Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,620 results · page 28 of 73
Jun 28, 2023Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.CVE-2021-25827 · Other software · Emby · reported by MITRECritical 9.8
Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.
- Product
- Emby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2023i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout parameter on the login page.CVE-2023-34830 · Other software · I-doit · reported by MITREMedium 5.4
i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout parameter on the login page.
- Product
- I-doit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2023When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login.CVE-2023-28800 · Other software · Zscaler · reported by cve@zscaler.comHigh 8.1
When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Jun 22, 2023A URL parameter during login flow was vulnerable to injection.CVE-2023-28799 · Other software · Zscaler · reported by cve@zscaler.comHigh 8.2
A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would redirect the user after auth and send the authorization token to the redirected domain.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Jun 22, 2023An issue was discovered in /cgi-bin/login_rj.cgi in Wildix WSG24POE version 103SP7D190822, allows attackers to bypass authentication.CVE-2023-29709 · Other software · Wildix · reported by MITREHigh 7.5
An issue was discovered in /cgi-bin/login_rj.cgi in Wildix WSG24POE version 103SP7D190822, allows attackers to bypass authentication.
- Product
- Wsg24poe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comholistic-height-e6d.notion.site
Jun 21, 2023User Registration & Login and User Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/search-rCVE-2023-33591 · Other software · User Registration & Login And User Management System Project · reported by MITREMedium 6.1
User Registration & Login and User Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/search-result.php.
- Product
- User Registration & Login And User Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Jun 19, 2023Social Share, Social Login and Social Comments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2779 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.52
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.52 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 16, 2023Thinking Software Efence login function has insufficient validation for user input.CVE-2023-32754 · Other software · Thinking Software · reported by twcert@cert.org.twCritical 9.8
Thinking Software Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.
- Product
- Efence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 12, 2023Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could allow an attacker with aCVE-2023-1897 · Other software · Atlas Copco · reported by ics-cert@hq.dhs.govCritical 9.4
Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could allow an attacker with access to the user’s computer to gain credential information of the controller.
- Product
- Power Focus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2023The Danfoss AK-EM100 stores login credentials in cleartext.CVE-2023-22584 · Other software · Danfoss · reported by csirt@divd.nlHigh 7.5
The Danfoss AK-EM100 stores login credentials in cleartext.
- Product
- AK-EM100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Jun 11, 2023The Danfoss AK-EM100 web forms allow for SQL injection in the login forms.CVE-2023-22583 · Other software · Danfoss · reported by csirt@divd.nlCritical 10
The Danfoss AK-EM100 web forms allow for SQL injection in the login forms.
- Product
- AK-EM100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Jun 7, 2023An issue in Planet Technologies WDRT-1800AX v1.01-CP21 allows attackers to bypass authentication and escalate privileges to root via manipulation of the LoginStCVE-2023-33553 · Other software · Planet · reported by MITRECritical 9.8
An issue in Planet Technologies WDRT-1800AX v1.01-CP21 allows attackers to bypass authentication and escalate privileges to root via manipulation of the LoginStatus cookie.
- Product
- Wdrt-1800ax Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.complanet.com.tw
Jun 6, 2023Login/Signup Popup: Authorization bypassCVE-2020-36715 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4. This makes it possible for authenticated attackers to inject arbitrary web scripts into the plugin settings that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Login/Signup Popup
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Login/Signup Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 6, 2023WPS Hide Login: Login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sitesCVE-2020-36710 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sites in versions up to, and including, 1.5.4.2.
- Product
- WPS Hide Login
- Affected
- up to 1.5.4.2
- What to do
- Affects up to 1.5.4.2. Update WPS Hide Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
May 31, 2023An issue in Deviniti Issue Sync Synchronization v3.5.2 for Jira allows attackers to obtain the login credentials of a user via a crafted request sent to /rest/sCVE-2023-30285 · Other software · Deviniti · reported by MITREHigh 7.5
An issue in Deviniti Issue Sync Synchronization v3.5.2 for Jira allows attackers to obtain the login credentials of a user via a crafted request sent to /rest/synchronizer/1.0/technicalUser.
- Product
- Issue Sync
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Feather Login Page: Cross-Site Request ForgeryCVE-2023-2549 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Feather Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions starting from 1.0.7 up to, and including, 1.1.1. This is due to missing nonce validation in the 'createTempAccountLink' function. This makes it possible for unauthenticated attackers to create a new user with administrator role via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can leverage CVE-2023-2545 to get the login link or request a password reset to the new user's email address.
