Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,137 results · page 33 of 43
Mar 3, 2023An issue discovered in Shenzhen Zhibotong Electronics WBT WE1626 Router v 21.06.18 allows attacker to execute arbitrary commands via serial connection to the UACVE-2022-45553 · Other software · ZBT · reported by MITRECritical 9.8
An issue discovered in Shenzhen Zhibotong Electronics WBT WE1626 Router v 21.06.18 allows attacker to execute arbitrary commands via serial connection to the UART port.
- Product
- We1626 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.prodefense.ioblog.prodefense.io
Mar 3, 2023An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive information via SPI busCVE-2022-45552 · Other software · ZBT · reported by MITREHigh 7.5
An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive information via SPI bus interface connected to pinout of the NAND flash memory.
- Product
- We1626 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.prodefense.ioblog.prodefense.io
Mar 3, 2023An issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command to the Network DiagnoCVE-2022-45551 · Other software · ZBT · reported by MITRECritical 9.8
An issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command to the Network Diagnosis endpoint.
- Product
- We1626 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.prodefense.ioblog.prodefense.io
Feb 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.2.8 versions.CVE-2023-24415 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.2.8 versions.
- Fixed in
- 4.2.9
- What to do
- Update the plugin to 4.2.9 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 21, 2023Nautobot is a Network Source of Truth and Network Automation Platform.CVE-2023-25657 · Other software · nautobot · reported by GitHubHigh 7.5
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions earlier than 1.5.7 are impacted by a remote code execution vulnerability. Nautobot did not properly sandbox Jinja2 template rendering. In Nautobot 1.5.7 has enabled sandboxed environments for the Jinja2 template engine used internally for template rendering for the following objects: `extras.ComputedField`, `extras.CustomLink`, `extras.ExportTemplate`, `extras.Secret`, `extras.Webhook`. While no active exploits of this vulnerability are known this change has been made as a preventative measure to protect against any potential remote code execution attacks utilizing maliciously crafted template code. This change forces the Jinja2 template engine to use a `SandboxedEnvironment` on all new installations of Nautobot. This addresses any potential unsafe code execution everywhere the helper function `nautobot.utilities.utils.render_jinja2` is called. Additionally, the documentation that had previously suggesting the direct use of `jinja2.Template` has been revised to suggest `render_jinja2`. Users are advised to upgrade to Nautobot 1.5.7 or newer. For users that are unable to upgrade to
- Product
- nautobot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023The Baremetrics date range picker is a solution for selecting both date ranges and single dates from a single calender view.CVE-2021-32859 · Other software · Baremetrics · reported by GitHubMedium 6.1
The Baremetrics date range picker is a solution for selecting both date ranges and single dates from a single calender view. Versions 1.0.14 and prior are prone to cross-site scripting (XSS) when handling untrusted `placeholder` entries. An attacker who is able to influence the field `placeholder` when creating a `Calendar` instance is able to supply arbitrary `html` or `javascript` that will be rendered in the context of a user leading to XSS. There are no known patches for this issue.
- Product
- baremetrics-calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Feb 16, 2023open redirect in pollbot (pollbot.services.mozilla.com) in versions before 1.4.6CVE-2022-0637 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
open redirect in pollbot (pollbot.services.mozilla.com) in versions before 1.4.6
- Product
- Pollbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgbugzilla.mozilla.org
Feb 5, 2023A vulnerability classified as problematic was found in ciubotaru share-on-diaspora 0.7.9.CVE-2017-20176 · Other software · ciubotaru · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in ciubotaru share-on-diaspora 0.7.9. This vulnerability affects unknown code of the file new_window.php. The manipulation of the argument title/url leads to cross site scripting. The attack can be initiated remotely. The name of the patch is fb6fae2f8a9b146471450b5b0281046a17d1ac8d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-220204.
- Product
- share-on-diaspora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series allows a remote unCVE-2022-33323 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.5
Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series allows a remote unauthenticated attacker to gain unauthorized access by authentication bypass through an unauthorized telnet login. As for the affected model names, controller types and firmware versions, see the Mitsubishi Electric's advisory which is listed in [References] section.
