Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,620 results · page 32 of 73
Jul 10, 2022Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command).CVE-2022-32294 · Email & office · Zimbra · reported by MITRECritical 9.8
Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartext on port UDP 514 (aka the syslog port). NOTE: a third party reports that this cannot be reproduced.
- Product
- Collaboration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2022The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be lCVE-2015-5298 · Websites & servers · Jenkins · reported by Red HatMedium 6.5
The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification.
- Product
- Google Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexfiltrated.comjenkins.io
Jul 5, 2022An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change CVE-2021-43116 · Other software · Alibaba · reported by MITREHigh 8.8
An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login.
- Product
- Nacos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jul 1, 2022Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at doctorlogin.php.CVE-2022-32094 · Other software · Hospital Management System Project · reported by MITRECritical 9.8
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at doctorlogin.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at adminlogin.php.CVE-2022-32093 · Other software · Hospital Management System Project · reported by MITRECritical 9.8
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at adminlogin.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances.CVE-2022-23725 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comHigh 7.7
PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances.
- Product
- PingID Windows Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.compingidentity.com
Jun 30, 2022PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file.CVE-2022-23720 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comHigh 7.5
PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID Windows Login user endpoints. Using sensitive full permissions properties file outside of a privileged trust boundary leads to an increased risk of exposure or discovery, and an attacker could leverage these credentials to perform administrative actions against PingID APIs or endpoints.
- Product
- PingID Windows Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.compingidentity.com
Jun 30, 2022PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests.CVE-2022-23719 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comHigh 7.2
PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java service using multiple attack vectors. A successful attack can lead to code executed as SYSTEM by the PingID Windows Login application, or even a denial of service for offline security key authentication.
- Product
- PingID Windows Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.compingidentity.com
Jun 30, 2022PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution.CVE-2022-23718 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comHigh 7.6
PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving a sophisticated man-in-the-middle position, or to compromise Ping Identity web servers, could deliver malicious code that would be executed as SYSTEM by the PingID Windows Login application.
- Product
- PingID Windows Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.compingidentity.com
Jun 30, 2022PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security keys as part of autCVE-2022-23717 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comMedium 5
PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security keys as part of authentication.
- Product
- PingID Windows Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.compingidentity.com
Jun 30, 2022A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.CVE-2021-41995 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comHigh 7.7
A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.
- Product
- PingID Mac Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.compingidentity.com
Jun 30, 2022Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins conCVE-2022-34802 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
- Product
- Jenkins RocketChat Notifier Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agentCVE-2022-22487 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using brute force techniques to gain unauthorized administrative access to both the IBM Spectrum Protect storage agent and the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 with which it communicates. IBM X-Force ID: 226326.
- Product
- Spectrum Protect Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 28, 2022In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing.CVE-2022-29272 · Other software · Nagios · reported by MITREMedium 6.1
In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.nagios.comgithub.com
Jun 27, 2022A vulnerability was found in Admin Custom Login Plugin 2.4.5.2.CVE-2017-20098 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability was found in Admin Custom Login Plugin 2.4.5.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to basic cross site scripting (Persistent). It is possible to launch the attack remotely.
- Product
- Admin Custom Login Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Login With OTP Over SMS, Email, WhatsApp and Google Authenticator: Does not escape its settingsCVE-2022-1994 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Login With OTP Over SMS, Email, WhatsApp and Google Authenticator
- Fixed in
- 1.0.8
- What to do
- Update Login With OTP Over SMS, Email, WhatsApp and Google Authenticator to 1.0.8 or newer.
Jun 27, 2022Limit Login Attempts: Does not sanitise and escape some of its settingsCVE-2022-1029 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
- Product
- Limit Login Attempts
- Fixed in
- 4.0.72
- What to do
- Update Limit Login Attempts to 4.0.72 or newer.
Jun 27, 2022The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to maliCVE-2022-1028 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
- Product
- WordPress Security Firewall, Malware Scanner, Secure Login and Backup
- Fixed in
- 4.2.1
- What to do
- Update WordPress Security Firewall, Malware Scanner, Secure Login and Backup to 4.2.1 or newer.
Jun 27, 2022Login using WordPress Users ( WP as SAML IDP ): Does not sanitise and escape some of its settingsCVE-2022-1010 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Login using WordPress Users ( WP as SAML IDP )
- Fixed in
- 1.13.4
- What to do
- Update Login using WordPress Users ( WP as SAML IDP ) to 1.13.4 or newer.