- Product
- Feather Login Page
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Feather Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 30, 2023Feather Login Page: Unauthorized loss of dataCVE-2023-2547 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete the temp user generated by the plugin.
- Product
- Feather Login Page
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Feather Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 30, 2023Feather Login Page: Unauthorized access of dataCVE-2023-2545 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOfUsers' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to access the login links, which can be used for privilege escalation.
- Product
- Feather Login Page
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Feather Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 30, 2023Loginizer: Does not escape a parameter before outputting it back in the pageCVE-2023-2296 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Loginizer WordPress plugin before 1.7.9 does not escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Loginizer
- Fixed in
- 1.7.9
- What to do
- Update Loginizer to 1.7.9 or newer.
May 30, 2023Login rebuilder: Does not sanitise and escape some of its settingsCVE-2023-2223 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login rebuilder WordPress plugin before 2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Login rebuilder
- Fixed in
- 2.8.1
- What to do
- Update Login rebuilder to 2.8.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in ThemeinProgress WIP Custom Login plugin <= 1.2.9 versions.CVE-2023-33313 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ThemeinProgress WIP Custom Login plugin <= 1.2.9 versions.
- Fixed in
- 1.3.0
- What to do
- Update the plugin to 1.3.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 27, 2023xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.CVE-2015-20108 · Other software · Onelogin · reported by MITRECritical 9.8
xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.
- Product
- Ruby-saml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin <= 2.1 versions.CVE-2022-47138 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin <= 2.1 versions.
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 23, 2023miniOrange WordPress Social Login and Register: Cross-Site Request Forgery (CSRF)CVE-2023-23706 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.
- Product
- miniOrange WordPress Social Login and Register
- Fixed in
- 7.6.0
- What to do
- Update miniOrange WordPress Social Login and Register to 7.6.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 22, 2023Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where the affected product isCVE-2023-25953 · Other software · WORKS MOBILE Japan Corp. · reported by vultures@jpcert.or.jpCritical 9.8
Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where the affected product is installed to inject arbitrary code while processing the product execution. Since a full disk access privilege is required to execute LINE WORKS Drive Explorer, the attacker may be able to read and/or write to arbitrary files without the access privileges.
- Product
- Drive Explorer for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpline.worksmobile.com
May 22, 2023A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary CVE-2023-31664 · Other software · Wso2 · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter.
- Product
- API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Softaculous Loginizer plugin <= 1.7.5 versions.CVE-2022-45079 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Cross-Site Request Forgery (CSRF) vulnerability in Softaculous Loginizer plugin <= 1.7.5 versions.
- Fixed in
- 1.7.6
- What to do
- Update the plugin to 1.7.6 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2023A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points (APs) could allow an unauthenticated, adjaCVE-2023-20003 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.7
A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points (APs) could allow an unauthenticated, adjacent attacker to bypass social login authentication. This vulnerability is due to a logic error with the social login implementation. An attacker could exploit this vulnerability by attempting to authenticate to an affected device. A successful exploit could allow the attacker to access the Guest Portal without authentication.
- Product
- Cisco Business Wireless Access Point Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
May 16, 2023OTP Login Woocommerce & Gravity Forms: Authentication bypassCVE-2023-2706 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for unauthenticated attackers to obtain login codes for administrators. This does require an attacker have access to the phone number configured for an account, which can be obtained via social engineering or reconnaissance.
- Product
- OTP Login Woocommerce & Gravity Forms
- Fixed in
- 2.3
- What to do
- Update OTP Login Woocommerce & Gravity Forms to 2.3 or newer.
Full record and what to do →NVD recordlana.codesplugins.trac.wordpress.org
May 16, 2023IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.CVE-2023-27742 · Other software · Idurarapp · reported by MITRECritical 9.8
IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.
- Product
- Idurar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login.CVE-2023-33005 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login.
- Product
- Jenkins WSO2 Oauth Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login.CVE-2023-32997 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login.
- Product
- Jenkins CAS Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the email parameter at login_core.php.CVE-2023-31519 · Other software · Pharmacy Management System Project · reported by MITRECritical 9.8
Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the email parameter at login_core.php.
- Product
- Pharmacy Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type.CVE-2022-22508 · Other software · CODESYS V3 · reported by info@cert.vde.comMedium 4.3
Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type.
