Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,628 results · page 29 of 73
Aug 14, 2023The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database.CVE-2023-3264 · Other software · Dataprobe · reported by trellixpsirt@trellix.comMedium 6.7
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database. A malicious agent with the ability to execute operating system commands on the device can leverage this vulnerability to read, modify, or delete arbitrary database records.
- Product
- iBoot PDU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrellix.comtrellix.com
Aug 14, 2023The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database.ACVE-2023-3262 · Other software · Dataprobe · reported by trellixpsirt@trellix.comMedium 6.7
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database.A malicious agent with the ability to execute operating system commands on the device can leverage this vulnerability to read, modify, or delete arbitrary database records.
- Product
- iBoot PDU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrellix.comtrellix.com
Aug 7, 2023SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which migCVE-2023-37484 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which might allow an attacker to access password hashes from the client's memory.
- Product
- SAP PowerDesigner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2023MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource.CVE-2023-38699 · Other software · mindsdb · reported by GitHubCritical 9.1
MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.
- Product
- mindsdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2023An Unrestricted Upload of File with Dangerous Type vulnerability in the Ajaxmanager File and Database explorer (ajaxmanager) module for PrestaShop through 2.3.0CVE-2023-33493 · Other software · Ajaxmanager Project · reported by MITRECritical 9.8
An Unrestricted Upload of File with Dangerous Type vulnerability in the Ajaxmanager File and Database explorer (ajaxmanager) module for PrestaShop through 2.3.0, allows remote attackers to upload dangerous files without restrictions.
- Product
- Ajaxmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Jul 25, 2023Directus is a real-time API and App dashboard for managing SQL database content.CVE-2023-38503 · Other software · directus · reported by GitHubMedium 5.7
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.3.0 and prior to version 10.5.0, the permission filters (i.e. `user_created IS $CURRENT_USER`) are not properly checked when using GraphQL subscription resulting in unauthorized users getting event on their subscription which they should not be receiving according to the permissions. This can be any collection but out-of-the box the `directus_users` collection is configured with such a permissions filter allowing you to get updates for other users when changes happen. Version 10.5.0 contains a patch. As a workaround, disable GraphQL subscriptions.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2023TDengine is an open source, time-series database optimized for Internet of Things devices.CVE-2023-38502 · Other software · taosdata · reported by GitHubMedium 6.5
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query. This issue affects TDengine Databases which let users connect and run arbitrary queries. Version 3.0.7.1 has a patch for this issue.
- Product
- TDengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2023GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests.CVE-2023-32637 · Other software · Generic Model Organism Database Project · reported by vultures@jpcert.or.jpCritical 9.8
GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyone who can upload files through the product may execute arbitrary code on the server.
- Product
- GBrowse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023Vulnerability in the Java VM component of Oracle Database Server.CVE-2023-22052 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 3.1
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.19 and 21.3-21.10. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java VM accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).
- Product
- Database - Enterprise Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023Vulnerability in the Unified Audit component of Oracle Database Server.CVE-2023-22034 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9
Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 19.3-19.19 and 21.3-21.10. Easily exploitable vulnerability allows high privileged attacker having SYSDBA privilege with network access via Oracle Net to compromise Unified Audit. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Unified Audit accessible data. CVSS 3.1 Base Score 4.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N).
- Product
- Database - Enterprise Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023Vulnerability in the Advanced Networking Option component of Oracle Database Server.CVE-2023-21949 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 3.7
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 19.3-19.19 and 21.3-21.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Advanced Networking Option accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
- Product
- Advanced Networking Option
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023Redis is an in-memory database that persists on disk.CVE-2022-24834 · Other software · redis · reported by GitHubHigh 7
Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Jul 11, 2023Redis is an in-memory database that persists on disk.CVE-2023-36824 · Other software · redis · reported by GitHubHigh 7.4
Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Several scenarios that may lead to authenticated users executing a specially crafted `COMMAND GETKEYS` or `COMMAND GETKEYSANDFLAGS`and authenticated users who were set with ACL rules that match key names, executing a specially crafted command that refers to a variadic list of key names. The vulnerability is patched in Redis 7.0.12.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Dave Jesch Database Collation Fix plugin <= 1.2.7 versions.CVE-2023-23997 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Dave Jesch Database Collation Fix plugin <= 1.2.7 versions.
- Fixed in
- 1.2.8
- What to do
- Update the plugin to 1.2.8 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 6, 2023A SQL Injection vulnerability detected in Food Ordering System v1.0 allows attackers to run commands on the database by sending crafted SQL queries to the ID paCVE-2023-36968 · Other software · Food Ordering System Project · reported by MITREHigh 7.2
A SQL Injection vulnerability detected in Food Ordering System v1.0 allows attackers to run commands on the database by sending crafted SQL queries to the ID parameter.
- Product
- Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comokankurtulus.com.tr
Jul 6, 2023SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.CVE-2023-36189 · Other software · Langchain · reported by MITREHigh 7.5
SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.
