Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,050 results · page 30 of 61
Feb 21, 2023Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-0947 · Other software · flatpressblog · reported by security@huntr.devCritical 9.8
Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.5.CVE-2023-0934 · Other software · answerdev · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.5.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2023Octobox is software for managing GitHub notifications.CVE-2021-32848 · Other software · octobox · reported by GitHubHigh 7.5
Octobox is software for managing GitHub notifications. Prior to pull request (PR) 2807, a user of the system can provide a specifically crafted search query string that will trigger a ReDoS vulnerability. This issue is fixed in PR 2807.
- Product
- octobox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2023Missing Authentication for Critical Function in GitHub repository kareadita/kavita prior to 0.7.0.CVE-2023-0919 · Other software · kareadita · reported by security@huntr.devHigh 8.1
Missing Authentication for Critical Function in GitHub repository kareadita/kavita prior to 0.7.0.
- Product
- kareadita/kavita
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2023Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.CVE-2023-0914 · Other software · pixelfed · reported by security@huntr.devMedium 5.3
Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.
- Product
- pixelfed/pixelfed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2023Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4.CVE-2023-0901 · Other software · pixelfed · reported by security@huntr.devMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4.
- Product
- pixelfed/pixelfed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2023Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cmsdocs/.CVE-2023-24078 · Other software · Realtimelogic · reported by MITREHigh 8.8
Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cmsdocs/.
- Product
- Fuguhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 16, 2023Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0880 · Other software · thorsten · reported by security@huntr.devHigh 8.3
Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.12.CVE-2023-0879 · Other software · btcpayserver · reported by security@huntr.devMedium 6.3
Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.12.
- Product
- btcpayserver/btcpayserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to 3.2.1.CVE-2023-0878 · Other software · nuxt · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to 3.2.1.
- Product
- nuxt/framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.CVE-2023-0877 · Other software · froxlor · reported by security@huntr.devHigh 8.8
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site.CVE-2023-22380 · Other software · GitHub · reported by product-cna@github.comMedium 6.5
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.6. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Feb 16, 2023Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3.0-DEV.CVE-2023-0866 · Other software · gpac · reported by security@huntr.devHigh 7.8
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3.0-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4.CVE-2023-0860 · Other software · modoboa · reported by security@huntr.devHigh 7.5
Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4.
- Product
- modoboa/modoboa-installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023Libpeconv – integer overflow, before commit 75b1565 (30/11/2022).CVE-2023-23462 · Other software · Hasherezade (github) · reported by cna@cyber.gov.ilCritical 9.8
Libpeconv – integer overflow, before commit 75b1565 (30/11/2022).
- Product
- Libpeconv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023Libpeconv – access violation, before commit b076013 (30/11/2022).CVE-2023-23461 · Other software · Hasherezade (github) · reported by cna@cyber.gov.ilCritical 9.8
Libpeconv – access violation, before commit b076013 (30/11/2022).
- Product
- Libpeconv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on external resources, whicCVE-2022-25978 · Other software · Usememos · reported by report@snyk.ioMedium 5.4
All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on external resources, which allows malicious actors to introduce links starting with a javascript: scheme.
- Product
- Memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2023Azure App Service on Azure Stack Hub Elevation of Privilege VulnerabilityCVE-2023-21777 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.7
Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
- Product
- Azure App Service on Azure Stack Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17.CVE-2023-0827 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to v2.3.0-DEV.CVE-2023-0819 · Other software · gpac · reported by security@huntr.devHigh 7.8
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to v2.3.0-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV.CVE-2023-0818 · Other software · gpac · reported by security@huntr.devMedium 5.5
Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023Buffer Over-read in GitHub repository gpac/gpac prior to v2.3.0-DEV.CVE-2023-0817 · Other software · gpac · reported by security@huntr.devHigh 7.8
Buffer Over-read in GitHub repository gpac/gpac prior to v2.3.0-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.11.CVE-2023-0810 · Other software · btcpayserver · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.11.
- Product
- btcpayserver/btcpayserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0794 · Other software · thorsten · reported by security@huntr.devHigh 8.3
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0793 · Other software · thorsten · reported by security@huntr.devHigh 7.1
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0792 · Other software · thorsten · reported by security@huntr.devMedium 6.5
Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0791 · Other software · thorsten · reported by security@huntr.devHigh 8.3
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0790 · Other software · thorsten · reported by security@huntr.devHigh 7.6
Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0789 · Other software · thorsten · reported by security@huntr.devHigh 8.1
Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0788 · Other software · thorsten · reported by security@huntr.devHigh 8.1
Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0787 · Other software · thorsten · reported by security@huntr.devHigh 8.1
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0786 · Other software · thorsten · reported by security@huntr.devHigh 8.4
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.CVE-2023-0780 · Other software · cockpit-hq · reported by security@huntr.devMedium 5.4
Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.
