Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,904 results · page 26 of 59
Jan 31, 2024Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacCVE-2024-23941 · Other software · Intermesh BV · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.
- Product
- Group Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2024A vulnerability, which was classified as critical, has been found in Wanhu ezOFFICE 11.1.0.CVE-2024-1012 · Other software · Wanhu · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Wanhu ezOFFICE 11.1.0. This issue affects some unknown processing of the file defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp. The manipulation of the argument recordId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252281 was assigned to this vulnerability.
- Product
- ezOFFICE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2024Group-Office is an enterprise CRM and groupware tool.CVE-2024-22418 · Other software · Intermesh · reported by GitHubMedium 6.5
Group-Office is an enterprise CRM and groupware tool. Affected versions are subject to a vulnerability which is present in the file upload mechanism of Group Office. It allows an attacker to execute arbitrary JavaScript code by embedding it within a file's name. For instance, using a filename such as “><img src=x onerror=prompt('XSS')>.jpg” triggers the vulnerability. When this file is uploaded, the JavaScript code within the filename is executed. This issue has been addressed in version 6.8.29. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2024A vulnerability was found in CXBSoft Post-Office up to 1.0 and classified as critical.CVE-2024-0530 · Other software · CXBSoft · reported by VulDBMedium 5.5
A vulnerability was found in CXBSoft Post-Office up to 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /apps/reg_go.php of the component HTTP POST Request Handler. The manipulation of the argument username_reg leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250700. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Post-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 14, 2024A vulnerability has been found in CXBSoft Post-Office up to 1.0 and classified as critical.CVE-2024-0529 · Other software · CXBSoft · reported by VulDBMedium 5.5
A vulnerability has been found in CXBSoft Post-Office up to 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /apps/login_auth.php of the component HTTP POST Request Handler. The manipulation of the argument username_login leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250699. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Post-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 14, 2024A vulnerability, which was classified as critical, was found in CXBSoft Post-Office 1.0.CVE-2024-0528 · Other software · CXBSoft · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in CXBSoft Post-Office 1.0. Affected is an unknown function of the file /admin/pages/update_go.php of the component HTTP POST Request Handler. The manipulation of the argument version leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250698 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Post-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 5, 2024SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent parameters in the NetwoCVE-2023-39853 · Other software · Dzzoffice · reported by MITREMedium 6.5
SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent parameters in the Network Disk backend module.
- Product
- Dzzoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2023Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments.CVE-2023-47804 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution. This is a corner case of CVE-2022-47502.
- Product
- Apache OpenOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Dec 14, 2023Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when sending a SOAP message to the service on TCP port 3911 that contains a CVE-2023-4694 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.5
Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when sending a SOAP message to the service on TCP port 3911 that contains a body but no header.
- Product
- HP OfficeJet Pro Printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Dec 14, 2023JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.CVE-2023-50137 · Other software · Jfinalcms Project · reported by MITREMedium 5.4
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.
- Product
- Jfinalcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023Microsoft Word Information Disclosure VulnerabilityCVE-2023-36009 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Word Information Disclosure Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 12, 2023Microsoft Outlook Information Disclosure VulnerabilityCVE-2023-35636 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Outlook Information Disclosure Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 12, 2023Microsoft Outlook for Mac Spoofing VulnerabilityCVE-2023-35619 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.3
Microsoft Outlook for Mac Spoofing Vulnerability
- Product
- Microsoft Office LTSC for Mac 2021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 12, 2023Local privilege escalation due to DLL hijacking vulnerability.CVE-2023-48677 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40901, Acronis Cyber Protect Cloud Agent (Windows) before build 39378, Acronis Cyber Protect 16 (Windows) before build 39938, Acronis True Image OEM (Windows) before build 42575.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Dec 11, 2023Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning.CVE-2023-6186 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 8.3
Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning. In affected versions LibreOffice supports hyperlinks with macro or similar built-in command targets that can be executed when activated without warning the user.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Dec 11, 2023Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer pluginCVE-2023-6185 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 8.3
Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to run arbitrary gstreamer plugins depending on what plugins are installed on the target system.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Dec 8, 2023Collabora Online is a collaborative online office suite based on LibreOffice technology.CVE-2023-49788 · Other software · CollaboraOnline · reported by GitHubHigh 7.2
Collabora Online is a collaborative online office suite based on LibreOffice technology. Unlike a standalone dedicated Collabora Online server, the Built-in CODE Server (richdocumentscode) is run without chroot sandboxing. Vulnerable versions of the richdocumentscode app can be susceptible to attack via modified client->server commands to overwrite files outside the sub directory the server has provided for the transient session. Files which can be accessed are limited to those that the server process has access to. The bug was fixed in Collabora Online - Built-in CODE Server (richdocumentscode) release 23.5.602. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023Collabora Online is a collaborative online office suite based on LibreOffice technology.CVE-2023-49782 · Other software · CollaboraOnline · reported by GitHubHigh 7.1
Collabora Online is a collaborative online office suite based on LibreOffice technology. Users of Nextcloud with `Collabora Online - Built-in CODE Server` app can be vulnerable to attack via proxy.php. The bug was fixed in Collabora Online - Built-in CODE Server (richdocumentscode) release 23.5.601. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapps.nextcloud.comgithub.com
Dec 5, 2023Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using accCVE-2023-5970 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 8.8
Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using accent characters, resulting in an MFA bypass.
