Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,716 results · page 30 of 55
Sep 9, 2022Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.21-6 allows privileged attackers to trigger a XSS on a victim's devices.CVE-2022-36859 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.7
Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.21-6 allows privileged attackers to trigger a XSS on a victim's devices.
- Product
- SmartTagPlugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 8, 2022XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform.CVE-2022-36100 · Other software · xwiki · reported by GitHubCritical 9.9
XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform Applications Tag and prior to 13.10.6 and 14.4 in XWiki Platform Tag UI, the tags document `Main.Tags` in XWiki didn't sanitize user inputs properly. This allowed users with view rights on the document (default in a public wiki or for authenticated users on private wikis) to execute arbitrary Groovy, Python and Velocity code with programming rights. This also allowed bypassing all rights checks and thus both modification and disclosure of all content stored in the XWiki installation. The vulnerability could be used to impact the availability of the wiki. On XWiki versions before 13.10.4 and 14.2, this can be combined with CVE-2022-36092, meaning that no rights are required to perform the attack. The vulnerability has been patched in versions 13.10.6 and 14.4. As a workaround, the patch that fixes the issue can be manually applied to the document `Main.Tags` or the updated version of that document can be imported from version 14.4 of xwiki-platform-tag-ui using the import feature in the administration UI on XWiki 10.9 and late
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022Migration, Backup, Staging – WPvivid: Deserialization of untrusted inputCVE-2022-2442 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter in versions up to, and including 0.9.74. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- Migration, Backup, Staging – WPvivid
- Affected
- up to 0.9.74
- What to do
- Affects up to 0.9.74. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 24, 2022A flaw was found in JSS, where it did not properly free up all memory.CVE-2021-4213 · Other software · Dogtagpki · reported by Red HatHigh 7.5
A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.
- Product
- Network Security Services For Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 22, 2022wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial asset IP aCVE-2022-35583 · Other software · Wkhtmltopdf · reported by MITRECritical 9.8
wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial asset IP address on it's source. This allows the attacker to takeover the whole infrastructure by accessing their internal assets.
- Product
- Wkhtmltopdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcyber-guy.gitbook.io
Aug 16, 2022SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via swf_DefineLosslessBitsTagToImage at /modules/swfbits.c.CVE-2022-35113 · Other software · Swftools · reported by MITREMedium 5.5
SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via swf_DefineLosslessBitsTagToImage at /modules/swfbits.c.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2022Better Tag Cloud: Does not sanitise and escape some of its settingsCVE-2022-2412 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Better Tag Cloud WordPress plugin through 0.99.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Better Tag Cloud
- Affected
- up to 0.99.5
- What to do
- Affects up to 0.99.5. Update Better Tag Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022Auto More Tag: Does not sanitise and escape some of its settingsCVE-2022-2411 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Auto More Tag WordPress plugin through 4.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Auto More Tag
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Auto More Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2022The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions.CVE-2022-1293 · Other software · Thales · reported by psirt@thalesgroup.comMedium 5.7
The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions.
- Product
- Citadel Web Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Simple Membership: Allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameterCVE-2022-2317 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter.
- Product
- Simple Membership
- Fixed in
- 4.1.3
- What to do
- Update Simple Membership to 4.1.3 or newer.
Jul 29, 2022DedeCMS v5.7.95 was discovered to contain a remote code execution (RCE) vulnerability via the component mytag_ main.php.CVE-2022-34531 · Other software · Dedecms · reported by MITRECritical 9.8
DedeCMS v5.7.95 was discovered to contain a remote code execution (RCE) vulnerability via the component mytag_ main.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2022Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks.CVE-2022-2414 · Other software · Dogtagpki · reported by Red HatHigh 7.5
Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
- Product
- Dogtagpki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2022A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials.CVE-2022-34754 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 6.8
A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials. Affected Products: Acti9 PowerTag Link C (A9XELC10-A) (V1.7.5 and prior), Acti9 PowerTag Link C (A9XELC10-B) (V2.12.0 and prior)
- Product
- Acti9 PowerTag Link C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jul 10, 2022The uncleYiba/photo_tag repository through 2020-08-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31560 · Other software · Photo TAG Project · reported by MITRECritical 9.3
The uncleYiba/photo_tag repository through 2020-08-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Photo TAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2022It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checkCVE-2015-5236 · Other software · Icedtea-web Project · reported by Red HatHigh 7.5
It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value.
- Product
- Icedtea-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Jun 28, 2022In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformatting/editing of emaiCVE-2022-29269 · Other software · Nagios · reported by MITREMedium 6.5
In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformatting/editing of emails from an official email address.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.nagios.comgithub.com
Jun 28, 2022In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest (XHR).CVE-2022-28803 · Other software · Silverstripe · reported by MITREMedium 5.4
In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest (XHR).
- Product
- Silverstripe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsilverstripe.orgsilverstripe.org
Jun 28, 2022Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS usCVE-2022-25238 · Other software · Silverstripe · reported by MITREMedium 5.4
Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code.
