · Other software · fossbilling · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4.
- Product
- fossbilling/fossbilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2023Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6.CVE-2023-3520 · Other software · it-novum · reported by security@huntr.devMedium 4.6
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6.
- Product
- it-novum/openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2023Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4.CVE-2023-3515 · Other software · go-gitea · reported by security@huntr.devMedium 4.4
Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4.
- Product
- go-gitea/gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3.CVE-2023-3493 · Other software · fossbilling · reported by security@huntr.devHigh 8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3.
- Product
- fossbilling/fossbilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3.CVE-2023-3491 · Other software · fossbilling · reported by security@huntr.devHigh 8.8
Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3.
- Product
- fossbilling/fossbilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023 SQL Injection in GitHub repository fossbilling/fossbilling prior to 0.5.3.CVE-2023-3490 · Other software · fossbilling · reported by security@huntr.devCritical 9.8
SQL Injection in GitHub repository fossbilling/fossbilling prior to 0.5.3.
- Product
- fossbilling/fossbilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8.CVE-2023-3479 · Other software · hestiacp · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2.CVE-2023-3469 · Other software · thorsten · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver.CVE-2023-3358 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 28, 2023A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver.CVE-2023-3357 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver. This flaw allows a local user to crash the system.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 28, 2023A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, having any level of acceCVE-2023-2625 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comCritical 9
A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, having any level of access VIEWER to ADMIN. To exploit the vulnerability the attacker can inject shell commands through a particular field of the web user interface that will be executed by the system.
- Product
- TXpert Hub CoreTec 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jun 28, 2023Cross-site Scripting (XSS) - Stored in GitHub repository spinacms/spina prior to 2.15.1.CVE-2023-3445 · Other software · spinacms · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository spinacms/spina prior to 2.15.1.
- Product
- spinacms/spina
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2023Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9.CVE-2023-3432 · Other software · plantuml · reported by security@huntr.devCritical 10
Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9.
- Product
- plantuml/plantuml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2023Improper Access Control in GitHub repository plantuml/plantuml prior to 1.2023.9.CVE-2023-3431 · Other software · plantuml · reported by security@huntr.devMedium 5.3
Improper Access Control in GitHub repository plantuml/plantuml prior to 1.2023.9.
- Product
- plantuml/plantuml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2023Weak Password Requirements in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v 1.2.0.CVE-2023-3423 · Other software · cloudexplorer-dev · reported by security@huntr.devHigh 8.8
Weak Password Requirements in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v 1.2.0.
- Product
- cloudexplorer-dev/cloudexplorer-lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2023nothub mrpack-install <= v0.16.2 is vulnerable to Directory Traversal.CVE-2023-25307 · Other software · Mrpack-install Project · reported by MITREHigh 7.8
nothub mrpack-install <= v0.16.2 is vulnerable to Directory Traversal.
- Product
- Mrpack-install
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2023Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.CVE-2023-3398 · Other software · jgraph · reported by security@huntr.devHigh 7.5
Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1.CVE-2023-3394 · Other software · fossbilling · reported by security@huntr.devMedium 5.4
Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1.
- Product
- fossbilling/fossbilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023 Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1.CVE-2023-3393 · Other software · fossbilling · reported by security@huntr.devHigh 7.2
Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1.
- Product
- fossbilling/fossbilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.CVE-2023-3304 · Other software · admidio · reported by security@huntr.devMedium 5.4
Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.
- Product
- admidio/admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.CVE-2023-3303 · Other software · admidio · reported by security@huntr.devLow 3.5
Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.
- Product
- admidio/admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.CVE-2023-3302 · Other software · admidio · reported by security@huntr.devHigh 7.8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.
- Product
- admidio/admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2023Cross-site Scripting (XSS) - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7.CVE-2023-3294 · Other software · saleor · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7.
- Product
- saleor/react-storefront
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2023Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm-core prior to 8.3.0.CVE-2023-3293 · Other software · salesagility · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm-core prior to 8.3.0.
- Product
- salesagility/suitecrm-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2023Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a channCVE-2023-2797 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.1
Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a channel.