- Product
- MELFA SD/SQ Series Controller CR1DA-771 of RV-2SD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2023The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers to have write accesCVE-2022-23334 · Other software · Ip-label · reported by MITRECritical 9.8
The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers to have write access and escalate privileges via replacing NEWTESTREMOTEMANAGER.EXE.
- Product
- Newtest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND tCVE-2022-3488 · Other software · ISC · reported by security-officer@isc.orgHigh 7.5
Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND to exit with an assertion failure. 'Broken' in this context is anything that would cause the resolver to reject the query response, such as a mismatch between query and answer name. This issue affects BIND 9 versions 9.11.4-S1 through 9.11.37-S1 and 9.16.8-S1 through 9.16.36-S1.
- Product
- BIND 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2023IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL.CVE-2023-22863 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 18, 2023IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting.CVE-2023-22594 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.6
IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244075.
- Product
- Robotic Process Automation for Cloud Pak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 18, 2023 IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission settCVE-2023-22592 · Other software · IBM · reported by psirt@us.ibm.comMedium 4
IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission settings. IBM X-Force ID: 244073.
- Product
- Robotic Process Automation for Cloud Pak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 8, 2023A vulnerability was found in emmflo yuko-bot.CVE-2014-125066 · Other software · emmflo · reported by VulDBMedium 4.3
A vulnerability was found in emmflo yuko-bot. It has been declared as problematic. This vulnerability affects unknown code. The manipulation of the argument title leads to denial of service. The attack can be initiated remotely. The name of the patch is e580584b877934a4298d4dd0c497c79e579380d0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217636.
- Product
- yuko-bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability, which was classified as critical, was found in john5223 bottle-auth.CVE-2014-125065 · Other software · john5223 · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in john5223 bottle-auth. Affected is an unknown function. The manipulation leads to sql injection. The name of the patch is 99cfbcc0c1429096e3479744223ffb4fda276875. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217632.
- Product
- bottle-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability was found in tiredtyrant flairbot.CVE-2015-10026 · Other software · tiredtyrant · reported by VulDBMedium 5.5
A vulnerability was found in tiredtyrant flairbot. It has been declared as critical. This vulnerability affects unknown code of the file flair.py. The manipulation leads to sql injection. The patch is identified as 5e112b68c6faad1d4699d02c1ebbb7daf48ef8fb. It is recommended to apply a patch to fix this issue. VDB-217618 is the identifier assigned to this vulnerability.
- Product
- flairbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2023 The affected products store both public and private key that are used to sign and protect Custom Parameter Set (CPS) file from modification.CVE-2022-3927 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 8
The affected products store both public and private key that are used to sign and protect Custom Parameter Set (CPS) file from modification. An attacker that manages to exploit this vulnerability will be able to change the CPS file, sign it so that it is trusted as the legitimate CPS file. This issue affects * FOXMAN-UN product: FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; * UNEM product: UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C. List of CPEs: * cpe:2.3:a:hitachienergy:foxman-un:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:
- Product
- FOXMAN-UN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jan 5, 2023IBM Robotic Process Automation for Cloud Pak 20.12 through 21.0.3 is vulnerable to broken access control.CVE-2022-43844 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Robotic Process Automation for Cloud Pak 20.12 through 21.0.3 is vulnerable to broken access control. A user is not correctly redirected to the platform log out screen when logging out of IBM RPA for Cloud Pak. IBM X-Force ID: 239081.
- Product
- Robotic Process Automation for Cloud Pak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 5, 2023IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email for the creator/modifier of platform level objects.CVE-2022-43573 · Other software · IBM · reported by psirt@us.ibm.comLow 3.1
IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email for the creator/modifier of platform level objects. IBM X-Force ID: 238678.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 5, 2023 IBM Robotic Process Automation 20.12 through 21.0.6 could allow an attacker with physical access to the system to obtain highly sensitive information from systCVE-2022-41740 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.6
IBM Robotic Process Automation 20.12 through 21.0.6 could allow an attacker with physical access to the system to obtain highly sensitive information from system memory. IBM X-Force ID: 238053.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 5, 2023A vulnerability was found in Woorank robots-txt-guard.CVE-2021-4305 · Other software · Woorank · reported by VulDBLow 3.5
A vulnerability was found in Woorank robots-txt-guard. It has been rated as problematic. Affected by this issue is the function makePathPattern of the file lib/patterns.js. The manipulation of the argument pattern leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. The name of the patch is c03827cd2f9933619c23894ce7c98401ea824020. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217448.