- Product
- Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.silverstripe.orgforum.silverstripe.org
Jun 23, 2022Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parameters, resulting iCVE-2022-34189 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Image Tag Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c.CVE-2022-33070 · Other software · Protobuf-c Project · reported by MITREMedium 5.5
Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
- Product
- Protobuf-c
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022A vulnerability, which was classified as problematic, has been found in Alpine PhotoTile for Instagram Plugin 1.2.7.7.CVE-2017-20087 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Alpine PhotoTile for Instagram Plugin 1.2.7.7. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely.
- Product
- Alpine PhotoTile for Instagram Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022Improper Input Validation vulnerability in synaTEE.signed.dll of Synaptics Fingerprint Driver allows a local authorized attacker to overwrite a heap tag, with pCVE-2021-3675 · Other software · Synaptics · reported by PSIRT@synaptics.comMedium 5.5
Improper Input Validation vulnerability in synaTEE.signed.dll of Synaptics Fingerprint Driver allows a local authorized attacker to overwrite a heap tag, with potential loss of confidentiality. This issue affects: Synaptics Synaptics Fingerprint Driver 5.1.xxx.26 versions prior to xxx=340 on x86/64; 5.2.xxxx.26 versions prior to xxxx=3541 on x86/64; 5.2.2xx.26 versions prior to xx=29 on x86/64; 5.2.3xx.26 versions prior to xx=25 on x86/64; 5.3.xxxx.26 versions prior to xxxx=3543 on x86/64; 5.5.xx.1058 versions prior to xx=44 on x86/64; 5.5.xx.1102 versions prior to xx=34 on x86/64; 5.5.xx.1116 versions prior to xx=14 on x86/64; 6.0.xx.1104 versions prior to xx=50 on x86/64; 6.0.xx.1108 versions prior to xx=31 on x86/64; 6.0.xx.1111 versions prior to xx=58 on x86/64.
- Product
- Synaptics Fingerprint Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.lenovo.com
Jun 15, 2022In auth_store of sjtag-driver.c, there is a possible read of uninitialized memory due to a missing bounds check.CVE-2022-20176 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In auth_store of sjtag-driver.c, there is a possible read of uninitialized memory due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-197787879References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 14, 2022Improper validation of tag id while RRC sending tag id to MAC can lead to TOCTOU race condition in Snapdragon Connectivity, Snapdragon MobileCVE-2021-35111 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Improper validation of tag id while RRC sending tag id to MAC can lead to TOCTOU race condition in Snapdragon Connectivity, Snapdragon Mobile
- Product
- Snapdragon Connectivity, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 14, 2022Possible buffer over read due to improper calculation of string length while parsing Id3 tag in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnCVE-2021-35100 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Possible buffer over read due to improper calculation of string length while parsing Id3 tag in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 13, 2022Google Tag Manager for WordPress (GTM4WP): Stored Cross-Site ScriptingCVE-2022-1961 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4wp-options[scroller-contentid]` parameter found in the `~/public/frontend.php` file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Google Tag Manager for WordPress (GTM4WP)
- Affected
- up to 1.15.1
- What to do
- Affects up to 1.15.1. Update Google Tag Manager for WordPress (GTM4WP) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Jun 13, 2022Google Tag Manager for: Reflected Cross-Site ScriptingCVE-2022-1707 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating into the data layer of sites with insufficient sanitization in versions up to an including 1.15. The affected file is ~/public/frontend.php and this could be exploited by unauthenticated attackers.
- Product
- Google Tag Manager for
- Fixed in
- 1.15.1
- What to do
- Update Google Tag Manager for to 1.15.1 or newer.
Jun 10, 2022The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags.CVE-2022-24278 · Other software · Convert-svg Project · reported by report@snyk.ioHigh 7.5
The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file.
- Product
- Convert-svg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2022FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections.CVE-2021-42245 · Other software · Flatcore · reported by MITREMedium 6.1
FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections.
- Product
- Flatcore-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name of the target git repCVE-2021-34081 · Other software · Gitsome Project · reported by MITREHigh 8.8
OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name of the target git repository.
- Product
- Gitsome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.checkmarx.netnpmjs.com
May 27, 2022The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.CVE-2021-27781 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.6
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
- Product
- HCL BigFix Mobile / Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 26, 2022A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attriCVE-2022-27777 · Other software · Rubyonrails · reported by support@hackerone.comMedium 6.1
A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.
- Product
- Actionpack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.rubyonrails.orglists.debian.org
May 24, 2022epub2txt2 v2.04 was discovered to contain an integer overflow via the function bug in _parse_special_tag at sxmlc.c.CVE-2022-29358 · Other software · Epub2txt2 Project · reported by MITREMedium 5.5
epub2txt2 v2.04 was discovered to contain an integer overflow via the function bug in _parse_special_tag at sxmlc.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted XML file.
- Product
- Epub2txt2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Pion DTLS is a Go implementation of Datagram Transport Layer Security.CVE-2022-29222 · Other software · pion · reported by GitHubMedium 5.9
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.
- Product
- dtls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Pion DTLS is a Go implementation of Datagram Transport Layer Security.CVE-2022-29190 · Other software · pion · reported by GitHubHigh 7.5
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.
