Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,654 results · page 26 of 54
Jul 1, 2023Event Espresso 4 Decaf: Cross-Site Request ForgeryCVE-2021-4404 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event Espresso 4 Decaf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.11. This is due to missing or incorrect nonce validation on the ajaxHandler() function. This makes it possible for unauthenticated attackers to op into notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Event Espresso 4 Decaf
- Affected
- up to 4.10.11
- What to do
- Affects up to 4.10.11. Update Event Espresso 4 Decaf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jun 28, 2023Ericsson Network Manager (ENM), versions prior to 22.1, contains a vulnerability in the application Network Connectivity Manager (NCM) where improper NeutralizaCVE-2022-46408 · Other software · Ericsson · reported by MITREMedium 6.8
Ericsson Network Manager (ENM), versions prior to 22.1, contains a vulnerability in the application Network Connectivity Manager (NCM) where improper Neutralization of Formula Elements in a CSV File can lead to remote code execution or data leakage via maliciously injected hyperlinks. The attacker would need admin/elevated access to exploit the vulnerability.
- Product
- Network Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Jun 28, 2023Ericsson Network Manager (ENM), versions prior to 22.2, contains a vulnerability in the REST endpoint “editprofile” where Open Redirect HTTP Header Injection caCVE-2022-46407 · Other software · Ericsson · reported by MITREMedium 4.8
Ericsson Network Manager (ENM), versions prior to 22.2, contains a vulnerability in the REST endpoint “editprofile” where Open Redirect HTTP Header Injection can lead to redirection of the submitted request to domain out of control of ENM deployment. The attacker would need admin/elevated access to exploit the vulnerability
- Product
- Network Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Jun 28, 2023In onCreate of UsbAccessoryUriActivity.java, there is a possible way to escape the Setup Wizard due to a logic error in the code.CVE-2023-21187 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onCreate of UsbAccessoryUriActivity.java, there is a possible way to escape the Setup Wizard due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-246542917
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 23, 2023Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.CVE-2023-30258 · Other software · Magnussolution · reported by MITRECritical 9.8
Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.
- Product
- Magnusbilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comeldstal.se
Jun 22, 2023A limited SQL injection risk was identified on the Mnet SSO access control page.CVE-2023-35132 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.3
A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.fedoraproject.org
Jun 15, 2023In onNullBinding of CallRedirectionProcessor.java, there is a possible long lived connection due to improper input validation.CVE-2023-21138 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onNullBinding of CallRedirectionProcessor.java, there is a possible long lived connection due to improper input validation. This could lead to local escalation of privilege and background activity launches with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-273260090
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 15, 2023snappy-java is a fast compressor/decompressor for Java.CVE-2023-34455 · Other software · xerial · reported by GitHubHigh 7.5
snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in versions prior to 1.1.10.1. The code in the function hasNextChunk in the fileSnappyInputStream.java checks if a given stream has more chunks to read. It does that by attempting to read 4 bytes. If it wasn’t possible to read the 4 bytes, the function returns false. Otherwise, if 4 bytes were available, the code treats them as the length of the next chunk. In the case that the `compressed` variable is null, a byte array is allocated with the size given by the input data. Since the code doesn’t test the legality of the `chunkSize` variable, it is possible to pass a negative number (such as 0xFFFFFFFF which is -1), which will cause the code to raise a `java.lang.NegativeArraySizeException` exception. A worse case would happen when passing a huge positive value (such as 0x7FFFFFFF), which would raise the fatal `java.lang.OutOfMemoryError` error. Version 1.1.10.1 contains a patch for this issue.
