Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,770 results · page 31 of 56
Dec 31, 2022** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8.CVE-2017-20158 · Other software · vova07 · reported by VulDBLow 3.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It has been declared as problematic. Affected by this vulnerability is the function run of the file actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.1.9 is able to address this issue. The identifier of the patch is c00d1e4fc912257fca1fce66d7a163bdbb4c8222. It is recommended to upgrade the affected component. The identifier VDB-217141 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Yii2 FileAPI Widget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Chris92de AdminServ.CVE-2020-36638 · Other software · Chris92de · reported by VulDBLow 3.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Chris92de AdminServ. It has been rated as problematic. This issue affects some unknown processing of the file resources/core/adminserv.php. The manipulation of the argument error leads to cross site scripting. The attack may be initiated remotely. The patch is named 9a45087814295de6fb3a3fe38f96293665234da1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217043. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- AdminServ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Chris92de AdminServ.CVE-2020-36637 · Other software · Chris92de · reported by VulDBLow 3.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Chris92de AdminServ. It has been declared as problematic. This vulnerability affects unknown code of the file resources/core/adminserv.php. The manipulation of the argument text leads to cross site scripting. The attack can be initiated remotely. The patch is identified as 3ed17dab3b4d6e8bf1c82ddfbf882314365e9cd7. It is recommended to apply a patch to fix this issue. VDB-217042 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- AdminServ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in gnuboard youngcart5 up to 5.4.5.1.CVE-2021-4293 · Other software · gnuboard · reported by VulDBLow 3.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in gnuboard youngcart5 up to 5.4.5.1. Affected is an unknown function of the file adm/menu_list_update.php. The manipulation of the argument me_link leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 5.4.5.2 is able to address this issue. The name of the patch is 70daa537adfa47b87af12d85f1e698fff01785ff. It is recommended to upgrade the affected component. VDB-216954 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- youngcart5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in cloudsync.CVE-2022-4773 · Other software · Cloudsync Project · reported by VulDBLow 2.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in cloudsync. Affected by this vulnerability is the function getItem of the file src/main/java/cloudsync/connector/LocalFilesystemConnector.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is 3ad796833398af257c28e0ebeade68518e0e612a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216919. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Cloudsync
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a signCVE-2019-25072 · Other software · github.com/tendermint/tendermint · reported by security@golang.orgHigh 7.5
Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.
- Product
- github.com/tendermint/tendermint/rpc/lib/client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in dns-stats hedgehog.CVE-2021-4276 · Other software · dns-stats · reported by VulDBMedium 4.1
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in dns-stats hedgehog. It has been rated as problematic. Affected by this issue is the function DSCIOManager::dsc_import_input_from_source of the file src/DSCIOManager.cpp. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 58922c345d3d1fe89bb2020111873a3e07ca93ac. It is recommended to apply a patch to fix this issue. VDB-216746 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: We do assume that the Data Manager server can only be accessed by authorised users. Because of this, we don’t believe this specific attack is possible without such a compromise of the Data Manager server.
- Product
- hedgehog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022A malicious website could have learned the size of a cross-origin resource that supported Range requests.CVE-2022-31736 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 16, 2022A support user exists on the device and appears to be a backdoor for Technical Support staff.CVE-2022-47209 · Network & remote access · Netgear · reported by vulnreport@tenable.comHigh 8.8
A support user exists on the device and appears to be a backdoor for Technical Support staff. The default password for this account is “support” and cannot be changed by a user via any normally accessible means.
- Product
- Rax30 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 12, 2022HP Support Assistant uses HP Performance Tune-up as a diagnostic tool.CVE-2022-38395 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.8
HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the HP Performance Tune-up.
- Product
- HP Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Dec 12, 2022In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them thrCVE-2022-46685 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log.
- Product
- Jenkins Gitea Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2022Cross-site scripting vulnerability in Aficio SP 4210N firmware versions prior to Web Support 1.05 allows a remote authenticated attacker with an administrative CVE-2022-37406 · Other software · RICOH COMPANY, LTD. · reported by vultures@jpcert.or.jpMedium 4.8
Cross-site scripting vulnerability in Aficio SP 4210N firmware versions prior to Web Support 1.05 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.
