Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
317 results · page 3 of 7
Mar 27, 2024BizPrint: Cross-Site Request Forgery (CSRF)CVE-2024-29773 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in BizSwoop a CPF Concepts, LLC Brand BizPrint allows Cross-Site Scripting (XSS).This issue affects BizPrint: from n/a through 4.5.5.
- Product
- BizPrint
- Affected
- up to 4.5.5
- What to do
- Affects up to 4.5.5. Update BizPrint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 17, 2024A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service (grossd daemon crash)CVE-2023-52159 · Other software · Bizdelnick · reported by MITREHigh 7.5
A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service (grossd daemon crash) or potentially execute arbitrary code in grossd via crafted SMTP transaction parameters that cause an incorrect strncat for a log entry.
- Product
- Gross
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeberg.orglists.debian.org
Feb 28, 2024Possible path traversal in Apache OFBiz allowing authentication bypass.CVE-2024-25065 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comissues.apache.org
Feb 28, 2024Possible path traversal in Apache OFBiz allowing file inclusion.CVE-2024-23946 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to version 18.12.12, that fixes the issue.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comissues.apache.org
Feb 8, 2024An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to exCVE-2024-24202 · Other software · easycorp · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to execute arbitrary code via uploading a crafted .txt file.
- Product
- zentao_max
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclammy-blizzard-8ef.notion.siteclammy-blizzard-8ef.notion.site
Jan 15, 2024A vulnerability has been found in DedeBIZ 6.3.0 and classified as critical.CVE-2024-0558 · Other software · Dedebiz · reported by VulDBMedium 4.7
A vulnerability has been found in DedeBIZ 6.3.0 and classified as critical. This vulnerability affects unknown code of the file /admin/makehtml_freelist_action.php. The manipulation of the argument startid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250726 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2024A vulnerability, which was classified as problematic, was found in DedeBIZ 6.3.0.CVE-2024-0557 · Other software · Dedebiz · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, was found in DedeBIZ 6.3.0. This affects an unknown part of the component Website Copyright Setting. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250725 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2023A vulnerability was found in Muyun DedeBIZ up to 6.2.12 and classified as critical.CVE-2023-7181 · Other software · Muyun · reported by VulDBMedium 4.7
A vulnerability was found in Muyun DedeBIZ up to 6.2.12 and classified as critical. Affected by this issue is some unknown functionality of the component Add Attachment Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249368. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DedeBIZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code CVE-2023-51467 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordissues.apache.orglists.apache.org
Dec 26, 2023Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.CVE-2023-50968 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comissues.apache.org
Dec 13, 2023Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature.CVE-2023-31546 · Other software · Dedebiz · reported by MITRECritical 9.6
Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023A vulnerability was found in DedeBIZ 6.2 and classified as critical.CVE-2023-6755 · Other software · Dedebiz · reported by VulDBMedium 4.7
A vulnerability was found in DedeBIZ 6.2 and classified as critical. This issue affects some unknown processing of the file /src/admin/content_batchup_action.php. The manipulation of the argument endid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247883. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2023Pre-auth RCE in Apache Ofbiz 18.12.09.CVE-2023-49070 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comissues.apache.org
Nov 7, 2023Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin.CVE-2023-46819 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09. Users are recommended to upgrade to version 18.12.09
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgofbiz.apache.org
Oct 26, 2023Zentao Biz version 8.7 and before is vulnerable to Information Disclosure.CVE-2023-46376 · Other software · Zentao · reported by MITREHigh 7.5
Zentao Biz version 8.7 and before is vulnerable to Information Disclosure.
- Product
- BIZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnarrow-payment-2cd.notion.sitenarrow-payment-2cd.notion.site
Oct 26, 2023ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF).CVE-2023-46375 · Other software · Zentao · reported by MITREHigh 8.8
ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF).
- Product
- BIZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnarrow-payment-2cd.notion.sitenarrow-payment-2cd.notion.site
Oct 26, 2023ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library.CVE-2023-46491 · Other software · Zentao · reported by MITREMedium 6.1
ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library.
