Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,994 results · page 28 of 60
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log.CVE-2022-40004 · Other software · Thingsboard · reported by MITRECritical 9.6
Cross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log.
- Product
- Thingsboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 13, 2022The login password of the web administrative dashboard in Arcadyan Wifi routers VRV9506JAC23 is sent in cleartext, allowing an attacker to sniff and intercept tCVE-2020-9420 · Network & remote access · Arcadyan · reported by MITREMedium 6.5
The login password of the web administrative dashboard in Arcadyan Wifi routers VRV9506JAC23 is sent in cleartext, allowing an attacker to sniff and intercept traffic to learn the administrative credentials to the router.
- Product
- Vrv9506jac23 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 13, 2022The Dashboard component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Developer Edition, TIBCO JCVE-2022-41563 · Other software · TIBCO Software Inc. · reported by security@tibco.comCritical 9
The Dashboard component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.2 and below, TIBCO JasperReports Server: version 8.1.0, TIBCO JasperReports Server - Developer Edition: versions 8.1.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.2 and below, TIBCO JasperReports Server for AWS Marketplace: version 8.1.0, TIBCO JasperReports Server for Microsoft Azure: versions 8.0.2 and below, and TIBCO JasperReports Server for Microsoft Azure: version 8.1.0.
- Product
- TIBCO JasperReports Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic ACVE-2022-45956 · Other software · BOA · reported by MITREMedium 5.3
Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic Authorization mechanism.
- Product
- BOA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Dec 12, 2022Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.CVE-2022-45970 · Other software · Alistgo · reported by MITREMedium 5.4
Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.
- Product
- Alist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Hewlett Packard Enterprise HPE OneView Global Dashboard (OVGD).CVE-2022-37927 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.1
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Hewlett Packard Enterprise HPE OneView Global Dashboard (OVGD).
- Product
- HPE OneView Global Dashboard (OVGD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Dec 6, 2022teler is an real-time intrusion detection and threat alert dashboard.CVE-2022-23466 · Other software · kitabisa · reported by GitHubMedium 5.4
teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version `v2.0.0-rc.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- teler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2022Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output iCVE-2022-43556 · Other software · Concretecms · reported by support@hackerone.comMedium 6.1
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output is not sanitized. The Concrete CMS security team has ranked this 4.2 with CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Thanks @_akbar_jafarli_ for reporting. Remediate by updating to Concrete CMS 8.5.10 and Concrete CMS 9.1.3.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orgdocumentation.concretecms.org
Dec 5, 2022PC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization or authenticatioCVE-2022-45479 · Other software · BEAppsMobile · reported by disclosure@synopsys.comCritical 9.8
PC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization or authentication. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Product
- PC Keyboard WiFi & Bluetooth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynopsys.comsynopsys.com
Dec 2, 2022PC Keyboard WiFi & Bluetooth allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypresseCVE-2022-45480 · Other software · Telepad · reported by disclosure@synopsys.comMedium 5.9
PC Keyboard WiFi & Bluetooth allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypresses) in cleartext. CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Product
- PC Keyboard WiFi & Bluetooth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynopsys.comsynopsys.com
Nov 30, 2022g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable and writable, allowingCVE-2022-46338 · Other software · G810-led Project · reported by MITREMedium 6.5
g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable and writable, allowing any process on the system to read traffic from keyboards, including sensitive data.
- Product
- G810-led
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggithub.com
Nov 26, 2022The ESL (Electronic Shelf Label) protocol, as implemented by (for example) the OV80e934802 RF transceiver on the ETAG-2130-V4.3 20190629 board, does not use autCVE-2022-45914 · Other software · Electronic Shelf Label Protocol Project · reported by MITREMedium 6.5
The ESL (Electronic Shelf Label) protocol, as implemented by (for example) the OV80e934802 RF transceiver on the ETAG-2130-V4.3 20190629 board, does not use authentication, which allows attackers to change label values via 433 MHz RF signals, as demonstrated by disrupting the organization of a hospital storage unit, or changing retail pricing.
