Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,050 results · page 27 of 61
Apr 24, 2023Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.CVE-2023-2258 · Other software · alfio-event · reported by security@huntr.devHigh 8.8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
- Product
- alfio-event/alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access toCVE-2023-2257 · Other software · Devolutions · reported by security@devolutions.netHigh 7.8
Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented "Force Login" security feature. This vulnerability occurs only if "Force Login" feature is enabled on the Hub Business instance and that an attacker has access to a locked Workspace desktop application configured with a Hub Business space.
- Product
- Workspace Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Apr 24, 2023Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5.CVE-2023-2251 · Other software · eemeli · reported by security@huntr.devHigh 7.5
Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5.
- Product
- eemeli/yaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing CVE-2022-48477 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.1
In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Apr 22, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1875 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2023Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.CVE-2023-2239 · Other software · microweber · reported by security@huntr.devMedium 6.5
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2023Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.CVE-2023-2240 · Other software · microweber · reported by security@huntr.devHigh 8.8
Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2023Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.CVE-2023-2228 · Other software · modoboa · reported by security@huntr.devMedium 6.8
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.
- Product
- modoboa/modoboa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2023Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.CVE-2023-2227 · Other software · modoboa · reported by security@huntr.devCritical 9.1
Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.
- Product
- modoboa/modoboa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8.CVE-2023-1892 · Other software · sidekiq · reported by security@huntr.devCritical 9.6
Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8.
- Product
- sidekiq/sidekiq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2023Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3.CVE-2023-2202 · Other software · francoisjacquet · reported by security@huntr.devMedium 6.5
Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3.
- Product
- francoisjacquet/rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2023Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18.CVE-2023-2191 · Other software · azuracast · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18.
- Product
- azuracast/azuracast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: Routing Hub).CVE-2023-21905 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: Routing Hub). Supported versions that are affected are 14.5, 14.6 and 14.7. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Banking Virtual Account Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Virtual Account Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Banking Virtual Account Management accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N).
- Product
- Banking Virtual Account Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.CVE-2023-2160 · Other software · modoboa · reported by security@huntr.devMedium 6.3
Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.
- Product
- modoboa/modoboa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2023Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2.CVE-2023-2138 · Other software · nuxtlabs · reported by security@huntr.devCritical 9.8
Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2.
- Product
- nuxtlabs/github-module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2023Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repoCVE-2023-2017 · Other software · Shopware AG · reported by info@starlabs.sgHigh 8.8
Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing callables. Users are advised to upgrade to v6.4.20.1 to resolve this issue. This is a bypass of CVE-2023-22731.
- Product
- Shopware 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Apr 16, 2023Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0.CVE-2023-2109 · Other software · chatwoot · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.CVE-2023-2106 · Other software · janeczku · reported by security@huntr.devCritical 9.8
Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-2105 · Other software · alextselegidis · reported by security@huntr.devHigh 8.8
Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- Product
- alextselegidis/easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-2104 · Other software · alextselegidis · reported by security@huntr.devMedium 5.4
Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- Product
- alextselegidis/easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-2103 · Other software · alextselegidis · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- Product
- alextselegidis/easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-2102 · Other software · alextselegidis · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- Product
- alextselegidis/easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20.CVE-2022-2525 · Other software · janeczku · reported by security@huntr.devCritical 9.8
Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2023Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.CVE-2023-2034 · Other software · froxlor · reported by security@huntr.devHigh 8.8
Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.3.CVE-2023-2021 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.3.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3.CVE-2023-2014 · Other software · microweber · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023Password Aging with Long Expiration in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1976 · Other software · answerdev · reported by security@huntr.devHigh 8.8
Password Aging with Long Expiration in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023Insertion of Sensitive Information Into Sent Data in GitHub repository answerdev/answer prior to 1.0.8.CVE-2023-1975 · Other software · answerdev · reported by security@huntr.devMedium 6.5
Insertion of Sensitive Information Into Sent Data in GitHub repository answerdev/answer prior to 1.0.8.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8.CVE-2023-1974 · Other software · answerdev · reported by security@huntr.devMedium 6.5
Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2023An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff.CVE-2023-23762 · Other software · GitHub · reported by product-cna@github.comMedium 6.5
An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff. To do so, an attacker would need write access to the repository and be able to correctly guess the target branch before it’s created by the code maintainer. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.9 and was fixed in versions 3.4.18, 3.5.15, 3.6.11, 3.7.8, and 3.8.1. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Apr 7, 2023An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other users' secret gists by auCVE-2023-23761 · Other software · GitHub · reported by product-cna@github.comHigh 7.7
An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other users' secret gists by authenticating through an SSH certificate authority. To do so, a user had to know the secret gist's URL. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.9 and was fixed in versions 3.4.18, 3.5.15, 3.6.11, 3.7.8, and 3.8.1. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Apr 5, 2023Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1887 · Other software · thorsten · reported by security@huntr.devMedium 4.3
Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1886 · Other software · thorsten · reported by security@huntr.devHigh 7.3
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1885 · Other software · thorsten · reported by security@huntr.devMedium 6.3
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1884 · Other software · thorsten · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1883 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1882 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.CVE-2023-1881 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1880 · Other software · thorsten · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1879 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1878 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Command Injection in GitHub repository microweber/microweber prior to 1.3.3.CVE-2023-1877 · Other software · microweber · reported by security@huntr.devCritical 9.8
Command Injection in GitHub repository microweber/microweber prior to 1.3.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.CVE-2023-1788 · Other software · firefly-iii · reported by security@huntr.devCritical 9.8
Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.
- Product
- firefly-iii/firefly-iii
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1758 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1757 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1756 · Other software · thorsten · reported by security@huntr.devMedium 4.7
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2023Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.CVE-2023-1789 · Other software · firefly-iii · reported by security@huntr.devCritical 9.8
Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.
- Product
- firefly-iii/firefly-iii
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2023cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C.CVE-2023-26485 · Other software · github · reported by GitHubMedium 5.3
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `_` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources. ### Impact A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. ### Proof of concept ``` $ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad, end="")' | time ./build/src/cmark-gfm --to plaintext ``` Increasing the number 10000 in the above commands causes the running time to increase quadratically. ### Patches This vulnerability have been patched in 0.29.0.gfm.10. ### Note on cmark and cmark-gfm XXX: TBD [cmark-gfm](https://github.com/github/cmark-gfm) is a fork of [cmark](https://github.com/commonmark/cmark) that adds the GitHub Flavored Markdown extensions. The two codebases hav
- Product
- cmark-gfm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2023cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C.CVE-2023-24824 · Other software · github · reported by GitHubMedium 5.3
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.
- Product
- cmark-gfm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1762 · Other software · thorsten · reported by security@huntr.devHigh 8.8
Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.