Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,767 results · page 277 of 356
Jun 2, 2022A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when an attacker uses cross-domain attacks.CVE-2022-30236 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.2
A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when an attacker uses cross-domain attacks. Affected Products: Wiser Smart, EER21000 & EER21001 (V4.5 and prior)
- Product
- Wiser Smart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized access when an attacker uses brute forceCVE-2022-30235 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.6
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized access when an attacker uses brute force. Affected Products: Wiser Smart, EER21000 & EER21001 (V4.5 and prior)
- Product
- Wiser Smart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC.CVE-2022-24581 · Other software · Aceware · reported by MITREHigh 7.5
ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software.
- Product
- Aceweb Online Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaceware.comaceware.com
May 27, 2022The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.CVE-2021-27780 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
- Product
- HCL BigFix Mobile / Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 27, 2022Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remotCVE-2022-20674 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
- Product
- Cisco Common Services Platform Collector Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 27, 2022Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remotCVE-2022-20673 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
- Product
- Cisco Common Services Platform Collector Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 27, 2022Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remotCVE-2022-20672 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
- Product
- Cisco Common Services Platform Collector Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 27, 2022Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remotCVE-2022-20671 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
- Product
- Cisco Common Services Platform Collector Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 27, 2022Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remotCVE-2022-20670 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
- Product
- Cisco Common Services Platform Collector Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 27, 2022Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remotCVE-2022-20669 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
- Product
- Cisco Common Services Platform Collector Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 27, 2022Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remotCVE-2022-20668 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
- Product
- Cisco Common Services Platform Collector Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 27, 2022Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remotCVE-2022-20667 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
- Product
- Cisco Common Services Platform Collector Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 27, 2022Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remotCVE-2022-20666 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
- Product
- Cisco Common Services Platform Collector Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 26, 2022This issue was addressed with improved checks to prevent unauthorized actions.CVE-2022-22663 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 15.4 and iPadOS 15.4, Security Update 2022-004 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.6. A malicious application may bypass Gatekeeper checks.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
May 25, 2022Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.CVE-2022-1815 · Other software · jgraph · reported by security@huntr.devHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed security token.CVE-2022-22497 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed security token. IBM X-Force ID: 226951.
- Product
- Aspera Faspex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 24, 2022The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface.CVE-2022-22309 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.8
The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface. This vulnerability can be more critical if the serial port is connected to a serial-over-lan device. IBM X-Force ID: 217095.
- Product
- Power System S922 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 24, 2022A vulnerability in the Spectrum Scale 5.1 core component and IBM Elastic Storage System 6.1 could allow unauthorized access to user data or injection of arbitraCVE-2020-4926 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.1
A vulnerability in the Spectrum Scale 5.1 core component and IBM Elastic Storage System 6.1 could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. IBM X-Force ID: 191600.
- Product
- Spectrum Scale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 24, 2022In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a cookie value.CVE-2021-45915 · Other software · Luxsoft · reported by MITRECritical 9.8
In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a cookie value. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator.
- Product
- Luxcal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comh1pmnh.github.io
May 24, 2022In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request.CVE-2021-45914 · Other software · Luxsoft · reported by MITRECritical 9.8
In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator.
- Product
- Luxcal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comh1pmnh.github.io
May 23, 2022Annke N48PBB (Network Video Recorder) products of version 3.4.106 build 200422 and prior are vulnerable to a stack-based buffer overflow, which allows an unauthCVE-2021-32941 · Other software · Annke · reported by ics-cert@hq.dhs.govCritical 9.4
Annke N48PBB (Network Video Recorder) products of version 3.4.106 build 200422 and prior are vulnerable to a stack-based buffer overflow, which allows an unauthorized remote attacker to execute arbitrary code with the same privileges as the server user (root).
- Product
- N48PBB (NVR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2022Nirweb support: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users)CVE-2022-0781 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection
- Product
- Nirweb support
- Fixed in
- 2.8.2
- What to do
- Update Nirweb support to 2.8.2 or newer.
May 18, 2022Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.CVE-2022-1774 · Other software · jgraph · reported by security@huntr.devMedium 6.1
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2022A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary files on the hosting CVE-2022-28921 · Other software · Blogengine · reported by MITREMedium 6.5
A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary files on the hosting web server.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogengine.io0xlanks.me
May 18, 2022Inkscape version 0.91 can access an uninitialized pointer, which may allow an attacker to have access to unauthorized information.CVE-2021-42702 · Other software · Inkscape · reported by ics-cert@hq.dhs.govLow 3.3
Inkscape version 0.91 can access an uninitialized pointer, which may allow an attacker to have access to unauthorized information.
- Product
- Inkscape
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govintegraxor.com
May 18, 2022Inkscape 0.91 is vulnerable to an out-of-bounds read, which may allow an attacker to have access to unauthorized information.CVE-2021-42700 · Other software · Inkscape · reported by ics-cert@hq.dhs.govLow 3.3
Inkscape 0.91 is vulnerable to an out-of-bounds read, which may allow an attacker to have access to unauthorized information.
- Product
- Inkscape
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govintegraxor.com
May 18, 2022A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard user account.CVE-2021-42851 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.3
A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard user account.
- Product
- Personal Cloud Storage A1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiknow.lenovo.com.cniknow.lenovo.com.cn
May 18, 2022A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorCVE-2021-42850 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.8
A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local network access.
- Product
- Personal Cloud Storage A1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiknow.lenovo.com.cniknow.lenovo.com.cn
May 18, 2022A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attackeCVE-2021-42849 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.8
A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical access.