- Product
- Aficio SP 4210N
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsupport.ricoh.com
Nov 30, 2022g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable and writable, allowingCVE-2022-46338 · Other software · G810-led Project · reported by MITREMedium 6.5
g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable and writable, allowing any process on the system to read traffic from keyboards, including sensitive data.
- Product
- G810-led
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggithub.com
Nov 28, 2022Opencast is a free, open-source platform to support the management of educational audio and video content.CVE-2022-41965 · Other software · opencast · reported by GitHubMedium 5.7
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2022Awesome Support: Does not ensure that the exported tickets archive to be downloaded belongs to the user making the requestCVE-2022-3511 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Awesome Support WordPress plugin before 6.1.2 does not ensure that the exported tickets archive to be downloaded belongs to the user making the request, allowing a low privileged user, such as subscriber to download arbitrary exported tickets via an IDOR vector
- Product
- Awesome Support
- Fixed in
- 6.1.2
- What to do
- Update Awesome Support to 6.1.2 or newer.
Nov 17, 2022Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list.CVE-2022-42903 · Email & office · Zohocorp · reported by MITRELow 3.3
Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list.
- Product
- Manageengine Supportcenter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Nov 16, 2022The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1.CVE-2022-4022 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1. SVG files containing malicious javascript are not sanitized. While version 2.5 adds the ability to sanitize image as they are uploaded, the plugin defaults to disable sanitization and does not restrict SVG upload to only administrators. This allows authenticated attackers, with author-level privileges and higher, to upload malicious SVG files that can be embedded in posts and pages by higher privileged users. Additionally, the embedded JavaScript is also triggered on visiting the image URL, which allows an attacker to execute malicious code in browsers visiting that URL.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 15, 2022An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle permission to downloaCVE-2022-45383 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle permission to download a previously created support bundle containing information limited to users with Overall/Administer permission.
- Product
- Jenkins Support Core Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Nov 11, 2022Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation.CVE-2022-40773 · Email & office · Zohocorp · reported by MITREHigh 8.8
Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an exportMickeyList export of requests from the list view.
- Product
- Manageengine Servicedesk Plus MSP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.comzerodayinitiative.com
Nov 11, 2022Incorrect default permissions in the Intel(R) Support Android application before version v22.02.28 may allow a privileged user to potentially enable informationCVE-2022-36367 · Other software · Intel · reported by secure@intel.comMedium 4.4
Incorrect default permissions in the Intel(R) Support Android application before version v22.02.28 may allow a privileged user to potentially enable information disclosure via local access.
- Product
- Support
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Uncontrolled resource consumption in the Intel(R) Support Android application before version 22.02.28 may allow an authenticated user to potentially enable deniCVE-2022-30691 · Other software · Intel · reported by secure@intel.comMedium 5.9
Uncontrolled resource consumption in the Intel(R) Support Android application before version 22.02.28 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Support
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45.CVE-2022-28689 · Other software · InHand Networks · reported by talos-cna@cisco.comHigh 8.8
A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.
- Product
- InRouter302
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinhandnetworks.comtalosintelligence.com
Nov 8, 2022@fastify/websocket provides WebSocket support for Fastify.CVE-2022-39386 · Other software · fastify · reported by GitHubHigh 7.5
@fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched. This has been patched in version 7.1.1 (fastify v4) and version 5.0.1 (fastify v3). There are currently no known workarounds. However, it should be possible to attach the error handler manually. The recommended path is upgrading to the patched versions.
- Product
- fastify-websocket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2022Fedora CoreOS supports setting a GRUB bootloader password using a Butane config.CVE-2022-3675 · Other software · Fedora Project · reported by patrick@puiterwijk.orgLow 2.6
Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB requires a password to access the GRUB command-line, modify kernel command-line arguments, or boot non-default OSTree deployments. Recent Fedora CoreOS releases have a misconfiguration which allows booting non-default OSTree deployments without entering a password. This allows someone with access to the GRUB menu to boot into an older version of Fedora CoreOS, reverting any security fixes that have recently been applied to the machine. A password is still required to modify kernel command-line arguments and to access the GRUB command line.
