Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
461 results · page 3 of 10
Nov 26, 2024A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code.CVE-2024-53673 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.1
A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code.
- Product
- Insight Remote Support
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.CVE-2024-11622 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.3
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.
- Product
- HPE Insight Remote Support
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XMLCVE-2024-39726 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.2
IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- Product
- Engineering Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends.CVE-2024-47073 · Other software · dataease · reported by GitHubCritical 9.3
DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The vulnerability has been fixed in v2.10.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024An XSS vulnerability was discovered in Veritas Data Insight before 7.1.CVE-2024-47854 · Other software · Veritas · reported by MITREMedium 6.1
An XSS vulnerability was discovered in Veritas Data Insight before 7.1. It allows a remote attacker to inject an arbitrary web script into an HTTP request that could reflect back to an authenticated user without sanitization if executed by that user.
- Product
- Data Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024A vulnerability in a logging function of Cisco Nexus Dashboard Insights could allow an attacker with access to a tech support file to view sensitive informationCVE-2024-20491 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.3
A vulnerability in a logging function of Cisco Nexus Dashboard Insights could allow an attacker with access to a tech support file to view sensitive information. This vulnerability exists because remote controller credentials are recorded in an internal log that is stored in the tech support file. An attacker could exploit this vulnerability by accessing a tech support file that is generated from an affected system. A successful exploit could allow the attacker to view remote controller admin credentials in clear text. Note: Best practice is to store debug logs and tech support files safely and to share them only with trusted parties because they may contain sensitive information.
- Product
- Cisco Nexus Dashboard Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Sep 10, 2024Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability.CVE-2024-39583 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- PowerScale InsightIQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Dell PowerScale InsightIQ, version 5.0, contain a Use of hard coded Credentials vulnerability.CVE-2024-39582 · Other software · Dell · reported by security_alert@emc.comLow 2.3
Dell PowerScale InsightIQ, version 5.0, contain a Use of hard coded Credentials vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- PowerScale InsightIQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a File or Directories Accessible to External Parties vulnerability.CVE-2024-39581 · Other software · Dell · reported by security_alert@emc.comHigh 7.3
Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a File or Directories Accessible to External Parties vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability to read, modify, and delete arbitrary files.
- Product
- PowerScale InsightIQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains an Improper Access Control vulnerability.CVE-2024-39580 · Other software · Dell · reported by security_alert@emc.comMedium 6.7
Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains an Improper Access Control vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- PowerScale InsightIQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Dell PowerScale InsightIQ, version 5.1, contain an Improper Privilege Management vulnerability.CVE-2024-39574 · Other software · Dell · reported by security_alert@emc.comMedium 6.7
Dell PowerScale InsightIQ, version 5.1, contain an Improper Privilege Management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
- Product
- PowerScale InsightIQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local requCVE-2024-8042 · Other software · Rapid7 · reported by cve@rapid7.comLow 2.4
Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local requests to set the name and description of a new user group. This could potentially lead to an empty user group being added to the incorrect customer. This vulnerability is remediated as of August 14, 2024.
- Product
- Insight Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024SAP CRM ABAP (Insights Management) allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests.CVE-2024-41737 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5
SAP CRM ABAP (Insights Management) allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application.
- Product
- SAP CRM ABAP (Insights Management)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2024Dell InsightIQ, Verion 5.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability.CVE-2024-28972 · Other software · Dell · reported by security_alert@emc.comMedium 5.9
Dell InsightIQ, Verion 5.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure.
- Product
- InsightIQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2024Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can CVE-2024-6504 · Other software · Rapid7 · reported by cve@rapid7.comMedium 4.3
Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can cause it to overload or crash by sending repeated invalid REST requests in a short timeframe, to the Console's port 443 causing the console to enter an exception handling logging loop, exhausting the CPU. There is no indication that an attacker can use this method to escalate privilege, acquire unauthorized access to data, or gain control of protected resources. This issue is fixed in version 6.6.261.
- Product
- InsightVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rapid7.comdocs.rapid7.com
Jul 9, 2024WP2Speed Faster – Optimize PageSpeed Insights Score 90-100: Unauthorized accessCVE-2024-5810 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to overwrite CSS, update the trial settings, purge the cache, and find attachments.
- Product
- WP2Speed Faster – Optimize PageSpeed Insights Score 90-100
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 11, 2024A medium severity vulnerability in BIPS has been identified where an authenticated attacker with high privileges can access the SSH private keys via an informatCVE-2024-5813 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891Medium 5.9
A medium severity vulnerability in BIPS has been identified where an authenticated attacker with high privileges can access the SSH private keys via an information leak in the server response.
- Product
- BeyondInsight PasswordSafe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbeyondtrust.combeyondtrust.com
Jun 11, 2024A low severity vulnerability in BIPS has been identified where an attacker with high privileges or a compromised high privilege account can overwrite Read-Only CVE-2024-5812 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891Low 3.3
A low severity vulnerability in BIPS has been identified where an attacker with high privileges or a compromised high privilege account can overwrite Read-Only smart rules via a specially crafted API request.
