Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,742 results · page 257 of 355
May 30, 2023Feather Login Page: Unauthorized loss of dataCVE-2023-2547 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete the temp user generated by the plugin.
- Product
- Feather Login Page
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Feather Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 30, 2023Feather Login Page: Unauthorized access of dataCVE-2023-2545 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOfUsers' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to access the login links, which can be used for privilege escalation.
- Product
- Feather Login Page
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Feather Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 30, 2023An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.CVE-2023-29745 · Other software · Bestweather Project · reported by MITREHigh 7.1
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.
- Product
- Bestweather
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a code execution attack by manipulating the database.CVE-2023-29742 · Other software · Bestweather Project · reported by MITREHigh 7.8
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a code execution attack by manipulating the database.
- Product
- Bestweather
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.CVE-2023-29743 · Other software · Bestweather Project · reported by MITREHigh 7.5
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.
- Product
- Bestweather
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause an escalation of privileges attack by manipulating the database.CVE-2023-29741 · Other software · Bestweather Project · reported by MITRECritical 9.8
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause an escalation of privileges attack by manipulating the database.
- Product
- Bestweather
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause a denial of service attack by manipulating the database.CVE-2023-29740 · Other software · Amdroidapp · reported by MITREHigh 7.5
An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause a denial of service attack by manipulating the database.
- Product
- Alarm Clock For Heavy Sleepers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordamdroidapp.comgithub.com
May 30, 2023An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the compoCVE-2023-29739 · Other software · Amdroidapp · reported by MITRECritical 9.8
An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the component.
- Product
- Alarm Clock For Heavy Sleepers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordamdroidapp.comgithub.com
May 30, 2023The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its database that is related CVE-2023-29727 · Other software · Applika · reported by MITRECritical 9.8
The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its database that is related to user privacy settings and affects the implementation of the normal functionality of the application. An attacker can use this to cause an escalation of privilege attack.
- Product
- Call Blocker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.complay.google.com
May 30, 2023There is an unauthorized access vulnerability in some ZTE mobile phones.CVE-2022-39075 · Other software · ZTE · reported by psirt@zte.com.cnHigh 7.1
There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could delete some system files without user permission.
- Product
- Blade A52 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zte.com.cnsupport.zte.com.cn
May 30, 2023There is an unauthorized access vulnerability in some ZTE mobile phones.CVE-2022-39074 · Other software · ZTE · reported by psirt@zte.com.cnLow 3.3
There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could start a non-public interface of an application without user permission.
- Product
- Blade A52 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zte.com.cnsupport.zte.com.cn
May 30, 2023There is an unauthorized access vulnerability in some ZTE mobile phones.CVE-2022-39071 · Other software · ZTE · reported by psirt@zte.com.cnHigh 7.1
There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could overwrite some system configuration files and user installers without user permission.
- Product
- Blade A52 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zte.com.cnsupport.zte.com.cn
May 30, 2023An issue found in edjing Mix v.7.09.01 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the database.CVE-2023-29734 · Other software · MWM · reported by MITRECritical 9.8
An issue found in edjing Mix v.7.09.01 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the database.
- Product
- Edjing MIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023The Lock Master app 2.2.4 for Android allows unauthorized apps to modify the values in its SharedPreference files.CVE-2023-29733 · Other software · Dualspace · reported by MITREHigh 7.8
The Lock Master app 2.2.4 for Android allows unauthorized apps to modify the values in its SharedPreference files. These files hold data that affects many app functions. Malicious modifications by unauthorized apps can cause security issues, such as functionality manipulation, resulting in a severe escalation of privilege attack.
- Product
- Lock Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2023Unauth.CVE-2023-27613 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MonitorClick Forms Ada – Form Builder plugin <= 1.0 versions.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets.CVE-2023-30570 · Other software · Libreswan · reported by MITREHigh 7.5
pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28.
- Product
- Libreswan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlibreswan.orglibreswan.org
May 28, 2023Unauth.CVE-2023-33332 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Product Vendors plugin <= 2.1.76 versions.
- Affected
- up to 2.1.76
- What to do
- Affects up to 2.1.76. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023WooCommerce WooCommerce Follow-Up Emails: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2023-33319 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.