- Product
- SMA100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.compsirt.global.sonicwall.com
Dec 1, 2023Collabora Online is a collaborative online office suite based on LibreOffice technology.CVE-2023-48314 · Other software · CollaboraOnline · reported by GitHubHigh 7.1
Collabora Online is a collaborative online office suite based on LibreOffice technology. Users of Nextcloud with Collabora Online Built-in CODE Server app can be vulnerable to attack via proxy.php. This vulnerability has been fixed in Collabora Online - Built-in CODE Server (richdocumentscode) release 23.5.403. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2023In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability.CVE-2023-46887 · Other software · Iteachyou · reported by MITREHigh 7.5
In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability.
- Product
- Dreamer CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2023Command injection in `main/lp/openoffice_text_document.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote coCVE-2023-4222 · Other software · Chamilo · reported by info@starlabs.sgHigh 7.2
Command injection in `main/lp/openoffice_text_document.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters.
- Product
- Chamilo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2023Command injection in `main/lp/openoffice_presentation.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote codCVE-2023-4221 · Other software · Chamilo · reported by info@starlabs.sgHigh 7.2
Command injection in `main/lp/openoffice_presentation.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters.
- Product
- Chamilo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2023An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel file.CVE-2023-31275 · Other software · WPS · reported by talos-cna@cisco.comHigh 8.8
An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel file. A specially crafted malformed file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- WPS Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Nov 14, 2023Microsoft Office Security Feature Bypass VulnerabilityCVE-2023-36413 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Office Security Feature Bypass Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 14, 2023Microsoft Office Graphics Remote Code Execution VulnerabilityCVE-2023-36045 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Graphics Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 14, 2023Microsoft Excel Remote Code Execution VulnerabilityCVE-2023-36041 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 14, 2023Microsoft Excel Security Feature Bypass VulnerabilityCVE-2023-36037 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Security Feature Bypass Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 7, 2023Group-Office is an enterprise CRM and groupware tool.CVE-2023-46730 · Other software · Intermesh · reported by GitHubHigh 7.4
Group-Office is an enterprise CRM and groupware tool. In affected versions there is full Server-Side Request Forgery (SSRF) vulnerability in the /api/upload.php endpoint. The /api/upload.php endpoint does not filter URLs which allows a malicious user to cause the server to make resource requests to untrusted domains. Note that protocols like file:// can also be used to access the server disk. The request result (on success) can then be retrieved using /api/download.php. This issue has been addressed in versions 6.8.15, 6.7.54, and 6.6.177. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2023Microsoft OneNote Spoofing VulnerabilityCVE-2023-36769 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.6
Microsoft OneNote Spoofing Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 10, 2023Microsoft Office Elevation of Privilege VulnerabilityCVE-2023-36569 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.4
Microsoft Office Elevation of Privilege Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 10, 2023Microsoft Office Click-To-Run Elevation of Privilege VulnerabilityCVE-2023-36568 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 10, 2023Microsoft Office Graphics Elevation of Privilege VulnerabilityCVE-2023-36565 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7
Microsoft Office Graphics Elevation of Privilege Vulnerability
- Product
- Microsoft Office 2019 for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 4, 2023Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-44208 · Other software · Acronis · reported by security@acronis.comCritical 9.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40713, Acronis True Image OEM (Windows) before build 42575.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Sep 27, 2023A use-after-free vulnerability exists in the footerr functionality of Hancom Office 2020 HWord 11.0.0.7520.CVE-2023-32541 · Other software · Hancom · reported by talos-cna@cisco.comHigh 8.8
A use-after-free vulnerability exists in the footerr functionality of Hancom Office 2020 HWord 11.0.0.7520. A specially crafted .doc file can lead to a use-after-free. An attacker can trick a user into opening a malformed file to trigger this vulnerability.
