Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,620 results · page 31 of 73
Oct 18, 2022An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Console login components of FortiTesteCVE-2022-33873 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 6.8
An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Console login components of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to execute arbitrary command in the underlying shell.
- Product
- Fortinet FortiTester
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Oct 18, 2022An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Telnet login components of FortiTesterCVE-2022-33872 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.8
An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Telnet login components of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated remote attacker to execute arbitrary command in the underlying shell.
- Product
- Fortinet FortiTester
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Oct 17, 2022An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page.CVE-2022-40055 · Other software · Gxgroup · reported by MITRECritical 9.8
An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page.
- Product
- Gpon ONT Titanium 2122a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.alphathreat.inblog.alphathreat.in
Oct 17, 2022anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.CVE-2022-42983 · Other software · Anji-plus · reported by MITREHigh 8.8
anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.
- Product
- Aj-report
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022Online Diagnostic Lab Management System version 1.0 remote exploit that bypasses login with SQL injection and then uploads a shell.CVE-2022-42064 · Other software · Online Diagnostic Lab Management System Project · reported by MITRECritical 9.8
Online Diagnostic Lab Management System version 1.0 remote exploit that bypasses login with SQL injection and then uploads a shell.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 11, 2022An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL.CVE-2022-41204 · Websites & servers · SAP SE · reported by cna@sap.comHigh 8.8
An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows them to steal credentials and hijack accounts. A successful attack could compromise the Confidentiality, Integrity, and Availability of the system.
- Product
- SAP Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Oct 10, 2022Disable User Login: Does not have authorisation and CSRF checksCVE-2022-2350 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unauthenticated attackers to block (or unblock) users at will.
- Product
- Disable User Login
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Disable User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2022An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and CVE-2022-41414 · Other software · Liferay · reported by MITREMedium 5.3
An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages.
- Product
- Liferay Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.liferay.devportal.liferay.dev
Oct 6, 2022In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity CVE-2022-40895 · Other software · Nedi · reported by MITRECritical 9.1
In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulnerability. The vulnerability is due to insecure design, where a difference in forgot password utility could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users. This affects NeDi 1.0.7 for OS X 1.0.7 <= and NeDi for Suse 1.0.7 <= and NeDi for FreeBSD 1.0.7 <=.
- Product
- Nedi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.nedi.chgist.github.com
Sep 30, 2022A vulnerability in the smart card login authentication of Cisco Duo for macOS could allow an unauthenticated attacker with physical access to bypass authenticatCVE-2022-20662 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the smart card login authentication of Cisco Duo for macOS could allow an unauthenticated attacker with physical access to bypass authentication. This vulnerability exists because the assigned user of a smart card is not properly matched with the authenticating user. An attacker could exploit this vulnerability by configuring a smart card login to bypass Duo authentication. A successful exploit could allow the attacker to use any personal identity verification (PIV) smart card for authentication, even if the smart card is not assigned to the authenticating user.
- Product
- Cisco Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Sep 30, 2022In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.CVE-2022-2778 · Other software · Octopus Deploy · reported by security@octopus.comCritical 9.8
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Sep 27, 2022SQL Injection vulnerability exists in version 1.0 of the Resumes Management and Job Application Website application login form by EGavilan Media that allows autCVE-2021-41433 · Other software · Resumes Management And JOB Application Website Application Project · reported by MITRECritical 9.8
SQL Injection vulnerability exists in version 1.0 of the Resumes Management and Job Application Website application login form by EGavilan Media that allows authentication bypass through login.php.
- Product
- Resumes Management And JOB Application Website Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Login Block IPs: Does not have CSRF check in placeCVE-2022-3098 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Login Block IPs WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Login Block IPs
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Login Block IPs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022Ldap WP Login / Active Directory Integration: Does not have any authorisation and CSRF checksCVE-2022-2987 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating it's settings (which are hooked to the init action), allowing unauthenticated attackers to update them. Attackers could set their own LDAP server to be used to authenticated users, therefore bypassing the current authentication
- Product
- Ldap WP Login / Active Directory Integration
- Fixed in
- 3.0.2
- What to do
- Update Ldap WP Login / Active Directory Integration to 3.0.2 or newer.
Sep 23, 2022A Reflected Cross-Site Scripting (XSS) vulnerability affects the Veritas Desktop Laptop Option (DLO) application login page (aka the DLOServer/restore/login.jspCVE-2022-41319 · Other software · Veritas · reported by MITREMedium 6.1
A Reflected Cross-Site Scripting (XSS) vulnerability affects the Veritas Desktop Laptop Option (DLO) application login page (aka the DLOServer/restore/login.jsp URI). This affects versions before 9.8 (e.g., 9.1 through 9.7).