- Product
- Electronic Shelf Label Protocol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 23, 2022Boa 0.94.14rc21 is vulnerable to SQL Injection via username.CVE-2022-44117 · Other software · BOA · reported by MITRECritical 9.8
Boa 0.94.14rc21 is vulnerable to SQL Injection via username. NOTE: the is disputed by multiple third parties because Boa does not ship with any support for SQL.
- Product
- BOA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 22, 2022An access control issue in /Admin/dashboard.php of Record Management System using CodeIgniter v1.0 allows attackers to access and modify user data.CVE-2022-41446 · Other software · Record Management System Project · reported by MITREMedium 5.4
An access control issue in /Admin/dashboard.php of Record Management System using CodeIgniter v1.0 allows attackers to access and modify user data.
- Product
- Record Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Nov 14, 2022Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/system/express/entitiCVE-2022-43695 · Other software · Concretecms · reported by MITREMedium 4.8
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/system/express/entities/associations because Concrete CMS allows association with an entity name that doesn’t exist or, if it does exist, contains XSS since it was not properly sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orgdocumentation.concretecms.org
Nov 14, 2022Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the dashboard icons due to un-sanitized output.CVE-2022-43968 · Other software · Concretecms · reported by MITREMedium 6.1
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the dashboard icons due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orgdocumentation.concretecms.org
Nov 12, 2022A vulnerability was found in gnuboard5.CVE-2022-3963 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key ID Handler. The manipulation of the argument fm_id leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 5.5.8.2.1 is able to address this issue. The name of the patch is ba062ca5b62809106d5a2f7df942ffcb44ecb5a9. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213540.
- Product
- gnuboard5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.CVE-2022-45182 · Other software · Pistar · reported by MITRECritical 9.8
Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.
- Product
- Pi-star Digital Voice Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Improper initialization in BIOS firmware for some Intel(R) NUC 11 Pro Kits and Intel(R) NUC 11 Pro Boards before version TNTGL357.0064 may allow an authenticateCVE-2022-37334 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper initialization in BIOS firmware for some Intel(R) NUC 11 Pro Kits and Intel(R) NUC 11 Pro Boards before version TNTGL357.0064 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- NUC 11 Pro KIT Nuc11tnhi70z Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Improper authentication in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow a privileged user to potentially eCVE-2022-36370 · Other software · Intel · reported by secure@intel.comHigh 7.5
Improper authentication in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- NUC KIT Nuc5i3myhe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Insecure default variable initialization in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow an authenticated CVE-2022-36349 · Other software · Intel · reported by secure@intel.comMedium 5.2
Insecure default variable initialization in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- NUC Board Nuc5i3mybe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Improper input validation in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Kits before version TY0070 may allow a privileged user to potentially enabCVE-2022-34152 · Other software · Intel · reported by secure@intel.comHigh 7.7
Improper input validation in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Kits before version TY0070 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- NUC Board De3815tybe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Improper input validation in the firmware for some Intel(R) Server Board S2600WF, Intel(R) Server System R1000WF and Intel(R) Server System R2000WF families befCVE-2022-30542 · Other software · Intel · reported by secure@intel.comHigh 8.2
Improper input validation in the firmware for some Intel(R) Server Board S2600WF, Intel(R) Server System R1000WF and Intel(R) Server System R2000WF families before version R02.01.0014 may allow a privileged user to potentially enable an escalation of privilege via local access.
- Product
- S2600wf Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Improper buffer restrictions in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC 8 Boards, Intel(R) NUC 8 Rugged Boards and Intel(R) NUC 8 Rugged Kits bCVE-2022-26124 · Other software · Intel · reported by secure@intel.comHigh 7.5
Improper buffer restrictions in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC 8 Boards, Intel(R) NUC 8 Rugged Boards and Intel(R) NUC 8 Rugged Kits before version CHAPLCEL.0059 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- NUC 8 Rugged KIT Nuc8cchkrn Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Uncaught exception in the firmware for some Intel(R) Server Board M50CYP Family before version R01.01.0005 may allow a privileged user to potentially enable a dCVE-2022-25917 · Other software · Intel · reported by secure@intel.comMedium 6
Uncaught exception in the firmware for some Intel(R) Server Board M50CYP Family before version R01.01.0005 may allow a privileged user to potentially enable a denial of service via local access.