- Product
- BeyondInsight PasswordSafe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbeyondtrust.combeyondtrust.com
Jun 4, 2024Prior to 23.1, an information disclosure vulnerability exists within BeyondInsight which can allow an attacker to enumerate usernames.CVE-2024-4220 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891Medium 4.3
Prior to 23.1, an information disclosure vulnerability exists within BeyondInsight which can allow an attacker to enumerate usernames.
- Product
- BeyondInsight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbeyondtrust.combeyondtrust.com
Jun 4, 2024Prior to 23.2, it is possible to perform arbitrary Server-Side requests via HTTP-based connectors within BeyondInsight, resulting in a server-side request forgeCVE-2024-4219 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891Medium 4.8
Prior to 23.2, it is possible to perform arbitrary Server-Side requests via HTTP-based connectors within BeyondInsight, resulting in a server-side request forgery vulnerability.
- Product
- BeyondInsight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbeyondtrust.combeyondtrust.com
May 14, 2024Dynamics 365 Customer Insights Spoofing VulnerabilityCVE-2024-30048 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.6
Dynamics 365 Customer Insights Spoofing Vulnerability
- Product
- Dynamics 365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 14, 2024Dynamics 365 Customer Insights Spoofing VulnerabilityCVE-2024-30047 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.6
Dynamics 365 Customer Insights Spoofing Vulnerability
- Product
- Dynamics 365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 25, 2024Google Analytics by Monster Insights: Missing AuthorizationCVE-2023-52220 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MonsterInsights Google Analytics by Monster Insights.This issue affects Google Analytics by Monster Insights: from n/a through 8.21.0.
- Product
- Google Analytics by Monster Insights
- Affected
- up to 8.21.0
- What to do
- Affects up to 8.21.0. Update Google Analytics by Monster Insights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 23, 2024 A key used in logging.json does not follow the least privilege principle by default and is exposed to local users in the Rapid7 Platform.CVE-2024-3185 · Other software · Rapid7 · reported by cve@rapid7.comMedium 6.8
A key used in logging.json does not follow the least privilege principle by default and is exposed to local users in the Rapid7 Platform. This allows an attacker with local access to a machine with the logging.json file to use that key to authenticate to the platform with high privileges. This was fixed in the Rapid7 platform starting 3 April 2024 via the introduction of a restricted role and the removal of automatic API key generation on installation of an agent.
- Product
- Insight Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rapid7.comdocs.rapid7.com
Apr 2, 2024Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through queCVE-2024-2745 · Other software · Rapid7 · reported by cve@rapid7.comLow 3.3
Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded. This vulnerability allows attackers to acquire sensitive information such as passwords, auth tokens, usernames etc. The vulnerability is remediated in version 6.6.244.
- Product
- InsightVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rapid7.comdocs.rapid7.com
Mar 27, 2024Dell InsightIQ, version 5.0, contains an improper access control vulnerability.CVE-2024-25962 · Other software · Dell · reported by security_alert@emc.comHigh 8.3
Dell InsightIQ, version 5.0, contains an improper access control vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to unauthorized access to monitoring data.
- Product
- InsightIQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024Matomo Analytics – Ethical Stats. Powerful Insights.: Reflected Cross-Site ScriptingCVE-2023-6923 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Matomo Analytics – Ethical Stats. Powerful Insights.
- Affected
- up to 4.15.3
- What to do
- Affects up to 4.15.3. Update Matomo Analytics – Ethical Stats. Powerful Insights. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 12, 2024Analytics Insights for Google Analytics 4 (AIWP): Is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callbackCVE-2024-0250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin before 6.3 is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
- Product
- Analytics Insights for Google Analytics 4 (AIWP)
- Fixed in
- 6.3
- What to do
- Update Analytics Insights for Google Analytics 4 (AIWP) to 6.3 or newer.
Jan 2, 2024An issue discovered in the Order and Invoice pages in Floorsight Insights Q3 2023 allows an unauthenticated remote attacker to view sensitive customer informatiCVE-2023-45892 · Other software · Floorsightsoftware · reported by MITREHigh 7.5
An issue discovered in the Order and Invoice pages in Floorsight Insights Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information.
- Product
- Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023MonsterInsights Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-32291 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MonsterInsights Pro allows Stored XSS.This issue affects MonsterInsights Pro: from n/a through 8.14.1.
- Product
- MonsterInsights Pro
- Affected
- up to 8.14.1
- What to do
- Affects up to 8.14.1. Update MonsterInsights Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 1, 2023A vulnerability was found in insights-client.CVE-2023-3972 · Other software · Red Hat · reported by Red HatHigh 7.8
A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local user or attacker could create the /var/tmp/insights-client directory (owning the directory with read, write, and execute permissions) on the system. After the insights-client is registered by root, an attacker could then control the directory content that insights are using by putting malicious scripts into it and executing arbitrary code as root (trivially bypassing SELinux protections because insights processes are allowed to disable SELinux system-wide).
