Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,050 results · page 29 of 61
Mar 10, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.CVE-2023-1312 · Other software · pimcore · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.CVE-2023-1307 · Other software · froxlor · reported by security@huntr.devCritical 9.8
Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.CVE-2023-1286 · Other software · pimcore · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023Code Injection in GitHub repository builderio/qwik prior to 0.21.0.CVE-2023-1283 · Other software · builderio · reported by security@huntr.devCritical 10
Code Injection in GitHub repository builderio/qwik prior to 0.21.0.
- Product
- builderio/qwik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site.CVE-2023-23760 · Other software · GitHub · reported by product-cna@github.comMedium 4.9
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to versions 3.8 and was fixed in versions 3.7.7, 3.6.10, 3.5.14, and 3.4.17. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Mar 8, 2023Cross-site Scripting in GitHub repository btcpayserver/btcpayserver prior to 1.8.3.CVE-2023-1270 · Other software · btcpayserver · reported by security@huntr.devMedium 5.4
Cross-site Scripting in GitHub repository btcpayserver/btcpayserver prior to 1.8.3.
- Product
- btcpayserver/btcpayserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-1269 · Other software · alextselegidis · reported by security@huntr.devCritical 9.8
Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- Product
- alextselegidis/easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392.CVE-2023-1264 · Other software · vim · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner grouCVE-2022-46257 · Other software · GitHub · reported by product-cna@github.comMedium 4.3
An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner group via the API by a user who did not have access to those repositories, resulting in the repository names being shown in the UI. To exploit this vulnerability, an attacker would need access to the GHES instance, permissions to modify GitHub Actions runner groups, and successfully guess the obfuscated ID of private repositories. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7 and was fixed in versions 3.3.17, 3.4.12, 3.5.9, 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Mar 7, 2023Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1245 · Other software · answerdev · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1244 · Other software · answerdev · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1243 · Other software · answerdev · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1242 · Other software · answerdev · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1241 · Other software · answerdev · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1240 · Other software · answerdev · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1239 · Other software · answerdev · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Reflected in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1238 · Other software · answerdev · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-1237 · Other software · answerdev · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2.CVE-2023-1212 · Websites & servers · phpipam · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.CVE-2023-1211 · Websites & servers · phpipam · reported by security@huntr.devHigh 7.2
SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023Azure/setup-kubectl is a GitHub Action for installing Kubectl.CVE-2023-23939 · Other software · Azure · reported by GitHubLow 3.9
Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action because it is world writable. This Kubectl tool installer runs `fs.chmodSync(kubectlPath, 777)` to set permissions on the Kubectl binary, however, this allows any local user to replace the Kubectl binary. This allows privilege escalation to the user that can also run kubectl, most likely root. This attack is only possible if an attacker somehow breached the GitHub actions runner or if a user is utilizing an Action that maliciously executes this attack. This has been fixed and released in all versions `v3` and later. 775 permissions are used instead. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- setup-kubectl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0.CVE-2023-1197 · Other software · uvdesk · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0.
- Product
- uvdesk/community-skeleton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2023Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4.CVE-2023-0734 · Other software · wallabag · reported by security@huntr.devMedium 5.3
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4.
- Product
- wallabag/wallabag
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository icret/easyimages2.0 prior to 2.6.7.CVE-2023-1181 · Other software · icret · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository icret/easyimages2.0 prior to 2.6.7.
- Product
- icret/easyimages2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2023Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.CVE-2023-1175 · Other software · vim · reported by security@huntr.devMedium 6.6
Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2023RSSHub is an open source and extensible RSS feed generator.CVE-2023-26491 · Other software · DIYgod · reported by GitHubMedium 5.4
RSSHub is an open source and extensible RSS feed generator. When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. This vulnerability was fixed in version c910c4d28717fb860fbe064736641f379fab2c91. Please upgrade to this or a later version, there are no known workarounds.
- Product
- RSSHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2023Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.CVE-2023-1170 · Other software · vim · reported by security@huntr.devMedium 6.6
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2023Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0.CVE-2023-1160 · Other software · cockpit-hq · reported by security@huntr.devMedium 5.5
Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0.
- Product
- cockpit-hq/cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2023A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment variables from a single environment variablCVE-2023-22381 · Other software · GitHub · reported by product-cna@github.comMedium 4.1
A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment variables from a single environment variable value in GitHub Actions when using a Windows based runner. To exploit this vulnerability, an attacker would need existing permission to control the value of environment variables for use with GitHub Actions. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.8.0 and was fixed in versions 3.4.15, 3.5.12, 3.6.8, 3.7.5. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Mar 2, 2023Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0.CVE-2023-1149 · Other software · btcpayserver · reported by security@huntr.devMedium 5.4
Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0.
- Product
- btcpayserver/btcpayserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-1148 · Other software · flatpressblog · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-1147 · Other software · flatpressblog · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Cross-site Scripting (XSS) - Generic in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-1146 · Other software · flatpressblog · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-1107 · Other software · flatpressblog · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-1106 · Other software · flatpressblog · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.CVE-2023-1127 · Other software · vim · reported by security@huntr.devHigh 7.8
Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.CVE-2023-1117 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.CVE-2023-1116 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.CVE-2023-1115 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2023External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-1105 · Other software · flatpressblog · reported by security@huntr.devHigh 8.1
External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2023Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-1104 · Other software · flatpressblog · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.CVE-2023-1081 · Other software · microweber · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22.CVE-2023-1070 · Other software · nilsteampassnet · reported by security@huntr.devHigh 7.1
External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.CVE-2023-1067 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2023OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.CVE-2022-2024 · Other software · gogs · reported by security@huntr.devCritical 9.8
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.
- Product
- gogs/gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.12.9.CVE-2023-1034 · Other software · salesagility · reported by security@huntr.devHigh 8.8
Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.12.9.
- Product
- salesagility/suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11.CVE-2023-1033 · Other software · froxlor · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2023Cross-site Scripting (XSS) - Stored in GitHub repository unilogies/bumsys prior to v2.0.1.CVE-2023-0995 · Other software · unilogies · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository unilogies/bumsys prior to v2.0.1.
- Product
- unilogies/bumsys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2023Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2.CVE-2023-0994 · Other software · francoisjacquet · reported by security@huntr.devHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2.
- Product
- francoisjacquet/rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.CVE-2023-0949 · Other software · modoboa · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.
- Product
- modoboa/modoboa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.