Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,931 results · page 32 of 59
Jul 19, 2023Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML CVE-2023-28754 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML configuration file. The attacker needs to have permission to modify the ShardingSphere Agent YAML configuration file on the target machine, and the target machine can access the URL with the arbitrary code JAR. An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. When the ShardingSphere JVM process starts and uses the ShardingSphere-Agent, the arbitrary code specified by the attacker will be executed during the deserialization of the YAML configuration file by the Agent. This issue affects ShardingSphere-Agent: through 5.3.2. This vulnerability is fixed in Apache ShardingSphere 5.4.0.
- Product
- ShardingSphere-Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Jul 17, 2023Use After Free vulnerability in Secomea SiteManager Embedded allows Obstruction.CVE-2023-2912 · Other software · Secomea · reported by VulnerabilityReporting@secomea.comMedium 5.9
Use After Free vulnerability in Secomea SiteManager Embedded allows Obstruction.
- Product
- SiteManager Embedded
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecomea.comsecomea.com
Jul 15, 2023CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplinCVE-2023-2507 · Other software · CleverTap · reported by help@fluidattacks.comCritical 9.3
CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.
- Product
- Cordova Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Jul 14, 2023zenstruck/collections is a set of helpers for iterating/paginating/filtering collections.CVE-2023-37473 · Other software · zenstruck · reported by GitHubHigh 8.5
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit `f4b1c48820` and included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input is not passed to either `EntityRepository::find()` or `query()`.
- Product
- collection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023Jenkins Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not validate SSH host keys when connecting OCI clouds, enabling man-in-the-middle attCVE-2023-37948 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comLow 3.7
Jenkins Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not validate SSH host keys when connecting OCI clouds, enabling man-in-the-middle attacks.
- Product
- Jenkins Oracle Cloud Infrastructure Compute Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jun 28, 2023Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.CVE-2023-36475 · Other software · parse-community · reported by GitHubCritical 9.8
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFoCVE-2023-35165 · Other software · aws · reported by GitHubMedium 6.6
AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages `aws-cdk-lib` 2.0.0 until 2.80.0 and `@aws-cdk/aws-eks` 1.57.0 until 1.202.0, `eks.Cluster` and `eks.FargateCluster` constructs create two roles, `CreationRole` and `default MastersRole`, that have an overly permissive trust policy. The first, referred to as the `CreationRole`, is used by lambda handlers to create the cluster and deploy Kubernetes resources (e.g `KubernetesManifest`, `HelmChart`, ...) onto it. Users with CDK version higher or equal to 1.62.0 (including v2 users) may be affected. The second, referred to as the `default MastersRole`, is provisioned only if the `mastersRole` property isn't provided and has permissions to execute `kubectl` commands on the cluster. Users with CDK version higher or equal to 1.57.0 (including v2 users) may be affected. The issue has been fixed in `@aws-cdk/aws-eks` v1.202.0 and `aws-cdk-lib` v2.80.0. These versions no longer use the account root principal. Instead, they restrict the trust policy to the specific roles of lambda handlers that need it. T
- Product
- aws-cdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2023VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 lacks certain size calculations before attempting to set a value of an mss structure member.CVE-2023-35848 · Other software · Virtualsquare · reported by MITREHigh 7.5
VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 lacks certain size calculations before attempting to set a value of an mss structure member.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2023Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by aCVE-2023-2793 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 6.5
Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by a linking to a specially crafted webpage in a message.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 9, 2023Metform Elementor Contact Form Builder: Unauthorized permalink structure updateCVE-2023-1843 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on the permalink_setup function in versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to change the permalink structure.