- Product
- WooCommerce WooCommerce Follow-Up Emails
- Affected
- up to 4.9.40
- What to do
- Affects up to 4.9.40. Update WooCommerce WooCommerce Follow-Up Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Unauth.CVE-2023-32800 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in One Rank Math SEO PRO plugin <= 3.0.35 versions.
- Affected
- up to 3.0.35
- What to do
- Affects up to 3.0.35. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Unauth.CVE-2023-33326 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected (XSS) Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 2.8.6 versions.
- Fixed in
- 3.0.0
- What to do
- Update the plugin to 3.0.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Unauth.CVE-2023-33309 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Awesome Motive Duplicator Pro plugin <= 4.5.11 versions.
- Fixed in
- 4.5.11.1
- What to do
- Update the plugin to 4.5.11.1 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 26, 2023Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the servCVE-2023-33247 · Other software · Talend · reported by MITREHigh 7.5
Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. (A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog server.)
- Product
- Data Catalog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.talend.comhelp.talend.com
May 26, 2023Unauth.CVE-2023-29098 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ArtistScope CopySafe Web Protection plugin <= 3.13 versions.
- Fixed in
- 3.14
- What to do
- Update the plugin to 3.14 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 25, 2023Unauth.CVE-2022-45366 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics plugin <= 5.0.4 versions.
- Affected
- up to 5.0.4
- What to do
- Affects up to 5.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 25, 2023Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduCVE-2023-28370 · Other software · tornadoweb · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.
- Product
- Tornado
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker withCVE-2023-31458 · Email & office · Mitel · reported by MITRECritical 9.8
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2, 22.24.1500.0 could allow an unauthenticated attacker to conduct a refleCVE-2023-25599 · Email & office · Mitel · reported by MITREHigh 7.4
A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2, 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the test_presenter.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to sensitive data storedCVE-2023-33796 · Other software · Netbox · reported by MITRECritical 9.1
A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to sensitive data stored in the database. NOTE: the vendor disputes this because the reporter's only query was for the schema of the API, which is public; queries for database objects would have been denied.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via unauthenticated port access.CVE-2023-31595 · Other software · Icrealtime · reported by MITREHigh 7.5
IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via unauthenticated port access.
- Product
- Icip-p2012t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker withCVE-2023-31459 · Email & office · Mitel · reported by MITREHigh 8.8
A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attackCVE-2023-31457 · Email & office · Mitel · reported by MITRECritical 9.8
A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could allow an unauthenticCVE-2023-25598 · Email & office · Mitel · reported by MITREMedium 6.1
A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the home.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
- Product
- Mivoice Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.CVE-2021-25749 · Other software · Kubernetes · reported by jordan@liggitt.netHigh 7.8
Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.
- Product
- Kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgroups.google.comgroups.google.com
May 23, 2023Go Pricing - WordPress Responsive Pricing Tables: Unauthorized arbitrary file uploadsCVE-2023-2496 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability check on the 'validate_upload' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Go Pricing - WordPress Responsive Pricing Tables
- Affected
- up to 3.3.19
- What to do
- Affects up to 3.3.19. Update Go Pricing - WordPress Responsive Pricing Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
May 23, 2023Go Pricing - WordPress Responsive Pricing Tables: Unauthorized modification of dataCVE-2023-2494 · WordPress plugins & themes · reported by WordfenceMedium 4.6
The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_postdata' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin to modify access to the plugin when it should only be the administrator's privilege.
- Product
- Go Pricing - WordPress Responsive Pricing Tables
- Affected
- up to 3.3.19
- What to do
- Affects up to 3.3.19. Update Go Pricing - WordPress Responsive Pricing Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
May 23, 2023Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Finex Media Competition Management System allows Retrieve Embedded Sensitive CVE-2023-2703 · Other software · Finex Media · reported by iletisim@usom.gov.trHigh 7.5
Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Finex Media Competition Management System allows Retrieve Embedded Sensitive Data, Collect Data as Provided by Users. This issue affects Competition Management System: before 23.07.
- Product
- Competition Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
May 22, 2023Directory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated attacker to obtain sensitive information, altCVE-2023-28413 · Other software · Monkey Wrench Inc. · reported by vultures@jpcert.or.jpCritical 9.8
Directory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated attacker to obtain sensitive information, alter the website, or cause a denial-of-service (DoS) condition.