- Product
- CODESYS Control RTE (SL)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
May 10, 2023An issue was found in Genesys CIC Polycom phone provisioning TFTP Server all version allows a remote attacker to execute arbitrary code via the login crednetialCVE-2023-29930 · Other software · Genesys · reported by MITREHigh 8.8
An issue was found in Genesys CIC Polycom phone provisioning TFTP Server all version allows a remote attacker to execute arbitrary code via the login crednetials to the TFTP server configuration page.
- Product
- Tftp Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhelp.genesys.com
May 8, 2023SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker with administrator privileges to get the login token ofCVE-2023-28762 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker with administrator privileges to get the login token of any logged-in BI user over the network without any user interaction. The attacker can impersonate any user on the platform resulting into accessing and modifying data. The attacker can also make the system partially or entirely unavailable.
- Product
- SAP BusinessObjects Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
May 8, 2023WP Login Box: Does not sanitise and escape some of its settingsCVE-2023-0544 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Login Box WordPress plugin through 2.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Login Box
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update WP Login Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023Enable/Disable Auto Login when Register: Does not have CSRF check in placeCVE-2023-0522 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enable/Disable Auto Login when Register WordPress plugin through 1.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Enable/Disable Auto Login when Register
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Enable/Disable Auto Login when Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023Open redirect vulnerability in typecho 1.1-17.10.30-release via the referer parameter to Login.php.CVE-2020-21038 · Other software · Typecho · reported by MITREMedium 6.1
Open redirect vulnerability in typecho 1.1-17.10.30-release via the referer parameter to Login.php.
- Product
- Typecho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2023A vulnerability was found in PHP-Login 1.0.CVE-2016-15031 · Websites & servers · Php-login Project · reported by VulDBHigh 7.3
A vulnerability was found in PHP-Login 1.0. It has been declared as critical. This vulnerability affects the function checkLogin of the file login/scripts/class.loginscript.php of the component POST Parameter Handler. The manipulation of the argument myusername leads to sql injection. The attack can be initiated remotely. Upgrading to version 2.0 is able to address this issue. The patch is identified as 0083ec652786ddbb81335ea20da590df40035679. It is recommended to upgrade the affected component. VDB-228022 is the identifier assigned to this vulnerability.
- Product
- Php-login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2023An issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to bypass login by connecting CVE-2023-30403 · Other software · Aigital · reported by MITREHigh 7.5
An issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to bypass login by connecting to the web app after a successful attempt by a legitimate user.
- Product
- Wireless-n Repeater Mini Router Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.packetstormsecurity.netmandomat.github.io
May 2, 2023Limit Login Attempts: Does not sanitize and escape usernamesCVE-2023-1861 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks
- Product
- Limit Login Attempts
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 27, 2023Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configCVE-2023-29471 · Other software · Lightbend · reported by MITREMedium 5.5
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
- Product
- Alpakka Kafka
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023miniOrange WordPress Social Login and Register: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-23710 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.
- Product
- miniOrange WordPress Social Login and Register
- Fixed in
- 7.6.0
- What to do
- Update miniOrange WordPress Social Login and Register to 7.6.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticated user to bypass CVE-2023-2282 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticated user to bypass administrator-enforced Web Login restrictions and gain access to entries via an unexpected vector.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Apr 25, 2023PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two people with the same userCVE-2022-23721 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comLow 3.8
PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two people with the same username are provisioned onto the same machine at different times.
- Product
- unspecified
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.comdocs.pingidentity.com
Apr 19, 2023Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication.CVE-2023-22893 · Other software · Strapi · reported by MITREHigh 7.5
Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.
- Product
- Strapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023ZM Ajax Login & Register: Authentication bypassCVE-2023-2027 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
- Product
- ZM Ajax Login & Register
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update ZM Ajax Login & Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 14, 2023The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks.CVE-2023-26756 · Other software · Revive · reported by MITREHigh 7.5
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. NOTE: The vendor's position is that this is effectively mitigated by rate limits and password-quality features.
- Product
- Adserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggoogleinformationsworld.blogspot.com
Apr 13, 2023Yoga Class Registration System 1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at /admin/login.php.CVE-2023-29626 · Other software · Yoga Class Registration System Project · reported by MITREHigh 7.5
Yoga Class Registration System 1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at /admin/login.php.
- Product
- Yoga Class Registration System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.