- Product
- CoreOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.fedoraproject.orggithub.com
Nov 1, 2022x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a guest can read and write the global sharedCVE-2022-42327 · Other software · Xen · reported by security@xen.orgHigh 7.1
x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a guest can read and write the global shared xAPIC page by moving the local APIC out of xAPIC mode. Access to this shared page bypasses the expected isolation that should exist between two guests.
- Product
- xen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comxenbits.xen.org
Oct 31, 2022Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certaiCVE-2022-31690 · Other software · VMware · reported by security@vmware.comHigh 8.1
Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via the browser) to the Authorization Server which can lead to a privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1) on the subsequent request to the token endpoint to obtain the access token.
- Product
- Spring Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comtanzu.vmware.com
Oct 28, 2022Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands” service, which allows any user on the saCVE-2022-2474 · Other software · Haas · reported by ics-cert@hq.dhs.govCritical 9.8
Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands” service, which allows any user on the same network segment as the controller (even while connected remotely) to access the service and write unauthorized macros to the device.
- Product
- Haas CNC Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object.CVE-2022-29823 · Other software · Feather js · reported by csirt@divd.nlCritical 10
Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.
- Product
- Feathers-Sequalize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Oct 21, 2022A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to access a subset of aCVE-2022-41575 · Other software · Gradle · reported by MITREHigh 7.5
A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to access a subset of application data (e.g., cleartext credentials). This is fixed in 2022.3.3.
- Product
- Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gradle.comsecurity.gradle.com
Oct 19, 2022The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in the root user's authCVE-2013-4253 · Other software · Redhat · reported by Red HatHigh 7.5
The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in the root user's authorized_keys file.
- Product
- Openshift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
Oct 19, 2022Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in buildCVE-2022-43409 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Pipelines.
- Product
- Jenkins Pipeline: Supporting APIs Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 14, 2022A security issue was discovered in WeBid <=1.2.2.CVE-2022-41477 · Other software · Webidsupport · reported by MITRECritical 9.1
A security issue was discovered in WeBid <=1.2.2. A Server-Side Request Forgery (SSRF) vulnerability in the admin/theme.php file allows remote attackers to inject payloads via theme parameters to read files across directories.
- Product
- Webid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server.CVE-2022-3140 · Other software · The Document Foundation · reported by security@documentfoundation.orgMedium 6.3
LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice links using that scheme could be constructed to call internal macros with arbitrary arguments. Which when clicked on, or activated by document events, could result in arbitrary script execution without warning. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.1; 7.3 versions prior to 7.3.6.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Oct 11, 2022Windows Security Support Provider Interface Information Disclosure VulnerabilityCVE-2022-38043 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows Security Support Provider Interface Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Oct 11, 2022OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls.CVE-2022-3358 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgHigh 7.5
OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0.0 to 3.0.5 incorrectly handle legacy custom ciphers passed to the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() functions (as well as other similarly named encryption and decryption initialisation functions). Instead of using the custom cipher directly it incorrectly tries to fetch an equivalent cipher from the available providers. An equivalent cipher is found based on the NID passed to EVP_CIPHER_meth_new(). This NID is supposed to represent the unique NID for a given cipher. However it is possible for an application to incorrectly pass NID_undef as this value in the call to EVP_CIPHER_meth_new(). When NID_undef is used in this way the OpenSSL encryption/decryption initialisation function will match the NULL cipher as being equivalent and will fetch this from the available providers. This will succeed if the default provider has been loaded (or if a third par
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.openssl.orgpsirt.global.sonicwall.com
Sep 28, 2022Dell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist.CVE-2022-34394 · Other software · Dell · reported by security_alert@emc.comLow 3.7
Dell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to unauthorized access to limited switch configuration data. The vulnerability could be leveraged by attackers to conduct man-in-the-middle attacks to gain access to the Support Assist information.
- Product
- Dell Networking OS10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022SVG Support: Does not properly handle SVG added via an URLCVE-2022-1755 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cross-Site Scripting attacks
- Product
- SVG Support
- Fixed in
- 2.5
- What to do
- Update SVG Support to 2.5 or newer.