- Product
- Desktop And Laptop Option
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordveritas.comveritas.com
Sep 19, 2022The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins.CVE-2022-28321 · Other software · Siemens · reported by MITRECritical 9.8
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.opensuse.orgbugzilla.suse.com
Sep 19, 2022This vulnerability of SecureGate is SQL-Injection using login without password.CVE-2022-23767 · Other software · HANSSAK Co.,Ltd · reported by vuln@krcert.or.krHigh 8.8
This vulnerability of SecureGate is SQL-Injection using login without password. A path traversal vulnerability is also identified during file transfer. An attacker can take advantage of these vulnerabilities to perform various attacks such as obtaining privileges and executing remote code, thereby taking over the victim’s system.
- Product
- SecureGate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Sep 19, 2022A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the product's login authentication by falsifyingCVE-2022-40144 · Other software · Trend Micro · reported by security@trendmicro.comCritical 9.8
A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the product's login authentication by falsifying request parameters on affected installations.
- Product
- Trend Micro Apex One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordappweb.trendmicro.comjvn.jp
Sep 18, 2022Modern Campus Omni CMS (formerly OU Campus) 10.2.4 allows login-page SQL injection via a '" OR 1 = 1 -- - , <?php' substring.CVE-2022-40766 · Other software · Moderncampus · reported by MITRECritical 9.8
Modern Campus Omni CMS (formerly OU Campus) 10.2.4 allows login-page SQL injection via a '" OR 1 = 1 -- - , <?php' substring.
- Product
- Omni CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.commoderncampus.com
Sep 16, 2022When logging in to a VBASE runtime project via Web-Remote, the product uses XOR with a static initial key to obfuscate login messages.CVE-2022-3217 · Other software · Visam · reported by vulnreport@tenable.comHigh 7.5
When logging in to a VBASE runtime project via Web-Remote, the product uses XOR with a static initial key to obfuscate login messages. An unauthenticated remote attacker with the ability to capture a login session can obtain the login credentials.
- Product
- Vbase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Sep 16, 2022The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authenCVE-2021-42949 · Other software · Digitaldruid · reported by MITRECritical 9.8
The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks.
- Product
- Hoteldruid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022Login No Captcha reCAPTCHA: Doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screenCVE-2022-2913 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screen.
- Product
- Login No Captcha reCAPTCHA
- Fixed in
- 1.7
- What to do
- Update Login No Captcha reCAPTCHA to 1.7 or newer.
Sep 15, 2022An issue in the component post_applogin.php of Super Flexible Software GmbH & Co.CVE-2022-36536 · Other software · Syncovery · reported by MITRECritical 9.8
An issue in the component post_applogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens.
- Product
- Syncovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022The login form /Login in ECi Printanista Hub (formerly FMAudit Printscout) before 5.5.2 (July 2023) performs expensive RSA key-generation operations, which alloCVE-2022-40306 · Other software · Ecisolutions · reported by MITREMedium 5.9
The login form /Login in ECi Printanista Hub (formerly FMAudit Printscout) before 5.5.2 (July 2023) performs expensive RSA key-generation operations, which allows attackers to cause a denial of service (DoS) by requesting that form repeatedly.
- Product
- Printanista Managed Print Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordreleasenotes.printanista.netecisolutions.com
Sep 14, 2022Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after injecting username CVE-2022-37138 · Other software · Razormist · reported by MITRECritical 9.8
Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after injecting username form.
- Product
- Loan Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Sep 13, 2022The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch other users' data upon a successful login requestCVE-2022-38770 · Other software · Transtek · reported by MITREMedium 5.3
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch other users' data upon a successful login request.
- Product
- Mojodat Fixed Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmojodat-vulnerabilities.netlify.apptranstek.com
Sep 13, 2022The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch cleartext passwords upon a successful login requeCVE-2022-38769 · Other software · Transtek · reported by MITREHigh 7.5
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch cleartext passwords upon a successful login request.
- Product
- Mojodat Fixed Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmojodat-vulnerabilities.netlify.apptranstek.com
Sep 13, 2022In NOKIA 1350 OMS R14.2, an Open Redirect vulnerability occurs is the login page via next HTTP GET parameter.CVE-2022-39814 · Other software · Nokia · reported by MITREMedium 6.1
In NOKIA 1350 OMS R14.2, an Open Redirect vulnerability occurs is the login page via next HTTP GET parameter.