- Product
- Mattermost Github Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 15, 2023Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-3291 · Other software · gpac · reported by security@huntr.devLow 3.3
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023An unchecked read in NTP server in github.com/cloudflare/cfnts prior to commit 783490b https://github.com/cloudflare/cfnts/commit/783490b913f05e508a492cd7b02e3CVE-2023-3036 · Other software · Cloudflare · reported by cna@cloudflare.comHigh 8.6
An unchecked read in NTP server in github.com/cloudflare/cfnts prior to commit 783490b https://github.com/cloudflare/cfnts/commit/783490b913f05e508a492cd7b02e3c4ec2297b71 enabled a remote attacker to trigger a panic by sending an NTSAuthenticator packet with extension length longer than the packet contents.
- Product
- cfnts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023Missing Authorization in GitHub repository fossbilling/fossbilling prior to 0.5.0.CVE-2023-3230 · Other software · fossbilling · reported by security@huntr.devHigh 7.5
Missing Authorization in GitHub repository fossbilling/fossbilling prior to 0.5.0.
- Product
- fossbilling/fossbilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.CVE-2023-3229 · Other software · fossbilling · reported by security@huntr.devMedium 6.5
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.
- Product
- fossbilling/fossbilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.CVE-2023-3228 · Other software · fossbilling · reported by security@huntr.devMedium 5.7
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.
- Product
- fossbilling/fossbilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0.CVE-2023-3227 · Other software · fossbilling · reported by security@huntr.devMedium 5.7
Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0.
- Product
- fossbilling/fossbilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2023Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3.CVE-2023-3224 · Other software · nuxt · reported by security@huntr.devCritical 9.8
Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3.
- Product
- nuxt/nuxt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2023Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5.CVE-2023-3218 · Other software · it-novum · reported by security@huntr.devMedium 4.4
Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5.
- Product
- it-novum/openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2023Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0.CVE-2023-3192 · Other software · froxlor · reported by security@huntr.devMedium 5.4
Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3191 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2023Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3190 · Other software · nilsteampassnet · reported by security@huntr.devMedium 4.6
Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2023Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.CVE-2023-3188 · Other software · owncast · reported by security@huntr.devMedium 6.5
Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.
- Product
- owncast/owncast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2023Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.CVE-2023-3173 · Other software · froxlor · reported by security@huntr.devCritical 9.8
Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2023Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.CVE-2023-3172 · Other software · froxlor · reported by security@huntr.devHigh 7.2
Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2023The filename parameter of the Context.FileAttachment function is not properly sanitized.CVE-2023-29401 · Other software · github.com/gin-gonic/gin · reported by security@golang.orgMedium 4.3
The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat". If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.
- Product
- github.com/gin-gonic/gin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.CVE-2023-3142 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking.CVE-2023-3140 · Other software · KNIME · reported by security@knime.comMedium 4.3
Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server.
- Product
- KNIME Business Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host nCVE-2023-2541 · Other software · KNIME · reported by security@knime.comMedium 5.3
The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host names, or IP addresses. No personal information or application data was exposed.
- Product
- KNIME Business Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerability which allows for arbitrary code execuCVE-2023-34111 · Other software · taosdata · reported by GitHubHigh 8.1
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerability which allows for arbitrary code execution within the github action context due to the insecure usage of `${{ github.event.pull_request.title }}` in a bash command within the GitHub workflow. Attackers can inject malicious commands which will be executed by the workflow. This happens because `${{ github.event.pull_request.title }}` is directly passed to bash command on like 25 of the workflow. This may allow an attacker to gain access to secrets which the github action has access to or to otherwise make use of the compute resources.
- Product
- grafanaplugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository admidio/admidio prior to 4.2.8.CVE-2023-3109 · Other software · admidio · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository admidio/admidio prior to 4.2.8.
- Product
- admidio/admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2023Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3095 · Other software · nilsteampassnet · reported by security@huntr.devMedium 6.5
Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3086 · Other software · nilsteampassnet · reported by security@huntr.devCritical 9
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3084 · Other software · nilsteampassnet · reported by security@huntr.devHigh 8.1
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.