- Product
- snappy-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2023snappy-java is a fast compressor/decompressor for Java.CVE-2023-34454 · Other software · xerial · reported by GitHubMedium 5.9
snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing an unrecoverable fatal error. The function `compress(char[] input)` in the file `Snappy.java` receives an array of characters and compresses it. It does so by multiplying the length by 2 and passing it to the rawCompress` function. Since the length is not tested, the multiplication by two can cause an integer overflow and become negative. The rawCompress function then uses the received length and passes it to the natively compiled maxCompressedLength function, using the returned value to allocate a byte array. Since the maxCompressedLength function treats the length as an unsigned integer, it doesn’t care that it is negative, and it returns a valid value, which is casted to a signed integer by the Java engine. If the result is negative, a `java.lang.NegativeArraySizeException` exception will be raised while trying to allocate the array `buf`. On the other side, if the result is positive, the `buf` array will successfully be allocated, but its size might be too small to use for the compression, causing a fatal Access Violat
- Product
- snappy-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2023snappy-java is a fast compressor/decompressor for Java.CVE-2023-34453 · Other software · xerial · reported by GitHubMedium 5.9
snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing a fatal error. The function `shuffle(int[] input)` in the file `BitShuffle.java` receives an array of integers and applies a bit shuffle on it. It does so by multiplying the length by 4 and passing it to the natively compiled shuffle function. Since the length is not tested, the multiplication by four can cause an integer overflow and become a smaller value than the true size, or even zero or negative. In the case of a negative value, a `java.lang.NegativeArraySizeException` exception will raise, which can crash the program. In a case of a value that is zero or too small, the code that afterwards references the shuffled array will assume a bigger size of the array, which might cause exceptions such as `java.lang.ArrayIndexOutOfBoundsException`. The same issue exists also when using the `shuffle` functions that receive a double, float, long and short, each using a different multiplier that may cause the same issue. Version 1.1.10.1 contains a patch for this vulnerability.
- Product
- snappy-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an autheCVE-2023-34212 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
- Product
- Apache NiFi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Jun 8, 2023snowflake-connector-nodejs, a NodeJS driver for Snowflake, is vulnerable to command injection via single sign on (SSO) browser URL authentication in versions prCVE-2023-34232 · Other software · snowflakedb · reported by GitHubHigh 7.3
snowflake-connector-nodejs, a NodeJS driver for Snowflake, is vulnerable to command injection via single sign on (SSO) browser URL authentication in versions prior to 1.6.21. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources. Version 1.6.21 contains a patch for this issue.
- Product
- snowflake-connector-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.snowflake.comgithub.com
Jun 8, 2023snowflake-connector-net, the Snowflake Connector for .NET, is vulnerable to command injection prior to version 2.0.18 via SSO URL authentication.CVE-2023-34230 · Other software · snowflakedb · reported by GitHubHigh 7.3
snowflake-connector-net, the Snowflake Connector for .NET, is vulnerable to command injection prior to version 2.0.18 via SSO URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources. Version 2.0.18 fixes this issue.
- Product
- snowflake-connector-net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023Mishandling of guest SSBD selection on AMD hardware The current logic to set SSBD on AMD Family 17h and Hygon Family 18h processors requires that the setting ofCVE-2022-42336 · Other software · Xen · reported by security@xen.orgLow 3.3
Mishandling of guest SSBD selection on AMD hardware The current logic to set SSBD on AMD Family 17h and Hygon Family 18h processors requires that the setting of SSBD is coordinated at a core level, as the setting is shared between threads. Logic was introduced to keep track of how many threads require SSBD active in order to coordinate it, such logic relies on using a per-core counter of threads that have SSBD active. When running on the mentioned hardware, it's possible for a guest to under or overflow the thread counter, because each write to VIRT_SPEC_CTRL.SSBD by the guest gets propagated to the helper that does the per-core active accounting. Underflowing the counter causes the value to get saturated, and thus attempts for guests running on the same core to set SSBD won't have effect because the hypervisor assumes it's already active.
- Product
- xen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgxenbits.xenproject.org
May 16, 2023A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST requeCVE-2023-32996 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails.
- Product
- Jenkins SAML Single Sign On(SSO) Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request witCVE-2023-32995 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails.
- Product
- Jenkins SAML Single Sign On(SSO) Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configureCVE-2023-32994 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comLow 3.7
Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.
- Product
- Jenkins SAML Single Sign On(SSO) Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SCVE-2023-32993 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.8
Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.
- Product
- Jenkins SAML Single Sign On(SSO) Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to aCVE-2023-32992 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML.
- Product
- Jenkins SAML Single Sign On(SSO) Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an HTTP request to an atCVE-2023-32991 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML.