- Product
- Snow Monkey Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsnow-monkey.2inc.org
May 22, 2023Unrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a remote unauthenticated attacker to upload anCVE-2023-28409 · Other software · Monkey Wrench Inc. · reported by vultures@jpcert.or.jpCritical 9.8
Unrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a remote unauthenticated attacker to upload an arbitrary file.
- Product
- MW WP Form
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpplugins.2inc.org
May 22, 2023Directory traversal vulnerability in MW WP Form versions v4.4.2 and earlier allows a remote unauthenticated attacker to alter the website or cause a denial-of-sCVE-2023-28408 · Other software · Monkey Wrench Inc. · reported by vultures@jpcert.or.jpCritical 9.8
Directory traversal vulnerability in MW WP Form versions v4.4.2 and earlier allows a remote unauthenticated attacker to alter the website or cause a denial-of-service (DoS) condition, and obtain sensitive information depending on settings.
- Product
- MW WP Form
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpplugins.2inc.org
May 22, 2023 Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded credentials.CVE-2023-2504 · Other software · BirdDog · reported by ics-cert@hq.dhs.govHigh 8.4
Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded credentials.
- Product
- STUDIO R3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023 Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously unregistered devices through the RMS platCVE-2023-2586 · Other software · Teltonika · reported by ics-cert@hq.dhs.govCritical 9
Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously unregistered devices through the RMS platform. If the user has not disabled the "RMS management feature" enabled by default, then an attacker could register that device to themselves. This could enable the attacker to perform different operations on the user's devices, including remote code execution with 'root' privileges (using the 'Task Manager' feature on RMS).
- Product
- Remote Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2023Groundhogg: Unauthorized access of data and modification of dataCVE-2023-2716 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Groundhogg plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'ajax_upload_file' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload a file to the contact, and then lists all the other uploaded files related to the contact.
- Product
- Groundhogg
- Affected
- up to 2.7.9.8
- What to do
- Affects up to 2.7.9.8. Update Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2023Groundhogg: Unauthorized modification of dataCVE-2023-2715 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_ticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's data to the plugin developer, and it is also possible to create an admin access with an auto login link that is also sent to the plugin developer with the ticket. It only works if the plugin is activated with a valid license.
- Product
- Groundhogg
- Affected
- up to 2.7.9.8
- What to do
- Affects up to 2.7.9.8. Update Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2023Groundhogg: Unauthorized modification of dataCVE-2023-2714 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_license' functions in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change the license key and support license key, but it can only be changed to a valid license key.
- Product
- Groundhogg
- Affected
- up to 2.7.9.8
- What to do
- Affects up to 2.7.9.8. Update Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2023Active Debug Code vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 Serial number 2310 **** and prior allows a remote unauthenticaCVE-2023-1618 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.5
Active Debug Code vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 Serial number 2310 **** and prior allows a remote unauthenticated attacker to bypass authentication and illegally log into the affected module by connecting to it via telnet which is hidden function and is enabled by default when shipped from the factory. As a result, a remote attacker with unauthorized login can reset the module, and if certain conditions are met, he/she can disclose or tamper with the module's configuration or rewrite the firmware.
- Product
- MELSEC WS Series WS0-GETH00200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2023OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances.CVE-2023-2025 · Other software · Johnson Controls · reported by productsecurity@jci.comMedium 5
OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances.
- Product
- OpenBlue Enterprise Manager Data Collector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
May 18, 2023Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstanceCVE-2023-2024 · Other software · Johnson Controls · reported by productsecurity@jci.comCritical 10
Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstances.
- Product
- OpenBlue Enterprise Manager Data Collector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
May 18, 2023Unauth.CVE-2023-30868 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jon Christopher CMS Tree Page View plugin <= 1.6.7 versions.
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compatchstack.com
May 18, 2023Unauth.CVE-2023-30487 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ThimPress LearnPress Export Import plugin <= 4.0.2 versions.
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2023Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to causCVE-2023-20189 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with root privileges on an affected device. These vulnerabilities are due to improper validation of requests that are sent to the web interface. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco Small Business Smart and Managed Switches
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.