Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,050 results · page 26 of 61
May 17, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.CVE-2023-2752 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.CVE-2023-2730 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2674 · Other software · openemr · reported by security@huntr.devMedium 4.3
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16.CVE-2023-2666 · Other software · froxlor · reported by security@huntr.devHigh 7.5
Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.CVE-2023-2665 · Other software · francoisjacquet · reported by security@huntr.devHigh 7.5
Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.
- Product
- francoisjacquet/rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2630 · Other software · pimcore · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.CVE-2023-2629 · Other software · pimcore · reported by security@huntr.devHigh 7.8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.
- Product
- pimcore/customer-data-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2615 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2614 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2616 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.CVE-2023-2610 · Other software · vim · reported by security@huntr.devHigh 7.8
Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Failure to unmap certain SysHub mappings in error paths of the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious bootloader to exhausCVE-2021-46755 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Failure to unmap certain SysHub mappings in error paths of the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious bootloader to exhaust the SysHub resources resulting in a potential denial of service.
- Product
- Ryzen™ 3000 Series Desktop Processors “Matisse” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Failure to validate the length fields of the ASP (AMD Secure Processor) sensor fusion hub headers may allow an attacker with a malicious Uapp or ABL to map the CVE-2021-46753 · Other software · AMD · reported by psirt@amd.comCritical 9.1
Failure to validate the length fields of the ASP (AMD Secure Processor) sensor fusion hub headers may allow an attacker with a malicious Uapp or ABL to map the ASP sensor fusion hub region and overwrite data structures leading to a potential loss of confidentiality and integrity.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.CVE-2023-2609 · Other software · vim · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.CVE-2023-2591 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Missing Authorization in GitHub repository answerdev/answer prior to 1.0.9.CVE-2023-2590 · Other software · answerdev · reported by security@huntr.devLow 3.5
Missing Authorization in GitHub repository answerdev/answer prior to 1.0.9.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3.CVE-2023-2583 · Other software · jsreport · reported by security@huntr.devCritical 10
Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3.
- Product
- jsreport/jsreport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2566 · Other software · openemr · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2023OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0.CVE-2023-2564 · Other software · sbs20 · reported by security@huntr.devCritical 10
OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0.
- Product
- sbs20/scanservjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2023External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0.CVE-2023-2554 · Other software · unilogies · reported by security@huntr.devHigh 7.2
External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0.
- Product
- unilogies/bumsys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository unilogies/bumsys prior to 2.2.0.CVE-2023-2553 · Other software · unilogies · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository unilogies/bumsys prior to 2.2.0.
- Product
- unilogies/bumsys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2023Cross-Site Request Forgery (CSRF) in GitHub repository unilogies/bumsys prior to 2.1.1.CVE-2023-2552 · Other software · unilogies · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository unilogies/bumsys prior to 2.1.1.
- Product
- unilogies/bumsys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2023PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1.CVE-2023-2551 · Other software · unilogies · reported by security@huntr.devHigh 8.8
PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1.
- Product
- unilogies/bumsys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.CVE-2023-2550 · Other software · thorsten · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7.CVE-2023-2516 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13.CVE-2023-2427 · Other software · thorsten · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2023Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.CVE-2023-2531 · Other software · azuracast · reported by security@huntr.devCritical 9.8
Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.
- Product
- azuracast/azuracast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2023Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted reqCVE-2023-26125 · Other software · Gin-gonic · reported by report@snyk.ioMedium 5.6
Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning. **Note:** Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic.
- Product
- GIN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2023OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.CVE-2023-2479 · Other software · appium · reported by security@huntr.devCritical 9.8
OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.
- Product
- appium/appium-desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2023Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.CVE-2023-2429 · Other software · thorsten · reported by security@huntr.devCritical 9.8
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.CVE-2023-2428 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2023Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499.CVE-2023-2426 · Other software · vim · reported by security@huntr.devMedium 5.3
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow.CVE-2023-30853 · Other software · gradle · reported by GitHubHigh 7.6
Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using the Gradle Build Action prior to version 2.4.2 that have executed the Gradle Build Tool with the configuration cache enabled, potentially exposing secrets configured for the repository. Secrets configured for GitHub Actions are normally passed to the Gradle Build Tool via environment variables. Due to the way that the Gradle Build Tool records these environment variables, they may be persisted into an entry in the GitHub Actions cache. This data stored in the GitHub Actions cache can be read by a GitHub Actions workflow running in an untrusted context, such as that running for a Pull Request submitted by a developer via a repository fork. This vulnerability was discovered internally through code review, and we have not seen any evidence of it being exploited in the wild. However, in addition to upgrading the Gradle Build Action, affected users should delete any potentially vulnerable cache entries and may choose to rotate any potentially affected secrets. Gradle Build Action v2.4.2 and newer no longer saves this sensitive data for later use,
- Product
- gradle-build-action
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2361 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.CVE-2023-2356 · Other software · mlflow · reported by security@huntr.devHigh 7.5
Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.
- Product
- mlflow/mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2343 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2342 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2341 · Other software · pimcore · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2340 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2339 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2338 · Other software · pimcore · reported by security@huntr.devHigh 8.8
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2336 · Other software · pimcore · reported by security@huntr.devMedium 6.5
Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2328 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2327 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2323 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2322 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.CVE-2023-2307 · Other software · builderio · reported by security@huntr.devMedium 4.7
Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.
- Product
- builderio/qwik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023`embano1/wip` is a GitHub Action written in Bash.CVE-2023-30623 · Other software · embano1 · reported by GitHubHigh 8.8
`embano1/wip` is a GitHub Action written in Bash. Prior to version 2, the `embano1/wip` action uses the `github.event.pull_request.title` parameter in an insecure way. The title parameter is used in a run statement - resulting in a command injection vulnerability due to string interpolation. This vulnerability can be triggered by any user on GitHub. They just need to create a pull request with a commit message containing an exploit. (Note that first-time PR requests will not be run - but the attacker can submit a valid PR before submitting an invalid PR). The commit can be genuine, but the commit message can be malicious. This can be used to execute code on the GitHub runners and can be used to exfiltrate any secrets used in the CI pipeline, including repository tokens. Version 2 has a fix for this issue.
- Product
- wip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.CVE-2023-2260 · Other software · alfio-event · reported by security@huntr.devHigh 8.8
Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
- Product
- alfio-event/alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.CVE-2023-2259 · Other software · alfio-event · reported by security@huntr.devHigh 7.2
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
- Product
- alfio-event/alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.