- Product
- Jenkins SAML Single Sign On(SSO) Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Exposure of resource to wrong sphere in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via CVE-2022-38087 · Other software · Intel · reported by secure@intel.comMedium 4.1
Exposure of resource to wrong sphere in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
- Product
- Xeon E-2314 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
May 10, 2023Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local CVE-2022-33894 · Other software · Intel · reported by secure@intel.comHigh 7.5
Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Xeon E-2314 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
May 9, 2023Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox checksum calculationCVE-2021-46794 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox checksum calculation triggering a data abort, resulting in a potential denial of service.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Time-of-check Time-of-use (TOCTOU) in the BIOS2PSP command may allow an attacker with a malicious BIOS to create a race condition causing the ASP bootloader to CVE-2021-46792 · Other software · AMD · reported by psirt@amd.comMedium 5.9
Time-of-check Time-of-use (TOCTOU) in the BIOS2PSP command may allow an attacker with a malicious BIOS to create a race condition causing the ASP bootloader to perform out-of-bounds SRAM reads upon an S3 resume event potentially leading to a denial of service.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient input validation in ABL may enable a privileged attacker to corrupt ASP memory, potentially resulting in a loss of integrity or code execution.CVE-2021-46773 · Other software · AMD · reported by psirt@amd.comHigh 8.8
Insufficient input validation in ABL may enable a privileged attacker to corrupt ASP memory, potentially resulting in a loss of integrity or code execution.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient input validation in ASP may allow an attacker with a compromised SMM to induce out-of-bounds memory reads within the ASP, potentially leading to a CVE-2021-46765 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Insufficient input validation in ASP may allow an attacker with a compromised SMM to induce out-of-bounds memory reads within the ASP, potentially leading to a denial of service.
- Product
- Ryzen™ 5000 Series Desktop processor with Radeon™ Graphics “Cezanne” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory access that may potentialCVE-2021-46760 · Other software · AMD · reported by psirt@amd.comCritical 9.8
A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory access that may potentially lead to an attacker leaking sensitive information or achieving code execution.
- Product
- 3rd Gen AMD Ryzen™ Threadripper™ Processors “Castle Peak” HEDT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Improper syscall input validation in AMD TEE (Trusted Execution Environment) may allow an attacker with physical access and control of a Uapp that runs under thCVE-2021-46759 · Other software · AMD · reported by psirt@amd.comMedium 6.1
Improper syscall input validation in AMD TEE (Trusted Execution Environment) may allow an attacker with physical access and control of a Uapp that runs under the bootloader to reveal the contents of the ASP (AMD Secure Processor) bootloader accessible memory to a serial port, resulting in a potential loss of integrity.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient validation of inputs in SVC_MAP_USER_STACK in the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious Uapp or ABL to send CVE-2021-46756 · Other software · AMD · reported by psirt@amd.comCritical 9.1
Insufficient validation of inputs in SVC_MAP_USER_STACK in the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious Uapp or ABL to send malformed or invalid syscall to the bootloader resulting in a potential denial of service and loss of integrity.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Failure to unmap certain SysHub mappings in error paths of the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious bootloader to exhausCVE-2021-46755 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Failure to unmap certain SysHub mappings in error paths of the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious bootloader to exhaust the SysHub resources resulting in a potential denial of service.
- Product
- Ryzen™ 3000 Series Desktop Processors “Matisse” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient input validation in the ASP (AMD Secure Processor) bootloader may allow an attacker with a compromised Uapp or ABL to coerce the bootloader into exCVE-2021-46754 · Other software · AMD · reported by psirt@amd.comCritical 9.1
Insufficient input validation in the ASP (AMD Secure Processor) bootloader may allow an attacker with a compromised Uapp or ABL to coerce the bootloader into exposing sensitive information to the SMU (System Management Unit) resulting in a potential loss of confidentiality and integrity.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Failure to validate the length fields of the ASP (AMD Secure Processor) sensor fusion hub headers may allow an attacker with a malicious Uapp or ABL to map the CVE-2021-46753 · Other software · AMD · reported by psirt@amd.comCritical 9.1
Failure to validate the length fields of the ASP (AMD Secure Processor) sensor fusion hub headers may allow an attacker with a malicious Uapp or ABL to map the ASP sensor fusion hub region and overwrite data structures leading to a potential loss of confidentiality and integrity.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox checksum calculationCVE-2021-46749 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox checksum calculation triggering a data abort, resulting in a potential denial of service.
- Product
- Ryzen™ 2000 Series Desktop Processors “Pinnacle Ridge”
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient validation in parsing Owner's Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted Virtualization) and SEV-ES user application canCVE-2021-26406 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Insufficient validation in parsing Owner's Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted Virtualization) and SEV-ES user application can lead to a host crash potentially resulting in denial of service.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to userspace, potentially lCVE-2021-26371 · Other software · AMD · reported by psirt@amd.comMedium 5.5
A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to userspace, potentially leading to information disclosure.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading to denial of service or potentially limiteCVE-2021-26365 · Other software · AMD · reported by psirt@amd.comHigh 8.2
Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading to denial of service or potentially limited leakage of information about out-of-bounds memory contents.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and informCVE-2021-26356 · Other software · AMD · reported by psirt@amd.comHigh 7.4
A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and information disclosure.