- Product
- Personal Cloud Storage A1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiknow.lenovo.com.cniknow.lenovo.com.cn
May 18, 2022An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrieve device aCVE-2021-42848 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.3
An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrieve device and networking details.
- Product
- Personal Cloud Storage A1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiknow.lenovo.com.cniknow.lenovo.com.cn
May 18, 2022An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php.CVE-2022-28955 · Other software · Dlink · reported by MITREHigh 7.5
An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php.
- Product
- Dir-816l Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022The affected On-Premise cnMaestro allows an unauthenticated attacker to access the cnMaestro server and execute arbitrary code in the privileges of the web servCVE-2022-1357 · Other software · Cambium Networks · reported by ics-cert@hq.dhs.govCritical 9.8
The affected On-Premise cnMaestro allows an unauthenticated attacker to access the cnMaestro server and execute arbitrary code in the privileges of the web server. This lack of validation could allow an attacker to append arbitrary data to the logger command.
- Product
- cnMaestro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022NVIDIA GPU Display Driver for Windows contains a vulnerability in the DirectX11 user mode driver (nvwgf2um/x.dll), where an unauthorized attacker on the networkCVE-2022-28182 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the DirectX11 user mode driver (nvwgf2um/x.dll), where an unauthorized attacker on the network can cause an out-of-bounds write through a specially crafted shader, which may lead to code execution to cause denial of service, escalation of privileges, information disclosure, and data tampering. The scope of the impact may extend to other components.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
May 16, 2022xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthorizeCVE-2021-33021 · Other software · xArrow · reported by ics-cert@hq.dhs.govMedium 6.1
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthorized attacker to execute arbitrary code.
- Product
- xArrow SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2022xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthorizeCVE-2021-33001 · Other software · xArrow · reported by ics-cert@hq.dhs.govMedium 6.1
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthorized attacker to execute arbitrary code.
- Product
- xArrow SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2022The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on theCVE-2021-27446 · Other software · Weintek · reported by ics-cert@hq.dhs.govCritical 10
The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system.
- Product
- cMT-SVR-1xx/2xx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.weintek.comcisa.gov
May 16, 2022The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensCVE-2021-27444 · Other software · Weintek · reported by ics-cert@hq.dhs.govCritical 9.8
The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.
- Product
- cMT-SVR-1xx/2xx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.weintek.comcisa.gov
May 16, 2022The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavCVE-2021-27442 · Other software · Weintek · reported by ics-cert@hq.dhs.govCritical 9.4
The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code.
- Product
- cMT-SVR-1xx/2xx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.weintek.comcisa.gov
May 13, 2022SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connections from an unauthorizCVE-2022-22282 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comCritical 9.8
SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connections from an unauthorized actor leading to Improper Access Control vulnerability.
- Product
- SonicWall SMA1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.compsirt.global.sonicwall.com
May 13, 2022mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive system information.CVE-2021-33013 · Other software · mySCADA · reported by ics-cert@hq.dhs.govHigh 8.2
mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive system information.
- Product
- myPRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to the file system.CVE-2021-33009 · Other software · mySCADA · reported by ics-cert@hq.dhs.govHigh 7.5
mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to the file system.
- Product
- myPRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to arbitrary directories.CVE-2021-33005 · Other software · mySCADA · reported by ics-cert@hq.dhs.govHigh 7.5
mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to arbitrary directories.
- Product
- myPRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive directory listing information.CVE-2021-27505 · Other software · mySCADA · reported by ics-cert@hq.dhs.govHigh 7.5
mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive directory listing information.
- Product
- myPRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and CVE-2021-22275 · Other software · B&R Automation · reported by cybersecurity@ch.abb.comHigh 8.6
Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service.
- Product
- Automation Runtime webserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-automation.combr-automation.com
May 13, 2022A vulnerability in Mitel 6900 Series IP (MiNet) phones excluding 6970, versions 1.8 (1.8.0.12) and earlier, could allow a unauthenticated attacker with physicalCVE-2022-29854 · Email & office · Mitel · reported by MITREMedium 6.8
A vulnerability in Mitel 6900 Series IP (MiNet) phones excluding 6970, versions 1.8 (1.8.0.12) and earlier, could allow a unauthenticated attacker with physical access to the phone to gain root access due to insufficient access control for test functionality during system startup. A successful exploit could allow access to sensitive information and code execution.
- Product
- Minet Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
May 13, 2022A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers to conduct a serverCVE-2020-22983 · Other software · Microstrategy · reported by MITREHigh 8.1
A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers to conduct a server-side request forgery (SSRF) attack via the srcURL parameter to the shortURL task.
- Product
- Microstrategy Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyourcompany.commedium.com
May 12, 2022Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path.CVE-2022-23166 · Other software · SysAid · reported by cna@cyber.gov.ilMedium 6.1
Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path. in the "Insert/Edit Embedded Media" window Choose Type : iFrame and File/URL : [here is the LFI] Solution: Update to 22.2.20 cloud version, or to 22.1.64 on premise version.
- Product
- Sysaid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the fCVE-2020-22987 · Other software · Microstrategy · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the fileToUpload parameter to the uploadFile task.
- Product
- Microstrategy Web SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyourcompany.commedium.com
May 12, 2022Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the sCVE-2020-22986 · Other software · Microstrategy · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the searchString parameter to the wikiScrapper task.
- Product
- Microstrategy Web SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyourcompany.commedium.com
May 12, 2022Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the kCVE-2020-22985 · Other software · Microstrategy · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the key parameter to the getESRIExtraConfig task.
- Product
- Microstrategy Web SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyourcompany.commedium.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.