- Product
- 1350 Optical Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Sep 13, 2022Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Password parameters on the Login page.CVE-2022-38637 · Other software · Hospital Management System Project · reported by MITRECritical 9.8
Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Password parameters on the Login page.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2022The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the CVE-2022-37146 · Other software · Plextrac · reported by MITREMedium 5.3
The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the PlexTrac authentication provider. Login attempts for valid, unlocked users configured to use PlexTrac as their authentication provider take significantly longer than those for invalid users, allowing for valid users to be enumerated by an unauthenticated remote attacker. Note that the lockout policy implemented in Plextrac version 1.17.0 makes it impossible to distinguish between valid, locked user accounts and user accounts that do not exist, but does not prevent valid, unlocked users from being enumerated.
- Product
- Plextrac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcontrolgap.comcontrolgap.com
Aug 31, 2022Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the user_email parameter at /admin/login.php.CVE-2022-36581 · Other software · Online Ordering System Project · reported by MITREHigh 7.5
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the user_email parameter at /admin/login.php.
- Product
- Online Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login FieldCVE-2022-37059 · Other software · Intelliants · reported by MITREMedium 4.8
Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field
- Product
- Subrion CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Aug 23, 2022All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthenticated attacker to enuCVE-2022-1989 · Other software · CODESYS · reported by info@cert.vde.comMedium 5.3
All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthenticated attacker to enumerate valid users.
- Product
- CODESYS Visualization
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
Aug 22, 2022An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.CVE-2022-32282 · Other software · WWBN · reported by talos-cna@cisco.comHigh 8.8
An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use it to directly login into the account, leading to increased privileges.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtalosintelligence.com
Aug 17, 2022DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.CVE-2022-35147 · Other software · Html-js · reported by MITRECritical 9.8
DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php.CVE-2022-35516 · Other software · Dedecms · reported by MITRECritical 9.8
DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 login.cgi has no filtering on parameter key, which leads to command injection in page /login.shtml.CVE-2022-35526 · Other software · Wavlink · reported by MITRECritical 9.8
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 login.cgi has no filtering on parameter key, which leads to command injection in page /login.shtml.
- Product
- Wn572hp3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Pharmacy Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the email or password parameter at login.php.CVE-2022-34949 · Other software · Pharmacy Management System Project · reported by MITRECritical 9.8
Pharmacy Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the email or password parameter at login.php.
- Product
- Pharmacy Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct CVE-2022-34530 · Other software · Backdropcms · reported by MITREMedium 5.3
An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.
- Product
- Backdrop CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Login with phone number: Does not sanitise and escape plugin settingsCVE-2022-0598 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Login with phone number
- Fixed in
- 1.3.8
- What to do
- Update Login with phone number to 1.3.8 or newer.
Jul 28, 2022An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks.CVE-2021-22640 · Other software · Ovarro · reported by ics-cert@hq.dhs.govHigh 7.5
An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks.
- Product
- TBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with access to the local host (client machine) to obtain a login access token.CVE-2022-22412 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.6
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with access to the local host (client machine) to obtain a login access token. IBM X-Force ID: 223019.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 25, 2022An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature.CVE-2022-35652 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.1
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Jul 20, 2022Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login_page parameter.CVE-2022-34048 · Other software · Wavlink · reported by MITREMedium 6.1
Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login_page parameter.
- Product
- Wn533a8 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Jul 17, 2022libnx_apl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201.CVE-2022-32985 · Other software · Nexans · reported by MITRECritical 9.8
libnx_apl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201.
- Product
- Gigaswitch 641 Desk V5 Sfp-vi Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec-consult.comnexans.de
Jul 14, 2022The login function of Mealie v1.0.0beta-2 allows attackers to enumerate existing usernames by timing the server's response time.CVE-2022-32425 · Other software · Mealie · reported by MITREMedium 5.3
The login function of Mealie v1.0.0beta-2 allows attackers to enumerate existing usernames by timing the server's response time.
- Product
- Mealie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2022A vulnerability was found in KB Login Authentication Script 1.1 and classified as critical.CVE-2017-20127 · Other software · unspecified · reported by VulDBHigh 7.3
A vulnerability was found in KB Login Authentication Script 1.1 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- KB Login Authentication Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jul 11, 2022Rename wp-login.php: Does not have CSRF check in placeCVE-2022-1732 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Rename wp-login.php
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Rename wp-login.php to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2022Multiple Lenze products of the cabinet series skip the password verification upon second login.CVE-2022-2302 · Other software · LENZE · reported by info@cert.vde.comCritical 9.8
Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been logged on to the device once, a remote attacker can get full access without knowledge of the password.
- Product
- cabinet c520
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Jul 10, 2022H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS.CVE-2022-35416 · Other software · H3c · reported by MITREMedium 6.1
H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS.
- Product
- SSL VPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.