Jun 23, 2022In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an iCVE-2022-34174 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page.CVE-2022-23078 · Other software · habitica · reported by vulnerabilitylab@mend.ioMedium 5.8
In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page.
- Product
- habitica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page.CVE-2022-23077 · Other software · habitica · reported by vulnerabilitylab@mend.ioMedium 6.1
In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page.
- Product
- habitica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php.CVE-2022-33119 · Other software · Nuuo · reported by MITREMedium 6.1
NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php.
- Product
- Nvrsolo Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2022A vulnerability has been found in Adminer Login 1.4.4 and classified as problematic.CVE-2017-20066 · Other software · unspecified · reported by VulDBMedium 5.3
A vulnerability has been found in Adminer Login 1.4.4 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improper access controls. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
- Product
- Adminer Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsumofpwn.nl
Jun 16, 2022A vulnerability was found in weblizar User Login Log Plugin 2.2.1.CVE-2017-20056 · Other software · weblizar · reported by VulDBLow 3.5
A vulnerability was found in weblizar User Login Log Plugin 2.2.1. It has been classified as problematic. Affected is an unknown function. The manipulation leads to basic cross site scripting (Stored). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- User Login Log Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsumofpwn.nl
Jun 15, 2022A vulnerability in the login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to log in without credentials and acceCVE-2022-20733 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to log in without credentials and access all roles without any restrictions. This vulnerability is due to exposed sensitive Security Assertion Markup Language (SAML) metadata. An attacker could exploit this vulnerability by using the exposed SAML metadata to bypass authentication to the user portal. A successful exploit could allow the attacker to access all roles without any restrictions.
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Jun 13, 2022HC Custom WP-Admin URL: Leaks the secret login URLCVE-2022-1595 · WordPress plugins & themes · reported by WPScanMedium 5.3
The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request
- Product
- HC Custom WP-Admin URL
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update HC Custom WP-Admin URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2022OAuthenticator is an OAuth token library for the JupyerHub login handler.CVE-2022-31027 · Other software · jupyterhub · reported by GitHubMedium 4.2
OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowed_idps configuration trait of CILogonOAuthenticator is documented to be a list of domains that indicate the institutions whose users are authorized to access this JupyterHub. This authorization is validated by ensuring that the *email* field provided to us by CILogon has a *domain* that matches one of the domains listed in `allowed_idps`.If `allowed_idps` contains `berkeley.edu`, you might expect only users with valid current credentials provided by University of California, Berkeley to be able to access the JupyterHub. However, CILogonOAuthenticator does *not* verify which provider is used by the user to login, only the email address provided. So a user can login with a GitHub account that has email set to `<something>@berkeley.edu`, and that will be treated exactly the same as someone logging in using the UC Berkeley official Identity Provider. The patch fixing this issue makes a *breaking change* in
- Product
- oauthenticator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2022Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity.CVE-2022-30749 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity.
- Product
- Smart Things
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 7, 2022Virtua Cobranca before 12R allows SQL Injection on the login page.CVE-2021-37589 · Other software · Virtuasoftware · reported by MITREHigh 7.5
Virtua Cobranca before 12R allows SQL Injection on the login page.
- Product
- Cobranca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 6, 2022A reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attackers to execute arbitrary web scripts or CVE-2022-29296 · Other software · Avantune · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Genialcloud Proj
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdl.packetstormsecurity.net
Jun 3, 2022In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.CVE-2021-42887 · Other software · Totolink · reported by MITRECritical 9.8
In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
- Product
- Ex1200t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Car Rental Management System v1.0 is vulnerable to SQL Injection via /ip/car-rental-management-system/admin/ajax.php?action=login.CVE-2022-32022 · Other software · CAR Rental Management System Project · reported by MITREHigh 7.2
Car Rental Management System v1.0 is vulnerable to SQL Injection via /ip/car-rental-management-system/admin/ajax.php?action=login.
- Product
- CAR Rental Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Simple Inventory System v1.0 is vulnerable to SQL Injection via /inventory/login.php.CVE-2022-31339 · Other software · Argie · reported by MITREHigh 7.2
Simple Inventory System v1.0 is vulnerable to SQL Injection via /inventory/login.php.