- Product
- Langchain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 30, 2023OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB).CVE-2023-36812 · Other software · OpenTSDB · reported by GitHubCritical 9.8
OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in commit `07c4641471c` and further refined in commit `fa88d3e4b`. These patches are available in the `2.4.2` release. Users are advised to upgrade. User unable to upgrade may disable Gunuplot via the config option`tsd.core.enable_ui = true` and remove the shell files `mygnuplot.bat` and `mygnuplot.sh`.
- Product
- opentsdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 27, 2023Custom 404 Pro: Does not properly sanitize database inputsCVE-2023-2032 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities.
- Product
- Custom 404 Pro
- Fixed in
- 3.8.1
- What to do
- Update Custom 404 Pro to 3.8.1 or newer.
Jun 26, 2023SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.CVE-2023-35930 · Other software · authzed · reported by GitHubLow 3.7
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may. Generally, `LookupResources` is not and should not be to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using `LookupResources` for negative authorization decisions.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2023An issue in the __nss_database_lookup component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL staCVE-2023-36363 · Other software · Monetdb · reported by MITREHigh 7.5
An issue in the __nss_database_lookup component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- Product
- Monetdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2023Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoriCVE-2023-2828 · Other software · ISC · reported by security-officer@isc.orgHigh 7.5
Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit. It has been discovered that the effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
- Product
- BIND 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comkb.isc.org
Jun 19, 2023In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, witCVE-2023-35866 · Other software · Keepassxc · reported by MITREMedium 5.5
In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes. NOTE: the vendor's position is "asking the user for their password prior to making any changes to the database settings adds no additional protection against a local attacker."
- Product
- Keepassxc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2023An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliCVE-2023-33568 · Other software · Dolibarr · reported by MITREHigh 7.5
An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023An attacker can exploit MDS COMPARE TOOL and use specially crafted inputs to read and modify database commands, resulting in the retrieval of additional informaCVE-2023-32115 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.2
An attacker can exploit MDS COMPARE TOOL and use specially crafted inputs to read and modify database commands, resulting in the retrieval of additional information persisted by the system.
- Product
- Master Data Synchronization (MDS COMPARE TOOL)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jun 9, 2023An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files.CVE-2023-29767 · Other software · Appcrossx · reported by MITREMedium 5.5
An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files.
- Product
- Crossx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2023An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause an escalation of Privileges via the database files.CVE-2023-29766 · Other software · Appcrossx · reported by MITREHigh 7.8
An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause an escalation of Privileges via the database files.
- Product
- Crossx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2023An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the database files.CVE-2023-29759 · Other software · Flightaware · reported by MITREMedium 5.5
An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the database files.
- Product
- Flightaware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2023schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated dataCVE-2023-2454 · Other software · Postgresql · reported by Red HatHigh 7.2
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.
- Product
- Postgresql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comsecurity.netapp.com
Jun 2, 2023The BT21 x BTS Wallpaper app 12 for Android allows unauthorized applications to actively request permission to insert data into the database that records informCVE-2023-29725 · Other software · Bt21 X BTS Wallpaper Project · reported by MITREMedium 5.5
The BT21 x BTS Wallpaper app 12 for Android allows unauthorized applications to actively request permission to insert data into the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the application is opened. By injecting data, the attacker can force the application to load malicious image URLs and display them in the UI. As the amount of data increases, it will eventually cause the application to trigger an OOM error and crash, resulting in a persistent denial of service attack.
- Product
- Bt21 X BTS Wallpaper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023The BT21 x BTS Wallpaper app 12 for Android allows unauthorized apps to actively request permission to modify data in the database that records information abouCVE-2023-29724 · Other software · Bt21 X BTS Wallpaper Project · reported by MITREHigh 7.8
The BT21 x BTS Wallpaper app 12 for Android allows unauthorized apps to actively request permission to modify data in the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the app is opened. An attacker could tamper with this data to cause an escalation of privilege attack.
- Product
- Bt21 X BTS Wallpaper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized applications to actively request permission to insert data into the database thatCVE-2023-29723 · Other software · Glitter Unicorn Wallpaper Project · reported by MITREHigh 7.5
The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized applications to actively request permission to insert data into the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the application is opened. By injecting data, the attacker can force the application to load malicious image URLs and display them in the UI. As the amount of data increases, it will eventually cause the application to trigger an OOM error and crash, resulting in a persistent denial of service attack.
- Product
- Glitter Unicorn Wallpaper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized apps to actively request permission to modify data in the database that records iCVE-2023-29722 · Other software · Glitter Unicorn Wallpaper Project · reported by MITRECritical 9.1
The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized apps to actively request permission to modify data in the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the app is opened. An attacker could tamper with this data to cause an escalation of privilege attack.
- Product
- Glitter Unicorn Wallpaper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.CVE-2023-29745 · Other software · Bestweather Project · reported by MITREHigh 7.1
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.