- Product
- Metform Elementor Contact Form Builder
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2023Under Construction: Cross-Site Request ForgeryCVE-2023-0832 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incorrect nonce validation on the install_weglot function called via the admin_action_install_weglot action. This makes it possible for unauthenticated attackers to perform an unauthorized install of the Weglot Translate plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Under Construction
- Affected
- up to 3.96
- What to do
- Affects up to 3.96. Update Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 9, 2023Under Construction: Cross-Site Request ForgeryCVE-2023-0831 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incorrect nonce validation on the dismiss_notice function called via the admin_action_ucp_dismiss_notice action. This makes it possible for unauthenticated attackers to dismiss plugin notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Under Construction
- Affected
- up to 3.96
- What to do
- Affects up to 3.96. Update Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 7, 2023Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowinCVE-2023-30575 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole instructions during the handshake through specially-crafted data.
- Product
- Apache Guacamole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jun 2, 2023A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.CVE-2023-29548 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 2, 2023Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn wouCVE-2023-25738 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 2, 2023An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled.CVE-2023-0767 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalas.aws.amazon.combugzilla.mozilla.org
Jun 2, 2023Buffer overflow in Platform CLI component in Silicon Labs Gecko SDK v4.2.1 and earlier allows user to overwrite limited structures on the heap.CVE-2023-2687 · Other software · silabs.com · reported by product-security@silabs.comLow 2.9
Buffer overflow in Platform CLI component in Silicon Labs Gecko SDK v4.2.1 and earlier allows user to overwrite limited structures on the heap.
- Product
- Gecko SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.silabs.comgithub.com
May 31, 2023EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files.CVE-2023-2909 · Network & remote access · ASUSTOR · reported by security@asustor.comHigh 8.5
EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below.
- Product
- ADM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordasustor.comasustor.com
May 30, 2023Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.CVE-2023-32689 · Other software · parse-community · reported by GitHubMedium 6.3
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a phishing attack vulnerability that involves a user uploading malicious files. A malicious user could upload an HTML file to Parse Server via its public API. That HTML file would then be accessible at the internet domain at which Parse Server is hosted. The URL of the the uploaded HTML could be shared for phishing attacks. The HTML page may seem legitimate because it is served under the internet domain where Parse Server is hosted, which may be the same as a company's official website domain. An additional security issue arises when the Parse JavaScript SDK is used. The SDK stores sessions in the internet browser's local storage, which usually restricts data access depending on the internet domain. A malicious HTML file could contain a script that retrieves the user's session token from local storage and then share it with the attacker. The fix included in versions 5.4.4 and 6.1.1 adds a new Parse Server option `fileUpload.fileExtensions` to restrict file upload on Parse Server by file extension. It is recommended to restrict
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2023Sensitive information disclosure due to improper authorization.CVE-2023-2782 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.3.1-38.
- Product
- Acronis Cyber Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Apr 28, 2023Sensitive information disclosure due to CORS misconfiguration.CVE-2023-2360 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.2.0-135.
- Product
- Acronis Cyber Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Apr 26, 2023ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure.CVE-2023-30845 · Computers, phones & browsers · GoogleCloudPlatform · reported by GitHubHigh 8.2
ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 through 2.42.0 contains an authentication bypass vulnerability. API clients can craft a malicious `X-HTTP-Method-Override` header value to bypass JWT authentication in specific cases. ESPv2 allows malicious requests to bypass authentication if both the conditions are true: The requested HTTP method is **not** in the API service definition (OpenAPI spec or gRPC `google.api.http` proto annotations, and the specified `X-HTTP-Method-Override` is a valid HTTP method in the API service definition. ESPv2 will forward the request to your backend without checking the JWT. Attackers can craft requests with a malicious `X-HTTP-Method-Override` value that allows them to bypass specifying JWTs. Restricting API access with API keys works as intended and is not affected by this vulnerability. Upgrade deployments to release v2.43.0 or higher to receive a patch. This release ensures that JWT authentication occurs, even when the caller specifies `x-http-method-override`. `x-http-method-override` is still supported by v2.43.0+. API clients can continue sending this header to ESPv2.