- Product
- cockpit-hq/cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023DataHub is an open-source metadata platform.CVE-2023-25562 · Other software · datahub-project · reported by GitHubMedium 6.9
DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout events. Any authentication checks using the `AuthUtils.hasValidSessionCookie()` method could be bypassed by using a cookie from a logged out session, as a result any logged out session cookie may be accepted as valid and therefore lead to an authentication bypass to the system. Users are advised to upgrade. There are no known workarounds for this issue. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-083.
- Product
- datahub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023DataHub is an open-source metadata platform.CVE-2023-25561 · Other software · datahub-project · reported by GitHubMedium 5.7
DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service (JAAS) authentication and that system is given a configuration which contains an error, the authentication for the system will fail open and allow an attacker to login using any username and password. The reason for this is that while an error is thrown in the `authenticateJaasUser` method it is swallowed without propagating the error. As a result of this issue unauthenticated users may gain access to the system. Users are advised to upgrade. There are no known workarounds for this issue. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-081.
- Product
- datahub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023DataHub is an open-source metadata platform.CVE-2023-25560 · Other software · datahub-project · reported by GitHubHigh 8.2
DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be able to augment these JSON strings to be sent to the backend and that can potentially be abused by including new or colliding values. This issue may lead to an authentication bypass and the creation of system accounts, which effectively can lead to full system compromise. Users are advised to upgrade. There are no known workarounds for this vulnerability. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-080.
- Product
- datahub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023DataHub is an open-source metadata platform.CVE-2023-25559 · Other software · datahub-project · reported by GitHubHigh 8.2
DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service (GMS) will use the X-DataHub-Actor HTTP header to infer the user the frontend is sending the request on behalf of. When the backends retrieves the header, its name is retrieved in a case-insensitive way. This case differential can be abused by an attacker to smuggle an X-DataHub-Actor header with different casing (eg: X-DATAHUB-ACTOR). This issue may lead to an authorization bypass by allowing any user to impersonate the system user account and perform any actions on its behalf. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-079.
- Product
- datahub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023DataHub is an open-source metadata platform.CVE-2023-25558 · Other software · datahub-project · reported by GitHubHigh 7.5
DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the `id_token` is done in an unsafe manner which is not properly accounted for by the DataHub frontend. Specifically, if any of the id_token claims value start with the {#sb64} prefix, pac4j considers the value to be a serialized Java object and will deserialize it. This issue may lead to Remote Code Execution (RCE) in the worst case. Although a `RestrictedObjectInputStream` is in place, that puts some restriction on what classes can be deserialized, it still allows a broad range of java packages and potentially exploitable with different gadget chains. Users are advised to upgrade. There are no known workarounds. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-086.
- Product
- datahub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023DataHub is an open-source metadata platform.CVE-2023-25557 · Other software · datahub-project · reported by GitHubHigh 7.5
DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or GraphQL requests to the backend. The goal of this proxy is to perform authentication if needed and forward HTTP requests to the DataHub Metadata Store (GMS). It has been discovered that the proxy does not adequately construct the URL when forwarding data to GMS, allowing external users to reroute requests from the DataHub Frontend to any arbitrary hosts. As a result attackers may be able to reroute a request from originating from the frontend proxy to any other server and return the result. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-076.
- Product
- datahub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.CVE-2023-0777 · Other software · modoboa · reported by security@huntr.devCritical 9.8
Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.
- Product
- modoboa/modoboa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 9, 2023SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop.CVE-2023-0771 · Other software · ampache · reported by security@huntr.devHigh 8.8
SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop.
- Product
- ampache/ampache
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2023Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.CVE-2023-0770 · Other software · gpac · reported by security@huntr.devHigh 7.8
Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2023github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing.CVE-2023-23631 · Other software · ipfs · reported by GitHubMedium 5.9
github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus fanout parameter in the HAMT directory nodes. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- go-unixfsnode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2023Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook inCVE-2023-22798 · Other software · Brave · reported by support@hackerone.comMedium 6.1
Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook in which the redirect interceptor may have been there for security purposes. This could potentially cause open redirects on these websites. Brave's redirect interceptor removal feature is known as "debouncing" and is intended to remove unnecessary redirects that track users across the web.
- Product
- Adblock-lists
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Feb 9, 2023Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to V2.1.0-DEV.CVE-2023-0760 · Other software · gpac · reported by security@huntr.devHigh 7.8
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to V2.1.0-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2023Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.CVE-2023-0759 · Other software · cockpit-hq · reported by security@huntr.devHigh 8.8
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.
- Product
- cockpit-hq/cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2023Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.CVE-2023-0748 · Other software · btcpayserver · reported by security@huntr.devMedium 6.4
Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.
- Product
- btcpayserver/btcpayserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2023Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.CVE-2023-0747 · Other software · btcpayserver · reported by security@huntr.devMedium 5.5
Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.
- Product
- btcpayserver/btcpayserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2023Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-0744 · Other software · answerdev · reported by security@huntr.devCritical 9.8
Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 8, 2023Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-0743 · Other software · answerdev · reported by security@huntr.devCritical 9
Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer prior to 1.0.4.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.