- Product
- Ryzen™ 3000 Series Desktop Processors “Matisse” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary memory values to be initializeCVE-2021-26354 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary memory values to be initialized to zero, potentially leading to a loss of integrity.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insecure Permissons vulnerability found in Shop_CMS YerShop all versions allows a remote attacker to escalate privileges via the cover_id parameter.CVE-2020-23362 · Other software · Yershop Project · reported by MITREHigh 7.1
Insecure Permissons vulnerability found in Shop_CMS YerShop all versions allows a remote attacker to escalate privileges via the cover_id parameter.
- Product
- Yershop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect useCVE-2023-31406 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.
- Product
- SAP BusinessObjects Business Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
May 8, 2023Under certain conditions, SAP BusinessObjects Business Intelligence Platform (Central Management Service) - versions 420, 430, allows an attacker to access infoCVE-2023-31404 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (Central Management Service) - versions 420, 430, allows an attacker to access information which would otherwise be restricted. Some users with specific privileges could have access to credentials of other users. It could let them access data sources which would otherwise be restricted.
- Product
- SAP BusinessObjects Business Intelligence Platform (Central Management Service)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
May 8, 2023Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect useCVE-2023-30741 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.
- Product
- SAP BusinessObjects Business Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
May 8, 2023SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restCVE-2023-30740 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.3
SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality, limited impact on integrity and availability of the application.
- Product
- SAP BusinessObjects Business Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
May 8, 2023An issue was discovered in Exynos Mobile Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, and Exynos 1080.CVE-2023-29092 · Computers, phones & browsers · Samsung · reported by MITRELow 3.1
An issue was discovered in Exynos Mobile Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, and Exynos 1080. Binding of a wrong resource can occur due to improper handling of parameters while binding a network interface.
- Product
- Exynos 5123 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
May 8, 2023SAP BusinessObjects Platform - versions 420, 430, Information design tool transmits sensitive information as cleartext in the binaries over the network.CVE-2023-28764 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.7
SAP BusinessObjects Platform - versions 420, 430, Information design tool transmits sensitive information as cleartext in the binaries over the network. This could allow an unauthenticated attacker with deep knowledge to gain sensitive information such as user credentials and domain names, which may have a low impact on confidentiality and no impact on the integrity and availability of the system.
- Product
- SAP BusinessObjects Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordi7p.wdf.sap.corpsap.com
May 8, 2023SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker with administrator privileges to get the login token ofCVE-2023-28762 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker with administrator privileges to get the login token of any logged-in BI user over the network without any user interaction. The attacker can impersonate any user on the platform resulting into accessing and modifying data. The attacker can also make the system partially or entirely unavailable.
- Product
- SAP BusinessObjects Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Apr 19, 2023In OnWakelockReleased of attribution_processor.cc, there is a use after free that could lead to remote code execution with no additional execution privileges neCVE-2023-21096 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In OnWakelockReleased of attribution_processor.cc, there is a use after free that could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-254774758
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 19, 2023In acc_ctrlrequest_composite of f_accessory.c, there is a possible out of bounds write due to a missing bounds check.CVE-2023-20941 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.6
In acc_ctrlrequest_composite of f_accessory.c, there is a possible out of bounds write due to a missing bounds check. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-264029575References: Upstream kernel
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 18, 2023An issue was discovered in the controller unit of the OpenRISC mor1kx processor.CVE-2021-41614 · Other software · Openrisc · reported by MITREHigh 7.8
An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program Counter Register (EPCR) are not implemented correctly. User programs from an unauthorized privilege level can make read/write accesses to EPCR.
- Product
- Mor1kx Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comseth.engr.tamu.edu
Apr 18, 2023An issue was discovered in the controller unit of the OpenRISC mor1kx processor.CVE-2021-41613 · Other software · Openrisc · reported by MITREMedium 4.3
An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The write logic of Exception Effective Address Register (EEAR) is not implemented correctly. User programs from authorized privilege levels will be unable to write to EEAR.
- Product
- Mor1kx Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comseth.engr.tamu.edu
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.