- Product
- Bestweather
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a code execution attack by manipulating the database.CVE-2023-29742 · Other software · Bestweather Project · reported by MITREHigh 7.8
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a code execution attack by manipulating the database.
- Product
- Bestweather
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.CVE-2023-29743 · Other software · Bestweather Project · reported by MITREHigh 7.5
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.
- Product
- Bestweather
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause an escalation of privileges attack by manipulating the database.CVE-2023-29741 · Other software · Bestweather Project · reported by MITRECritical 9.8
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause an escalation of privileges attack by manipulating the database.
- Product
- Bestweather
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause a denial of service attack by manipulating the database.CVE-2023-29740 · Other software · Amdroidapp · reported by MITREHigh 7.5
An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause a denial of service attack by manipulating the database.
- Product
- Alarm Clock For Heavy Sleepers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordamdroidapp.comgithub.com
May 30, 2023The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its database that is related CVE-2023-29727 · Other software · Applika · reported by MITRECritical 9.8
The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its database that is related to user privacy settings and affects the implementation of the normal functionality of the application. An attacker can use this to cause an escalation of privilege attack.
- Product
- Call Blocker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.complay.google.com
May 30, 2023An issue found in edjing Mix v.7.09.01 for Android allows a local attacker to cause a denial of service via the database files.CVE-2023-29735 · Other software · MWM · reported by MITREMedium 5.5
An issue found in edjing Mix v.7.09.01 for Android allows a local attacker to cause a denial of service via the database files.
- Product
- Edjing MIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023An issue found in edjing Mix v.7.09.01 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the database.CVE-2023-29734 · Other software · MWM · reported by MITRECritical 9.8
An issue found in edjing Mix v.7.09.01 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the database.
- Product
- Edjing MIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause a denial of service via the database files.CVE-2023-29737 · Other software · Wavekeyboard · reported by MITREMedium 5.5
An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause a denial of service via the database files.
- Product
- Wave Animated Keyboard Emoji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwavekeyboard.comgithub.com
May 24, 2023A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to sensitive data storedCVE-2023-33796 · Other software · Netbox · reported by MITRECritical 9.1
A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to sensitive data stored in the database. NOTE: the vendor disputes this because the reporter's only query was for the schema of the API, which is public; queries for database objects would have been denied.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2023SQLite JDBC is a library for accessing and creating SQLite database files in Java.CVE-2023-32697 · Other software · xerial · reported by GitHubHigh 8.8
SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.
- Product
- sqlite-jdbc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2023Dgraph is an open source distributed GraphQL database.CVE-2023-31135 · Other software · dgraph-io · reported by GitHubLow 3.3
Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come from the length of the log line being encrypted. This is problematic because two log lines will often have the same length, so due to these collisions we are reusing the same nonce many times. All audit logs generated by versions of Dgraph <v23.0.0 are affected. Attackers must have access to the system the logs are stored on. Dgraph users should upgrade to v23.0.0. Users unable to upgrade should store existing audit logs in a secure location and for extra security, encrypt using an external tool like `gpg`.
- Product
- dgraph
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.wikipedia.orggithub.com
May 17, 2023SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database and gain windows XP CVE-2023-31702 · Other software · Escanav · reported by MITREHigh 7.2
SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database and gain windows XP command shell to perform code execution on database server via GetUserCurrentPwd?UsrId=1.
- Product
- Escan Management Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 15, 2023Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL.CVE-2023-31131 · Other software · greenplum-db · reported by GitHubHigh 7.4
Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsafe methods to extract tar files within GPPKGs. greenplum-db is vulnerable to path traversal leading to arbitrary file writes. An attacker can use this vulnerability to overwrite data or system files potentially leading to crash or malfunction of the system. Any files which are accessible to the running process are at risk. All users are requested to upgrade to Greenplum Database version 6.23.2 or higher. There are no known workarounds for this vulnerability.
- Product
- gpdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023An issue in the __nss_database_lookup component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateCVE-2023-31613 · Other software · Openlinksw · reported by MITREHigh 7.5
An issue in the __nss_database_lookup component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- Product
- Virtuoso
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to modify database connecCVE-2022-47880 · Other software · Jedox · reported by MITREMedium 5.3
An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to modify database connections to disclose a connections' cleartext password via the 'test connection' function.
- Product
- Jedox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.syslifters.comdocs.syslifters.com
May 11, 2023Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding.CVE-2023-29195 · Other software · vitessio · reported by GitHubMedium 4.1
Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly. Version 16.0.2, corresponding to version 0.16.2 of the `go` module, contains a patch for this issue. Some workarounds are available. Always use `vtctldclient` to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.
- Product
- vitess
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023 A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) database systemCVE-2023-31150 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comHigh 8
A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) database system could allow an authenticated attacker to retrieve passwords. See SEL Service Bulletin dated 2022-11-15 for more details.
- Product
- SEL-3505
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordselinc.comnozominetworks.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.