- Product
- BIZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforemost-smash-52a.notion.siteforemost-smash-52a.notion.site
Oct 26, 2023ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS).CVE-2023-46374 · Other software · Zentao · reported by MITREMedium 6.1
ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS).
- Product
- BIZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnarrow-payment-2cd.notion.sitenarrow-payment-2cd.notion.site
Oct 9, 2023An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code viCVE-2023-44827 · Other software · Easycorp · reported by MITREHigh 8.8
An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code via a crafted script to the Office Conversion Settings function.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspotted-topaz-6aa.notion.sitespotted-topaz-6aa.notion.site
Sep 29, 2023A vulnerability was found in DedeBIZ 6.2 and classified as critical.CVE-2023-5268 · Other software · Dedebiz · reported by VulDBMedium 6.3
A vulnerability was found in DedeBIZ 6.2 and classified as critical. This issue affects some unknown processing of the file /src/admin/makehtml_taglist_action.php. The manipulation of the argument mktime leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240881 was assigned to this vulnerability.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A vulnerability, which was classified as critical, was found in DedeBIZ 6.2.CVE-2023-5266 · Other software · Dedebiz · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in DedeBIZ 6.2. This affects an unknown part of the file /src/admin/tags_main.php. The manipulation of the argument ids leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240879.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023DedeBIZ v6.2.11 was discovered to contain multiple remote code execution (RCE) vulnerabilities at /admin/file_manage_control.php via the $activepath and $filenaCVE-2023-43234 · Other software · Dedebiz · reported by MITRECritical 9.8
DedeBIZ v6.2.11 was discovered to contain multiple remote code execution (RCE) vulnerabilities at /admin/file_manage_control.php via the $activepath and $filename parameters.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023A stored cross-site scripting (XSS) vulnerability in the Website column management function of DedeBIZ v6.2.11 allows attackers to execute arbitrary web scriptsCVE-2023-43232 · Other software · Dedebiz · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Website column management function of DedeBIZ v6.2.11 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2023A vulnerability was found in DedeBIZ 6.2.10.CVE-2023-4170 · Other software · Dedebiz · reported by VulDBLow 3.5
A vulnerability was found in DedeBIZ 6.2.10. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Article Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-236186 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability, which was classified as problematic, has been found in DedeBIZ 6.2.10.CVE-2023-3839 · Other software · Dedebiz · reported by VulDBMedium 4.1
A vulnerability, which was classified as problematic, has been found in DedeBIZ 6.2.10. Affected by this issue is some unknown functionality of the file /admin/sys_sql_query.php. The manipulation of the argument sqlquery leads to sql injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-235190 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability classified as problematic was found in DedeBIZ 6.2.10.CVE-2023-3838 · Other software · Dedebiz · reported by VulDBLow 2.4
A vulnerability classified as problematic was found in DedeBIZ 6.2.10. Affected by this vulnerability is an unknown functionality of the file /admin/vote_edit.php. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235189 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability classified as problematic has been found in DedeBIZ 6.2.10.CVE-2023-3837 · Other software · Dedebiz · reported by VulDBLow 2.4
A vulnerability classified as problematic has been found in DedeBIZ 6.2.10. Affected is an unknown function of the file /admin/sys_sql_query.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235188. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php.CVE-2023-30198 · Other software · Webbax · reported by MITREHigh 7.5
Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php.
- Product
- Winbizpayment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comfriends-of-presta.github.io
Jun 7, 2023Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.CVE-2023-33510 · Other software · Jeecg P3 BIZ Chat Project · reported by MITREHigh 7.5
Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.
- Product
- Jeecg P3 BIZ Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcarl1l.github.iocarl1l.github.io
May 15, 2023BizLibrary: Does not sanitise and escape some of its settingsCVE-2023-0892 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BizLibrary WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- BizLibrary
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update BizLibrary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 1, 2023OpenText BizManager before 16.6.0.1 does not perform proper validation during the change-password operation.CVE-2022-35898 · Other software · Opentext · reported by MITRECritical 9.8
OpenText BizManager before 16.6.0.1 does not perform proper validation during the change-password operation. This allows any authenticated user to change the password of any other user, including the Administrator account.