- Product
- Red Hat Enterprise Linux 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 11, 2023BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content.CVE-2022-44758 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly authorized.
- Product
- BigFix Insights for Vulnerability Remediation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 11, 2023BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure.CVE-2022-44757 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive information, modify data in unexpected ways, etc.
- Product
- BigFix Insights for Vulnerability Remediation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 10, 2023Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege VulnerabilityCVE-2023-36419 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability
- Product
- Azure HDInsight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 12, 2023Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege VulnerabilityCVE-2023-38156 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege Vulnerability
- Product
- Azure HDInsight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023Azure Apache Hadoop Spoofing VulnerabilityCVE-2023-38188 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.5
Azure Apache Hadoop Spoofing Vulnerability
- Product
- Azure HDInsight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023Azure Apache Ambari Spoofing VulnerabilityCVE-2023-36881 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.5
Azure Apache Ambari Spoofing Vulnerability
- Product
- Azure HDInsight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023Azure Apache Oozie Spoofing VulnerabilityCVE-2023-36877 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.5
Azure Apache Oozie Spoofing Vulnerability
- Product
- Azure HDInsight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023Azure HDInsight Jupyter Notebook Spoofing VulnerabilityCVE-2023-35394 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.6
Azure HDInsight Jupyter Notebook Spoofing Vulnerability
- Product
- Azure HDInsight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023Azure Apache Hive Spoofing VulnerabilityCVE-2023-35393 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.5
Azure Apache Hive Spoofing Vulnerability
- Product
- Azure HDInsight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 27, 2023Directory traversal vulnerability in Jinfornet Jreport 15.6 allows unauthenticated attackers to gain sensitive information.CVE-2020-22623 · Other software · Insightsoftware · reported by MITREHigh 7.5
Directory traversal vulnerability in Jinfornet Jreport 15.6 allows unauthenticated attackers to gain sensitive information.
- Product
- Jreport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2023 There is SQL injection vulnerability in Esri ArcGIS Insights Desktop for Mac and Windows version 2022.1 that may allow a local, authorized attacker to executeCVE-2023-25839 · Other software · Esri · reported by psirt@esri.comHigh 7
There is SQL injection vulnerability in Esri ArcGIS Insights Desktop for Mac and Windows version 2022.1 that may allow a local, authorized attacker to execute arbitrary SQL commands against the back-end database. The effort required to generate the crafted input required to exploit this issue is complex and requires significant effort before a successful attack can be expected.
- Product
- ArcGIS Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2023 There is SQL injection vulnerability in Esri ArcGIS Insights 2022.1 for ArcGIS Enterprise and that may allow a remote, authorized attacker to execute arbitraryCVE-2023-25838 · Other software · Esri · reported by psirt@esri.comHigh 7.5
There is SQL injection vulnerability in Esri ArcGIS Insights 2022.1 for ArcGIS Enterprise and that may allow a remote, authorized attacker to execute arbitrary SQL commands against the back-end database. The effort required to generate the crafted input required to exploit this issue is complex and requires significant effort before a successful attack can be expected.
- Product
- ArcGIS Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2023DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends.CVE-2023-35164 · Other software · dataease · reported by GitHubMedium 6.3
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions a missing authorization check allows unauthorized users to manipulate a dashboard created by the administrator. This vulnerability has been fixed in version 1.18.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2023DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends.CVE-2023-35168 · Other software · dataease · reported by GitHubMedium 6.5
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privilege bypass vulnerability where ordinary users can gain access to the user database. Exposed information includes md5 hashes of passwords, username, email, and phone number. The vulnerability has been fixed in v1.18.8. Users are advised to upgrade. There are no known workarounds for the vulnerability.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2023DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends.CVE-2023-34463 · Other software · dataease · reported by GitHubHigh 8.1
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions Unauthorized users can delete an application erroneously. This vulnerability has been fixed in version 1.18.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.CVE-2023-23344 · Other software · HCL Software · reported by psirt@hcl.comLow 3
A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.
- Product
- HCL BigFix WebUI Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 16, 2023A security vulnerability in HPE Insight Remote Support may result in the local disclosure of privileged LDAP information.CVE-2023-30904 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 5.5
A security vulnerability in HPE Insight Remote Support may result in the local disclosure of privileged LDAP information.
- Product
- HPE Insight Remote Support
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Jun 7, 2023Aria Operations for Networks contains an information disclosure vulnerability.CVE-2023-20889 · Other software · VMware · reported by security@vmware.comHigh 7.5
Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in information disclosure.
- Product
- Vrealize Network Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023Aria Operations for Networks contains an authenticated deserialization vulnerability.CVE-2023-20888 · Other software · VMware · reported by security@vmware.comHigh 8.8
Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution.
- Product
- Vrealize Network Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.