- Product
- dtls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Pion DTLS is a Go implementation of Datagram Transport Layer Security.CVE-2022-29189 · Other software · pion · reported by GitHubMedium 5.3
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could exploit this to cause excessive memory usage. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.
- Product
- dtls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2022The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmCVE-2021-32934 · Other software · ThroughTek · reported by ics-cert@hq.dhs.govCritical 9.1
The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module) do not sufficiently protect data transferred between the local device and ThroughTek servers. This can allow an attacker to access sensitive information, such as camera feeds.
- Product
- P2P SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call to the Stage 2 Bootloader potentially leading to corrupt memoCVE-2021-26386 · Other software · AMD · reported by psirt@amd.comHigh 7.8
A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call to the Stage 2 Bootloader potentially leading to corrupt memory and code execution.
- Product
- Ryzen™ Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022A malicious or compromised User Application (UApp) or AGESA Boot Loader (ABL) could be used by an attacker to exfiltrate arbitrary memory from the ASP stage 2 bCVE-2021-26361 · Other software · AMD · reported by psirt@amd.comMedium 5.5
A malicious or compromised User Application (UApp) or AGESA Boot Loader (ABL) could be used by an attacker to exfiltrate arbitrary memory from the ASP stage 2 bootloader potentially leading to information disclosure.
- Product
- Ryzen™ Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Sensitive information accessible by physical probing of JTAG interface for some Intel(R) Processors with SGX may allow an unprivileged user to potentially enablCVE-2022-0005 · Other software · Intel · reported by secure@intel.comLow 2.4
Sensitive information accessible by physical probing of JTAG interface for some Intel(R) Processors with SGX may allow an unprivileged user to potentially enable information disclosure via physical access.
- Product
- Celeron G5205u Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editAgent.php?agent_id=.CVE-2022-30001 · Other software · Angeljudesuarez · reported by MITRECritical 9.8
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editAgent.php?agent_id=.
- Product
- Insurance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Tieba-Cloud-Sign v4.9 was discovered to contain a cross-site scripting (XSS) vulnerability via the function strip_tags.CVE-2022-28920 · Other software · Moecraft · reported by MITREMedium 4.8
Tieba-Cloud-Sign v4.9 was discovered to contain a cross-site scripting (XSS) vulnerability via the function strip_tags.
- Product
- Tieba-cloud-sign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Insufficient bound checks in the System Management Unit (SMU) may result in a system voltage malfunction that could result in denial of resources and/or possiblCVE-2021-26373 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Insufficient bound checks in the System Management Unit (SMU) may result in a system voltage malfunction that could result in denial of resources and/or possibly denial of service.
- Product
- EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2022IBM Navigator for i 7.2, 7.3, and 7.4 (heritage version) could allow a remote attacker to obtain access to the web interface without valid credentials.CVE-2022-22481 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Navigator for i 7.2, 7.3, and 7.4 (heritage version) could allow a remote attacker to obtain access to the web interface without valid credentials. By modifying the sign on request, an attacker can gain visibility to the fully qualified domain name of the target system and the navigator tasks page, however they do not gain the ability to perform those tasks on the system or see any specific system data. IBM X-Force ID: 225899.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 2, 2022Photo Gallery: Does not properly escape the $_POST['filter_tag'] parameterCVE-2022-1281 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Injection attacks possible.
- Product
- Photo Gallery
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
May 2, 2022The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element (if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag is true).CVE-2022-29969 · Other software · Mediawiki · reported by MITREMedium 6.1
The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element (if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag is true).
- Product
- RSS For Mediawiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
May 1, 2022All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user input (such as <not-a-tag />) that is CVE-2022-25349 · Other software · Materializecss · reported by report@snyk.ioMedium 5.4
All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user input (such as <not-a-tag />) that is being parsed as HTML/JavaScript, and inserted into the Document Object Model (DOM). This vulnerability can be exploited when the user-input is provided to the autocomplete component.
- Product
- Materialize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2022This affects the package @yaireo/tagify before 4.9.8.CVE-2022-25854 · Other software · Tagify Project · reported by report@snyk.ioMedium 5.4
This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.
- Product
- Tagify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Turtlapp Turtle Note v0.7.2.6 does not filter the <meta> tag during markdown parsing, allowing attackers to execute HTML injection.CVE-2022-28101 · Other software · Lyonbros · reported by MITRECritical 9
Turtlapp Turtle Note v0.7.2.6 does not filter the <meta> tag during markdown parsing, allowing attackers to execute HTML injection.
- Product
- Turtl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcybercitadel.com
Apr 27, 2022In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader (FSBL) by bypassing authentication and loading a maliciouCVE-2022-23822 · Other software · AMD-Xilinx · reported by psirt@amd.comMedium 6.8
In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader (FSBL) by bypassing authentication and loading a malicious image onto the device. This in turn may further allow the attacker to perform additional attacks such as such as using the device as a decryption oracle. An anticipated mitigation via a 2022.1 patch will resolve the issue.
- Product
- Zynq-7000 SoC FSBL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.xilinx.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.