- Product
- Bizmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbusinessnetwork.opentext.comhackandpwn.com
Apr 14, 2023Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin.CVE-2022-47501 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jan 11, 2023A vulnerability, which was classified as critical, was found in IonicaBizau node-gry up to 5.x.CVE-2020-36650 · Other software · IonicaBizau · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in IonicaBizau node-gry up to 5.x. This affects an unknown part. The manipulation leads to command injection. Upgrading to version 6.0.0 is able to address this issue. The patch is named 5108446c1e23960d65e8b973f1d9486f9f9dbd6c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218019.
- Product
- node-gry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2022dedecmdv6 6.1.9 is vulnerable to SQL Injection.CVE-2022-44120 · Other software · Dedebiz · reported by MITRECritical 9.8
dedecmdv6 6.1.9 is vulnerable to SQL Injection. via sys_sql_query.php.
- Product
- Dedecmsv6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 23, 2022dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution (RCE) via file_manage_control.php.CVE-2022-44118 · Other software · Dedebiz · reported by MITRECritical 9.8
dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution (RCE) via file_manage_control.php.
- Product
- Dedecmsv6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 23, 2022dedecmdv6 v6.1.9 is vulnerable to Arbitrary file deletion via file_manage_control.php.CVE-2022-43196 · Other software · Dedebiz · reported by MITRECritical 9.1
dedecmdv6 v6.1.9 is vulnerable to Arbitrary file deletion via file_manage_control.php.
- Product
- Dedecmsv6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Sep 15, 2022Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0.CVE-2022-3224 · Other software · ionicabizau · reported by security@huntr.devMedium 6.1
Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0.
- Product
- ionicabizau/parse-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2022Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.CVE-2022-2900 · Other software · ionicabizau · reported by security@huntr.devCritical 9.1
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.
- Product
- ionicabizau/parse-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2022Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticatCVE-2022-29158 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Sep 2, 2022The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099.CVE-2022-29063 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099. In version 18.12.05 and earlier, by hosting a malicious RMI server on localhost, an attacker may exploit this behavior, at server start-up or on a server restart, in order to run arbitrary code. Upgrade to at least 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12646.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Sep 2, 2022In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “SuCVE-2022-25813 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SSTI. A RCE is then possible.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Sep 2, 2022Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports.CVE-2022-25371 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. By leveraging a bug in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142) it is possible to perform a remote code execution (RCE) attack in Apache OFBiz, release 18.12.05 and earlier.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Sep 2, 2022Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports.CVE-2022-25370 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inject a malicious payload and execute it using the stored XSS.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Aug 17, 2022DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys_info.php.CVE-2022-36215 · Other software · Dedebiz · reported by MITREHigh 7.2
DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys_info.php.
- Product
- Dedecmsv6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022Origin validation error vulnerability in NeoRS’s ActiveX moudle allows attackers to download and execute arbitrary files.CVE-2022-23763 · Other software · DOUZONE BIZON Co.,Ltd · reported by vuln@krcert.or.krHigh 7.8
Origin validation error vulnerability in NeoRS’s ActiveX moudle allows attackers to download and execute arbitrary files. Remote attackers can use this vulerability to encourage users to access crafted web pages, causing damage such as malicious code infections.
- Product
- NeoRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Jun 28, 2022Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0.CVE-2022-0624 · Other software · ionicabizau · reported by security@huntr.devHigh 7.3
Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0.
- Product
- ionicabizau/parse-path
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0.CVE-2022-2218 · Other software · ionicabizau · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0.
- Product
- ionicabizau/parse-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.CVE-2022-2216 · Other software · ionicabizau · reported by security@huntr.devCritical 9.8
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.
- Product
- ionicabizau/parse-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Cross-site Scripting (XSS) - Generic in GitHub repository ionicabizau/parse-url prior to 7.0.0.CVE-2022-2217 · Other software · ionicabizau · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository ionicabizau/parse-url prior to 7.0.0.
- Product
- ionicabizau/parse-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0.CVE-2022-0722 · Other software · ionicabizau · reported by security@huntr.devHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0.
- Product
- ionicabizau/parse-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.