- Product
- M50cyp1ur204 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Improper authentication in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Business, Intel(R) NUC Enthusiast, Intel(R) NUC Kits before version HN0067 mCVE-2022-21794 · Other software · Intel · reported by secure@intel.comHigh 7.7
Improper authentication in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Business, Intel(R) NUC Enthusiast, Intel(R) NUC Kits before version HN0067 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- NUC KIT Nuc8i7hnk Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2022Improper input validation in the firmware for some Intel(R) Server Board M10JNP Family before version 7.216 may allow a privileged user to potentially enable anCVE-2021-0185 · Other software · Intel · reported by secure@intel.comHigh 7.5
Improper input validation in the firmware for some Intel(R) Server Board M10JNP Family before version 7.216 may allow a privileged user to potentially enable an escalation of privilege via local access.
- Product
- M10jnp2sb Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2022A vulnerability in multiple management dashboard pages of Cisco Umbrella could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) aCVE-2022-20969 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.8
A vulnerability in multiple management dashboard pages of Cisco Umbrella could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the Cisco Umbrella dashboard. This vulnerability is due to unsanitized user input. An attacker could exploit this vulnerability by submitting custom JavaScript to the web application and persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.
- Product
- Cisco Umbrella Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Nov 3, 2022In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.CVE-2022-43571 · Other software · Splunk · reported by prodsec@splunk.comHigh 8.8
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.splunk.comsplunk.com
Nov 1, 2022A vulnerability was found in eolinker apinto-dashboard.CVE-2022-3804 · Other software · eolinker · reported by VulDBMedium 4.3
A vulnerability was found in eolinker apinto-dashboard. It has been classified as problematic. Affected is an unknown function of the file /login. The manipulation of the argument callback leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212640.
- Product
- apinto-dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordc2.im5i.comc2.im5i.com
Nov 1, 2022A vulnerability was found in eolinker apinto-dashboard and classified as problematic.CVE-2022-3803 · Other software · eolinker · reported by VulDBLow 3.5
A vulnerability was found in eolinker apinto-dashboard and classified as problematic. This issue affects some unknown processing of the file /api/discoveries/. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212639.
- Product
- apinto-dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordc2.im5i.comc2.im5i.com
Nov 1, 2022A vulnerability was found in eolinker apinto-dashboard.CVE-2022-3797 · Other software · eolinker · reported by VulDBMedium 6.3
A vulnerability was found in eolinker apinto-dashboard. It has been rated as problematic. This issue affects some unknown processing of the file /login. The manipulation of the argument callback leads to open redirect. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212633 was assigned to this vulnerability.
- Product
- apinto-dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022A vulnerability, which was classified as problematic, has been found in node-red-dashboard.CVE-2022-3783 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component ui_text Format Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 9305d1a82f19b235dfad24a7d1dd4ed244db7743. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212555.
- Product
- node-red-dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 alloCVE-2022-43170 · Other software · Rukovoditel · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add info block".
- Product
- Rukovoditel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2022Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection.CVE-2022-0073 · Other software · LiteSpeed Technologies · reported by psirt@paloaltonetworks.comHigh 8.8
Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection. This affects 1.7.0 versions before 1.7.16.1.
- Product
- OpenLiteSpeed Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2022Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal.CVE-2022-0072 · Other software · LiteSpeed Technologies · reported by psirt@paloaltonetworks.comMedium 5.8
Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1
- Product
- OpenLiteSpeed Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2022Vulnerability in the Oracle Enterprise Data Quality product of Oracle Fusion Middleware (component: Dashboard).CVE-2022-21615 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.4
Vulnerability in the Oracle Enterprise Data Quality product of Oracle Fusion Middleware (component: Dashboard). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Data Quality. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Data Quality, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Data Quality accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N).
