Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,050 results · page 28 of 61
Mar 30, 2023Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1761 · Other software · thorsten · reported by security@huntr.devMedium 6.3
Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1760 · Other software · thorsten · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1759 · Other software · thorsten · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1755 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1754 · Other software · thorsten · reported by security@huntr.devMedium 4.7
Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1753 · Other software · thorsten · reported by security@huntr.devMedium 5.5
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack prior to 0.1.30.CVE-2023-1712 · Other software · deepset-ai · reported by security@huntr.devCritical 9.8
Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack prior to 0.1.30.
- Product
- deepset-ai/haystack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.CVE-2023-1704 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.CVE-2023-1703 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.CVE-2023-1702 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20.CVE-2023-1701 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0.CVE-2023-1665 · Other software · linagora · reported by security@huntr.devCritical 9.8
Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0.
- Product
- linagora/twake
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Denial of Service in GitHub repository gpac/gpac prior to 2.4.0.CVE-2023-1654 · Other software · gpac · reported by security@huntr.devHigh 7.8
Denial of Service in GitHub repository gpac/gpac prior to 2.4.0.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible CVE-2022-48429 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Mar 27, 2023Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.CVE-2023-1655 · Other software · gpac · reported by security@huntr.devHigh 7.8
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2023Improper Access Control in GitHub repository calcom/cal.com prior to 2.7.CVE-2023-1647 · Other software · calcom · reported by security@huntr.devHigh 8.8
Improper Access Control in GitHub repository calcom/cal.com prior to 2.7.
- Product
- calcom/cal.com
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.CVE-2023-1177 · Other software · mlflow · reported by security@huntr.devCritical 9.3
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.
- Product
- mlflow/mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2.CVE-2023-1176 · Other software · mlflow · reported by security@huntr.devLow 3.3
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2.
- Product
- mlflow/mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.CVE-2023-1605 · Other software · radareorg · reported by security@huntr.devHigh 7.5
Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.
- Product
- radareorg/radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.CVE-2023-1578 · Other software · pimcore · reported by security@huntr.devHigh 8.8
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib.CVE-2023-1370 · Other software · json-smart · reported by reefs@jfrog.comHigh 7.5
[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.
- Product
- json-smart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comsecurity.netapp.com
Mar 21, 2023SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.CVE-2023-1545 · Other software · nilsteampassnet · reported by security@huntr.devHigh 7.5
SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1543 · Other software · answerdev · reported by security@huntr.devHigh 8.8
Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1542 · Other software · answerdev · reported by security@huntr.devMedium 5.4
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1541 · Other software · answerdev · reported by security@huntr.devLow 3.8
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1540 · Other software · answerdev · reported by security@huntr.devMedium 5.3
Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1539 · Other software · answerdev · reported by security@huntr.devMedium 5.3
Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1538 · Other software · answerdev · reported by security@huntr.devMedium 5.3
Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1537 · Other software · answerdev · reported by security@huntr.devCritical 9.8
Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.CVE-2023-1536 · Other software · answerdev · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.CVE-2023-1535 · Other software · answerdev · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2023Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0.CVE-2023-1527 · Other software · tsolucio · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0.
- Product
- tsolucio/corebos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2023Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.CVE-2023-1517 · Other software · pimcore · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.CVE-2023-1515 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0.CVE-2023-1496 · Other software · imgproxy · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0.
- Product
- imgproxy/imgproxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023Authorization Bypass Through User-Controlled Key in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.CVE-2023-1463 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Authorization Bypass Through User-Controlled Key in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.CVE-2023-1429 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow.CVE-2023-27581 · Other software · rlespinasse · reported by GitHubHigh 8.8
github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. This can be used to execute code on the GitHub runners and to exfiltrate any secrets one uses in the CI pipeline. A patched action is available in version 4.4.1. No workaround is available.
- Product
- github-slug-action
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-1367 · Other software · alextselegidis · reported by security@huntr.devLow 3.8
Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- Product
- alextselegidis/easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2.CVE-2023-1362 · Other software · unilogies · reported by security@huntr.devMedium 6.1
Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2.
- Product
- unilogies/bumsys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2.CVE-2023-1361 · Other software · unilogies · reported by security@huntr.devMedium 6.5
SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2.
- Product
- unilogies/bumsys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2023NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402.CVE-2023-1355 · Other software · vim · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Improper removal of sensitive data in the entry edit feature of Hub Business submodule in Devolutions Remote Desktop Manager PowerShell Module 2022.3.1.5 and eaCVE-2023-1203 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Improper removal of sensitive data in the entry edit feature of Hub Business submodule in Devolutions Remote Desktop Manager PowerShell Module 2022.3.1.5 and earlier allows an authenticated user to access sensitive data on entries that were edited using the affected submodule.
- Product
- Remote Desktop Manager PowerShell Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Mar 10, 2023Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.CVE-2023-1320 · Other software · osticket · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
- Product
- osticket/osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.CVE-2023-1319 · Other software · osticket · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
- Product
- osticket/osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Cross-site Scripting (XSS) - Generic in GitHub repository osticket/osticket prior to v1.16.6.CVE-2023-1318 · Other software · osticket · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository osticket/osticket prior to v1.16.6.
- Product
- osticket/osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.CVE-2023-1317 · Other software · osticket · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.
- Product
- osticket/osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.CVE-2023-1316 · Other software · osticket · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
- Product
- osticket/osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.CVE-2023-1315 · Other software · osticket · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.
- Product
- osticket/osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1.CVE-2023-1313 · Other software · cockpit-hq · reported by security@huntr.devHigh 8.8
Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1.
- Product
- cockpit-hq/cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.