- Product
- Simple Inventory System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /checklogin.jsp endpoint.CVE-2022-26978 · Other software · Barco · reported by MITREMedium 6.1
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /checklogin.jsp endpoint. The os_username parameters is not correctly sanitized, leading to reflected XSS.
- Product
- Control Room Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022EGavilan Media User-Registration-and-Login-System-With-Admin-Panel 1.0 is vulnerable to SQL Injection via profile_action - update_user.CVE-2021-44096 · Other software · Egavilanmedia · reported by MITRECritical 9.8
EGavilan Media User-Registration-and-Login-System-With-Admin-Panel 1.0 is vulnerable to SQL Injection via profile_action - update_user. This allows a remote attacker to compromise Application SQL database.
- Product
- User Registration And Login System With Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2022Change wp-admin login: Does not properly check for authorisation and is also missing CSRF checkCVE-2022-1589 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector
- Product
- Change wp-admin login
- Fixed in
- 1.1.0
- What to do
- Update Change wp-admin login to 1.1.0 or newer.
May 26, 2022Talend Administration Center is vulnerable to a reflected Cross-Site Scripting (XSS) issue in the SSO login endpoint.CVE-2022-31648 · Other software · Talend · reported by MITREMedium 6.1
Talend Administration Center is vulnerable to a reflected Cross-Site Scripting (XSS) issue in the SSO login endpoint. The issue is fixed for versions 8.0.x in TPS-5233, for versions 7.3.x in TPS-5324, and for versions 7.2.x in TPS-5235. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version.
- Product
- Administration Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022An attacker can gain VxWorks Shell after login due to hard-coded credentials on a KUKA KR C4 control software for versions prior to 8.7 or any product running KCVE-2021-33014 · Other software · KUKA · reported by ics-cert@hq.dhs.govHigh 8.8
An attacker can gain VxWorks Shell after login due to hard-coded credentials on a KUKA KR C4 control software for versions prior to 8.7 or any product running KSS.
- Product
- KR C4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface.CVE-2022-22309 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.8
The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface. This vulnerability can be more critical if the serial port is connected to a serial-over-lan device. IBM X-Force ID: 217095.
- Product
- Power System S922 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 19, 2022Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login.CVE-2022-28987 · Email & office · Zohocorp · reported by MITREMedium 5.3
Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2022GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface.CVE-2021-37413 · Other software · Grandcom · reported by MITRECritical 9.8
GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface. A remote unauthenticated attacker can exploit this vulnerability to obtain administrative access to the webpage, access the user database, modify web content and upload custom files. The backend login script does not verify and sanitize user-provided strings.
- Product
- Dynweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2022A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.CVE-2022-30600 · Other software · Moodle · reported by patrick@puiterwijk.orgCritical 9.8
A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
May 17, 2022HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts.CVE-2022-30689 · Other software · Hashicorp · reported by MITREMedium 5.3
HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comsecurity.gentoo.org
May 16, 2022Bulk Edit and Create User Profiles: Does not sanitise and escape the Users LoginCVE-2022-1089 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Bulk Edit and Create User Profiles WordPress plugin before 1.5.14 does not sanitise and escape the Users Login, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Bulk Edit and Create User Profiles
- Fixed in
- 1.5.14
- What to do
- Update Bulk Edit and Create User Profiles to 1.5.14 or newer.
May 13, 2022WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi-bin/login.cgi.CVE-2022-30489 · Other software · Wavlink · reported by MITREMedium 6.1
WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi-bin/login.cgi.
- Product
- Wn535g3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click oCVE-2022-22796 · Other software · SysAid · reported by cna@cyber.gov.ilHigh 7
Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authentication.
- Product
- Sysaid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Phpok v6.1 was discovered to contain a deserialization vulnerability via the update_f() function in login_control.php.CVE-2022-29363 · Websites & servers · Phpok · reported by MITRECritical 9.8
Phpok v6.1 was discovered to contain a deserialization vulnerability via the update_f() function in login_control.php. This vulnerability allows attackers to getshell via writing arbitrary files.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../../../../../../../winCVE-2022-29596 · Other software · Microstrategy · reported by MITRECritical 9.8
MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../../../../../../../windows/win.ini%00.jpg&Pwd=_any_password_&ConnMode=1&3054=Login substring for directory traversal.
- Product
- Enterprise Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2022Hotel Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at the login page.CVE-2022-28110 · Other software · Hotel Management System Project · reported by MITRECritical 9.8
Hotel Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at the login page.
- Product
- Hotel Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.