- Product
- Enterprise Data Quality
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2022Vulnerability in the Oracle Enterprise Data Quality product of Oracle Fusion Middleware (component: Dashboard).CVE-2022-21614 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Oracle Enterprise Data Quality product of Oracle Fusion Middleware (component: Dashboard). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Data Quality. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Data Quality accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- Product
- Enterprise Data Quality
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2022Vulnerability in the Oracle Enterprise Data Quality product of Oracle Fusion Middleware (component: Dashboard).CVE-2022-21613 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle Enterprise Data Quality product of Oracle Fusion Middleware (component: Dashboard). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Data Quality. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Data Quality, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Data Quality accessible data as well as unauthorized update, insert or delete access to some of Oracle Enterprise Data Quality accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Data Quality. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L).
- Product
- Enterprise Data Quality
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2022Vulnerability in the Oracle Enterprise Data Quality product of Oracle Fusion Middleware (component: Dashboard).CVE-2022-21612 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1
Vulnerability in the Oracle Enterprise Data Quality product of Oracle Fusion Middleware (component: Dashboard). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Data Quality. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Data Quality accessible data as well as unauthorized access to critical data or complete access to all Oracle Enterprise Data Quality accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
- Product
- Enterprise Data Quality
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022A Cross-Site Request Forgery (CSRF) in MQTTRoute v3.3 and below allows attackers to create and remove dashboards.CVE-2022-35611 · Other software · Bevywise · reported by MITREMedium 4.3
A Cross-Site Request Forgery (CSRF) in MQTTRoute v3.3 and below allows attackers to create and remove dashboards.
- Product
- Mqttroute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityblog101.blogspot.comsecurityblog101.blogspot.com
Oct 11, 2022A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin dashboard.CVE-2022-42238 · Other software · Merchandise Online Store Project · reported by MITREHigh 8.8
A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin dashboard.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022discourse-chat is a plugin for the Discourse message board which adds chat functionality.CVE-2022-39279 · Other software · discourse · reported by GitHubMedium 4.3
discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat channel's name and description in an unsafe way, allowing staff members to cause an cross site scripting (XSS) attack by inserting unsafe HTML into them. Version 0.9 has addressed this issue. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- discourse-chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2022Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.CVE-2022-38817 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.
- Product
- Dapr Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NOTICE BOARD plugin <= 1.1 at WordPress.CVE-2022-38460 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NOTICE BOARD plugin <= 1.1 at WordPress.
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 16, 2022Post SMTP Mailer/Email Log: Does not escape some of its settings before outputting them in the admins dashboardCVE-2022-2351 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed.
- Product
- Post SMTP Mailer/Email Log
- Fixed in
- 2.1.4
- What to do
- Update Post SMTP Mailer/Email Log to 2.1.4 or newer.
Sep 13, 2022Cross site Scripting (XSS) in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs.CVE-2022-31861 · Other software · Thingsboard · reported by MITREMedium 5.4
Cross site Scripting (XSS) in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs.
- Product
- Thingsboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityblog101.blogspot.comsecurityblog101.blogspot.com
Sep 11, 2022SysAid Help Desk before 22.1.65 allows XSS via the Asset Dashboard, aka FR# 67262.CVE-2022-40325 · Other software · Sysaid · reported by MITREMedium 6.1
SysAid Help Desk before 22.1.65 allows XSS via the Asset Dashboard, aka FR# 67262.
- Product
- Help Desk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.sysaid.comdocumentation.sysaid.com
Sep 6, 2022TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable Buffer Overflow via the hostname parameter in binary /bin/boa.CVE-2022-40112 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable Buffer Overflow via the hostname parameter in binary /bin/boa.
- Product
- A3002r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable to Buffer Overflow via /bin/boa.CVE-2022-40110 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable to Buffer Overflow via /bin/boa.
- Product
- A3002r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.