- Product
- Hancom Office 2020
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 20, 2023Sensitive information disclosure due to insecure folder permissions.CVE-2023-5042 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40713, Acronis True Image OEM (Windows) before build 42575.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Sep 12, 2023Microsoft Office Spoofing VulnerabilityCVE-2023-41764 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Office Spoofing Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 12, 2023Microsoft Office Security Feature Bypass VulnerabilityCVE-2023-36767 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Office Security Feature Bypass Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 12, 2023Microsoft Excel Information Disclosure VulnerabilityCVE-2023-36766 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Information Disclosure Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 12, 2023Microsoft Office Elevation of Privilege VulnerabilityCVE-2023-36765 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Elevation of Privilege Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 12, 2023Microsoft Outlook Information Disclosure VulnerabilityCVE-2023-36763 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft Outlook Information Disclosure Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 7, 2023GIGAPOD file servers (Appliance model and Software model) provide two web interfaces, 80/tcp and 443/tcp for user operation, and 8001/tcp for administrative opeCVE-2014-5329 · Other software · TripodWorks CO.,LTD. · reported by vultures@jpcert.or.jpHigh 7.5
GIGAPOD file servers (Appliance model and Software model) provide two web interfaces, 80/tcp and 443/tcp for user operation, and 8001/tcp for administrative operation. 8001/tcp is served by a version of Apache HTTP server containing a flaw in handling HTTP requests (CVE-2011-3192), which may lead to a denial-of-service (DoS) condition.
- Product
- GIGAPOD OFFICEHARD Appliance model
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2023Local privilege escalation during installation due to improper soft link handling.CVE-2022-46869 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation during installation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis True Image OEM (Windows) before build 42575.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Aug 31, 2023Local privilege escalation due to insecure driver communication port permissions.CVE-2023-41743 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis Cyber Protect Cloud Agent (Windows) before build 31637, Acronis Cyber Protect 15 (Windows) before build 35979, Acronis True Image OEM (Windows) before build 42575.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Aug 31, 2023Local privilege escalation during recovery due to improper soft link handling.CVE-2022-46868 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation during recovery due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40173.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Aug 31, 2023Local privilege escalation due to insecure driver communication port permissions.CVE-2022-45451 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40173, Acronis Agent (Windows) before build 30600, Acronis Cyber Protect 15 (Windows) before build 30984.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Aug 25, 2023 e-Excellence U-Office Force file uploading function does not restrict upload of file with dangerous type.CVE-2023-32757 · Other software · e-Excellence · reported by twcert@cert.org.twCritical 9.8
e-Excellence U-Office Force file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker without logging the service can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.
- Product
- U-Office Force
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 25, 2023 e-Excellence U-Office Force has a path traversal vulnerability within its file uploading and downloading functions.CVE-2023-32756 · Other software · e-Excellence · reported by twcert@cert.org.twHigh 7.5
e-Excellence U-Office Force has a path traversal vulnerability within its file uploading and downloading functions. An unauthenticated remote attacker can exploit this vulnerability to read arbitrary system files, but can’t control system or disrupt service.
- Product
- U-Office Force
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 25, 2023 e-Excellence U-Office Force generates an error message in webiste service.CVE-2023-32755 · Other software · e-Excellence · reported by twcert@cert.org.twMedium 5.3
e-Excellence U-Office Force generates an error message in webiste service. An unauthenticated remote attacker can obtain partial sensitive system information from error message by sending a crafted command.
- Product
- U-Office Force
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 14, 2023A Command Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to execute aCVE-2023-39293 · Email & office · mitel · reported by MITRECritical 9.8
A Command Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to execute arbitrary commands within the context of the system.
- Product
- mivoice_office_400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.