Sep 23, 2022Cross-Site Request Forgery (CSRF) vulnerability in YDS Support Ticket System plugin <= 1.0 at WordPress.CVE-2022-36388 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in YDS Support Ticket System plugin <= 1.0 at WordPress.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 21, 2022Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 at WordPress.CVE-2022-38073 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 at WordPress.
- Affected
- up to 6.0.7
- What to do
- Affects up to 6.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 21, 2022Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if CVE-2022-31679 · Other software · VMware · reported by security@vmware.comLow 3.7
Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.
- Product
- Spring Data Rest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtanzu.vmware.comtanzu.vmware.com
Sep 16, 2022Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled.CVE-2022-40152 · Other software · xstream · reported by cve-coordination@google.comMedium 6.5
Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
- Product
- Woodstox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orggithub.com
Sep 2, 2022SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support.CVE-2022-36071 · Other software · drakkan · reported by GitHubHigh 8.3
SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a secondary authentication factor. Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged, SFTPGo also supports recovery codes. These are a set of one time use codes that can be used instead of the TOTP. In SFTPGo versions from version 2.2.0 to 2.3.3 recovery codes can be generated before enabling two-factor authentication. An attacker who knows the user's password could potentially generate some recovery codes and then bypass two-factor authentication after it is enabled on the account at a later time. This issue has been fixed in version 2.3.4. Recovery codes can now only be generated after enabling two-factor authentication and are deleted after disabling it.
- Product
- sftpgo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2022NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database.CVE-2022-36076 · Other software · NodeBB · reported by GitHubHigh 8.8
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added (and later checked) a nonce was inadvertently rendered opt-in instead of opt-out. This re-exposed a vulnerability in that a specially crafted Man-in-the-Middle (MITM) attack could theoretically take over another user account during the single sign-on process. The issue has been fully patched in version 1.17.2.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.opera.comgithub.com
Aug 31, 2022A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled.CVE-2022-1263 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 31, 2022NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database.CVE-2022-36045 · Other software · NodeBB · reported by GitHubCritical 9
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and real-time notifications. `utils.generateUUID`, a helper function available in essentially all versions of NodeBB (as far back as v1.0.1 and potentially earlier) used a cryptographically insecure Pseudo-random number generator (`Math.random()`), which meant that a specially crafted script combined with multiple invocations of the password reset functionality could enable an attacker to correctly calculate the reset code for an account they do not have access to. This vulnerability impacts all installations of NodeBB. The vulnerability allows for an attacker to take over any account without the involvement of the victim, and as such, the remediation should be applied immediately (either via NodeBB upgrade or cherry-pick of the specific changeset. The vulnerability has been patched in version 2.x and 1.19.x. There is no known workaround, but the patch sets listed above will fully patch the vulnerability.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022Fluent Support: Does not properly sanitiseCVE-2022-2559 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection vulnerability exploitable by high privilege users
- Product
- Fluent Support
- Fixed in
- 1.5.8
- What to do
- Update Fluent Support to 1.5.8 or newer.
Aug 19, 2022Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or autCVE-2022-2793 · Other software · Emerson Electric · reported by ics-cert@hq.dhs.govMedium 5.9
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or authorization of data packets after establishing a connection for the SRTP protocol.
- Product
- Proficy Machine Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Incorrect default permissions for the Intel(R) Support Android application before 21.07.40 may allow an authenticated user to potentially enable information disCVE-2022-27500 · Other software · Intel · reported by secure@intel.comMedium 5.5
Incorrect default permissions for the Intel(R) Support Android application before 21.07.40 may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Support
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Improper access control in the Intel(R) DSA software for before version 22.2.14 may allow an authenticated user to potentially enable escalation of privilege viCVE-2022-26017 · Other software · Intel · reported by secure@intel.comHigh 8
Improper access control in the Intel(R) DSA software for before version 22.2.14 may allow an authenticated user to potentially enable escalation of privilege via adjacent access.
- Product
- Driver & Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2022Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database.CVE-2022-37401 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulnerable to a brute force attack if an attacker has access to the users stored config. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26307 - LibreOffice
- Product
- Apache OpenOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenoffice.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.