Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,940 results · page 31 of 39
Jul 11, 2023Connected User Experiences and Telemetry Elevation of Privilege VulnerabilityCVE-2023-35320 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 6, 2023ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris LayCVE-2023-1298 · Other software · ServiceNow · reported by psirt@servicenow.comMedium 4.3
ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts.
- Product
- Now User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.servicenow.comlinkedin.com
Jun 17, 2023Multiple Sitecore products allow remote code execution.CVE-2023-35813 · Websites & servers · Sitecore · reported by MITRECritical 9.8
Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.
- Product
- Experience Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sitecore.comsupport.sitecore.com
Jun 15, 2023Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2023-29322 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jun 15, 2023Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-29307 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jun 15, 2023Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2023-29304 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jun 15, 2023Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2023-29302 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jun 6, 2023Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /Applications/ContCVE-2023-33653 · Other software · Sitecore · reported by MITREHigh 8.8
Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /Applications/Content%20Manager/Execute.aspx?cmd=convert&mode=HTML.
- Product
- Experience Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.assetnote.ioblog.assetnote.io
Jun 6, 2023Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/InCVE-2023-33652 · Other software · Sitecore · reported by MITREHigh 8.8
Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/Invoke.aspx.
- Product
- Experience Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.assetnote.ioblog.assetnote.io
Jun 6, 2023An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 ICVE-2023-33651 · Websites & servers · Sitecore · reported by MITREHigh 7.5
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.
- Product
- Experience Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.assetnote.iosupport.sitecore.com
May 27, 2023Craft is a CMS for creating custom digital experiences on the web.CVE-2023-33195 · Other software · craftcms · reported by GitHubMedium 5
Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023Craft is a CMS for creating custom digital experiences.CVE-2023-33196 · Other software · craftcms · reported by GitHubMedium 5.5
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, wCVE-2023-33194 · Other software · craftcms · reported by GitHubLow 3.7
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023Craft is a CMS for creating custom digital experiences on the web.CVE-2023-33197 · Other software · craftcms · reported by GitHubMedium 5.5
Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx.CVE-2023-27068 · Other software · Sitecore · reported by MITRECritical 9.8
Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx.
- Product
- Experience Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.night-wolf.iodev.sitecore.net
May 22, 2023Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to downloCVE-2023-27067 · Other software · Sitecore · reported by MITREHigh 7.5
Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to download.aspx
- Product
- Experience Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.night-wolf.iodev.sitecore.net
May 22, 2023Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via UrlhanCVE-2023-27066 · Other software · Sitecore · reported by MITREMedium 6.5
Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle.
- Product
- Experience Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.night-wolf.iodev.sitecore.net
May 19, 2023A reflected Cross-site Scripting (XSS) vulnerability in Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary CVE-2023-1996 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comMedium 6.1
A reflected Cross-site Scripting (XSS) vulnerability in Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.
- Product
- 3DEXPERIENCE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023Pimcore is an open source data and experience management platform.CVE-2023-30855 · Other software · pimcore · reported by GitHubMedium 6.5
Pimcore is an open source data and experience management platform. Versions of Pimcore prior to 10.5.18 are vulnerable to path traversal. The impact of this path traversal and arbitrary extension is limited to creation of arbitrary files and appending data to existing files. When combined with the SQL Injection, the exported data `RESTRICTED DIFFUSION 9 / 9` can be controlled and a webshell can be uploaded. Attackers can use that to execute arbitrary PHP code on the server with the permissions of the webserver. Users may upgrade to version 10.5.18 to receive a patch or, as a workaround, apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Pimcore is an open source data and experience management platform.CVE-2023-30852 · Other software · pimcore · reported by GitHubMedium 4.4
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CSS file read via the `scriptPath` and `scripts` parameters. The `scriptPath` parameter is not sanitized properly and is vulnerable to path traversal attack. Any JavaScript/CSS file from the application server can be read by specifying sufficient number of `../` patterns to go out from the application webroot followed by path of the folder where the file is located in the "scriptPath" parameter and the file name in the "scripts" parameter. The JavaScript file is successfully read only if the web application has read access to it. Users should update to version 10.5.21 to receive a patch or, as a workaround, apply the patch manual.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Pimcore is an open source data and experience management platform.CVE-2023-30850 · Other software · pimcore · reported by GitHubHigh 8.8
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the admin translations API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Pimcore is an open source data and experience management platform.CVE-2023-30849 · Other software · pimcore · reported by GitHubHigh 8.8
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Pimcore is an open source data and experience management platform.CVE-2023-30848 · Other software · pimcore · reported by GitHubHigh 8.8
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as a workaround, apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023Pimcore is an open source data and experience management platform.CVE-2023-28438 · Other software · pimcore · reported by GitHubMedium 6.2
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a Weak Cryptography for Passwords vulnerability that can lead to a security feature bypass.CVE-2023-22271 · Other software · Adobe · reported by AdobeMedium 5.3
Experience Manager versions 6.5.15.0 (and earlier) are affected by a Weak Cryptography for Passwords vulnerability that can lead to a security feature bypass. A low-privileged attacker can exploit this in order to decrypt a user's password. The attack complexity is high since a successful exploitation requires to already have in possession this encrypted secret.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2023-22269 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22266 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22265 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22264 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22263 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22262 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22261 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22260 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22259 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22258 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22257 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22256 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2023-22254 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2023-22253 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2023-22252 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2023-21616 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2023-21615 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 20, 2023Pimcore is an open source data and experience management platform.CVE-2023-28429 · Other software · pimcore · reported by GitHubMedium 6.1
Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 10.5.19 or, as a workaround, apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023Pimcore is an open source data and experience management platform.CVE-2023-28108 · Other software · pimcore · reported by GitHubHigh 7.9
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and so relies on the auto-quoting being done by the DAO class. Users should update to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023Pimcore is an open source data and experience management platform.CVE-2023-28106 · Other software · pimcore · reported by GitHubMedium 6.1
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2023An issue was discovered in Sitecore XP/XM 10.3.CVE-2023-26262 · Other software · Sitecore · reported by MITREHigh 7.2
An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to direct code execution on the content management (CM) server.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsitecore.com
Mar 12, 2023An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28.CVE-2022-48367 · Other software · Ibexa · reported by MITRECritical 9.8
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled.
- Product
- Digital Experience Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevelopers.ibexa.cogithub.com
Mar 12, 2023An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26.CVE-2022-48365 · Other software · Ibexa · reported by MITREHigh 7.2
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.
- Product
- Digital Experience Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevelopers.ibexa.cogithub.com
Mar 3, 2023Craft is a platform for creating digital experiences.CVE-2023-23927 · Other software · craftcms · reported by GitHubMedium 6.1
Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2023Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences.CVE-2023-26052 · Other software · saleor · reported by GitHubLow 3.7
Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. This issue has been patched in versions 3.1.48, 3.7.59, 3.8.0, 3.9.27, 3.10.14 and 3.11.12.
- Product
- saleor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.