- Product
- esp-v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Jerryscript commit 1a2c047 was discovered to contain a stack overflow via the component ecma_op_function_construct at /operations/ecma-function-object.c.CVE-2023-30410 · Other software · Jerryscript · reported by MITREMedium 5.5
Jerryscript commit 1a2c047 was discovered to contain a stack overflow via the component ecma_op_function_construct at /operations/ecma-function-object.c.
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2023The 'Visforms Base Package for Joomla 3' extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query.CVE-2023-23753 · Other software · vi-solutions · reported by security@joomla.orgCritical 9.8
The 'Visforms Base Package for Joomla 3' extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attacker can interact with the database and could be able to read, modify and delete data on it.
- Product
- Visforms Base Package for Joomla 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.asturhackers.esvi-solutions.de
Apr 19, 2023When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/CVE-2021-3429 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 5.5
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
- Product
- cloud-init
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.CVE-2021-28254 · Other software · Laravel · reported by MITRECritical 9.8
A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.
- Product
- Laravel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD records1mple-top.github.ios1mple-top.github.io
Apr 11, 2023A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticaCVE-2022-41331 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.8
A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests.
- Product
- FortiPresence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Apr 11, 2023National land numerical information data conversion tool all versions improperly restricts XML external entity references (XXE).CVE-2023-25955 · Other software · Ministry of Land, Infrastructure, Transport and Tourism, Japan · reported by vultures@jpcert.or.jpMedium 5.5
National land numerical information data conversion tool all versions improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.
- Product
- National land numerical information data conversion tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpnlftp.mlit.go.jp
Apr 5, 2023Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow aCVE-2023-20131 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco Prime Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Apr 5, 2023Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow aCVE-2023-20130 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco Prime Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Apr 5, 2023Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow aCVE-2023-20129 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco Prime Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Apr 5, 2023Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow aCVE-2023-20127 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco Prime Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Apr 5, 2023A vulnerability in the web-based management interface of Cisco Prime Infrastructure Software could allow an unauthenticated, remote attacker to conduct a reflecCVE-2023-20068 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the web-based management interface of Cisco Prime Infrastructure Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user of the web-based management interface on an affected device to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or to access sensitive, browser-based information.
- Product
- Cisco Prime Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Mar 24, 2023Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times aCVE-2023-28448 · Other software · firecracker-microvm · reported by GitHubMedium 5.7
Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.
- Product
- versionize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements.CVE-2023-1436 · Other software · jettison · reported by reefs@jfrog.comMedium 5.9
An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.
- Product
- jettison
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
Mar 17, 2023Rockwell Automation Modbus TCP Server AOI prior to 2.04.00 is vulnerable to an unauthorized user sending a malformed message that could cause the controller to CVE-2023-0027 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comMedium 5.3
Rockwell Automation Modbus TCP Server AOI prior to 2.04.00 is vulnerable to an unauthorized user sending a malformed message that could cause the controller to respond with a copy of the most recent response to the last valid request. If exploited, an unauthorized user could read the connected device’s Modbus TCP Server AOI information.
- Product
- Modbus TCP Server Add On Instructions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.custhelp.comrockwellautomation.custhelp.com
Mar 14, 2023Windows BrokerInfrastructure Service Elevation of Privilege VulnerabilityCVE-2023-23393 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Windows BrokerInfrastructure Service Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 10, 2023A vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, local attacker to CVE-2022-20929 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.8
A vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, local attacker to provide an unauthentic upgrade file for upload. This vulnerability is due to insufficient cryptographic signature verification of upgrade files. An attacker could exploit this vulnerability by providing an administrator with an unauthentic upgrade file. A successful exploit could allow the attacker to fully compromise the Cisco NFVIS system.
- Product
- Cisco Enterprise NFV Infrastructure Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Mar 3, 2023vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange.CVE-2023-23929 · Other software · vantage6 · reported by GitHubHigh 8.8
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.
- Product
- vantage6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2023A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authentiCVE-2023-20069 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker would need to have valid credentials to access the web-based management interface of the affected device.
- Product
- Cisco Prime Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Mar 1, 2023vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange.CVE-2023-22738 · Other software · vantage6 · reported by GitHubMedium 6.3
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain their permissions and therefore might be able to access stuff they should not be allowed to access. This issue is patched in version 3.8.0.
- Product
- vantage6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange.CVE-2022-39228 · Other software · vantage6 · reported by GitHubMedium 5.3
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0.
- Product
- vantage6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially rCVE-2022-27672 · Other software · AMD · reported by psirt@amd.comMedium 4.7
When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially resulting in information disclosure.
- Product
- 1st Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgamd.com
Feb 27, 2023Improper Certificate Validation vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on LCVE-2022-4895 · Other software · Hitachi · reported by hirt@hitachi.co.jpHigh 8.6
Improper Certificate Validation vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Analyzer probe component) allows Man in the Middle Attack.This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.1-00.
- Product
- Hitachi Infrastructure Analytics Advisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhitachi.comhitachi.com
Feb 27, 2023Incorrect Default Permissions vulnerability in Hitachi Automation Director on Linux, Hitachi Infrastructure Analytics Advisor on Linux (Hitachi Infrastructure ACVE-2020-36652 · Other software · Hitachi · reported by hirt@hitachi.co.jpMedium 6.6
Incorrect Default Permissions vulnerability in Hitachi Automation Director on Linux, Hitachi Infrastructure Analytics Advisor on Linux (Hitachi Infrastructure Analytics Advisor, Analytics probe server components), Hitachi Ops Center Automator on Linux, Hitachi Ops Center Analyzer on Linux (Hitachi Ops Center Analyzer, Analyzer probe server components), Hitachi Ops Center Viewpoint on Linux (Viewpoint RAID Agent component) allows local users to read and write specific files. This issue affects Hitachi Automation Director: from 8.2.0-00 through 10.6.1-00; Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.0.0-00; Hitachi Ops Center Automator: before 10.9.1-00; Hitachi Ops Center Analyzer: before 10.9.1-00; Hitachi Ops Center Viewpoint: before 10.9.1-00.
- Product
- Hitachi Automation Director
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhitachi.comhitachi.com
Feb 27, 2023Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team CVE-2023-27266 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.7
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Feb 27, 2023Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team aCVE-2023-27265 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.7
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Feb 23, 2023A vulnerability in the Link Layer Discovery Protocol (LLDP) feature for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) ModeCVE-2023-20089 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.4
A vulnerability in the Link Layer Discovery Protocol (LLDP) feature for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mode could allow an unauthenticated, adjacent attacker to cause a memory leak, which could result in an unexpected reload of the device. This vulnerability is due to incorrect error checking when parsing ingress LLDP packets. An attacker could exploit this vulnerability by sending a steady stream of crafted LLDP packets to an affected device. A successful exploit could allow the attacker to cause a memory leak, which could result in a denial of service (DoS) condition when the device unexpectedly reloads. Note: This vulnerability cannot be exploited by transit traffic through the device. The crafted LLDP packet must be targeted to a directly connected interface, and the attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). In addition, the attack surface for this vulnerability can be reduced by disabling LLDP on interfaces where it is not required.
- Product
- Cisco NX-OS System Software in ACI Mode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Feb 23, 2023A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly CVE-2023-20011 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.8
A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. If the affected user has administrative privileges, these actions could include modifying the system configuration and creating new privileged accounts.
- Product
- Cisco Application Policy Infrastructure Controller (APIC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Feb 21, 2023Markup (JSON-LD) structured in schema.org: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4666 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Markup (JSON-LD) structured in schema.org WordPress plugin through 4.8.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Markup (JSON-LD) structured in schema.org
- Affected
- up to 4.8.1
- What to do
- Affects up to 4.8.1. Update Markup (JSON-LD) structured in schema.org to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.