- Product
- robots-txt-guard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023The tf_remapper_node component 1.1.1 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in the same ROS applicatCVE-2022-48217 · Other software · tradr-project · reported by MITREHigh 8.1
The tf_remapper_node component 1.1.1 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in the same ROS application, to change a robot's behavior. This occurs because a topic name depends on the attacker-controlled old_tf_topic_name and/or new_tf_topic_name parameter. NOTE: the vendor's position is "it is the responsibility of the programmer to make sure that only known and required parameters are set and unexpected parameters are not."
- Product
- tf_remapper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023A vulnerability was found in oxguy3 coebot-www and classified as problematic.CVE-2016-15008 · Other software · oxguy3 · reported by VulDBLow 3.5
A vulnerability was found in oxguy3 coebot-www and classified as problematic. This issue affects the function displayChannelCommands/displayChannelQuotes/displayChannelAutoreplies/showChannelHighlights/showChannelBoir of the file js/channel.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. The patch is named c1a6c44092585da4236237e0e7da94ee2996a0ca. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217355.
- Product
- coebot-www
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2023kenny2automate is a Discord bot.CVE-2023-22452 · Other software · Kenny2github · reported by GitHubMedium 6.5
kenny2automate is a Discord bot. In the web interface for server settings, form elements were generated with Discord channel IDs as part of input names. Prior to commit a947d7c, no validation was performed to ensure that the channel IDs submitted actually belonged to the server being configured. Thus anyone who has access to the channel ID they wish to change settings for and the server settings panel for any server could change settings for the requested channel no matter which server it belonged to. Commit a947d7c resolves the issue and has been deployed to the official instance of the bot. The only workaround that exists is to disable the web config entirely by changing it to run on localhost. Note that a workaround is only necessary for those who run their own instance of the bot.
- Product
- kenny2automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2023The ntpd_driver component before 1.3.0 and 2.x before 2.2.0 for Robot Operating System (ROS) allows attackers, who control the source code of a different node iCVE-2022-48198 · Other software · Ntpd Driver Project · reported by MITRECritical 9.8
The ntpd_driver component before 1.3.0 and 2.x before 2.2.0 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in the same ROS application, to change a robot's behavior. This occurs because a topic name depends on the attacker-controlled time_ref_topic parameter.
- Product
- Ntpd Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending oCVE-2020-36563 · Other software · github.com/RobotsAndPencils/go-saml · reported by security@golang.orgMedium 5.3
XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input.
- Product
- github.com/RobotsAndPencils/go-saml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryCVE-2022-1520 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird < 91.9.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 21, 2022Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications.CVE-2022-46330 · Other software · Squirrel · reported by vultures@jpcert.or.jpHigh 7.8
Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows 2.0.1 and earlier contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.
- Product
- Installers generated by Squirrel.Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022User Registration: Does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated usersCVE-2022-3912 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example.
- Product
- User Registration
- Fixed in
- 2.2.4.1
- What to do
- Update User Registration to 2.2.4.1 or newer.
Dec 12, 2022Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3883 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Fixed in
- 7.24
- What to do
- Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to 7.24 or newer.
Dec 12, 2022Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins.CVE-2022-46683 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
- Product
- Jenkins Google Login Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2022Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accountCVE-2022-46405 · Other software · Joinmastodon · reported by MITREHigh 7.5
Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated messages.
- Product
- Mastodon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2022The user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from insecure direct object reference vulnerabilities.CVE-2022-24187 · Other software · Sz-fujia · reported by MITREHigh 7.5
The user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from insecure direct object reference vulnerabilities. Other end-users user_id and device_id values can be enumerated by incrementing or decrementing id numbers. The impact of this vulnerability allows an attacker to discover sensitive information such as end-user email addresses, and their unique frame_token value of all other Ourphoto App end-users.
- Product
- Ourphoto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapps.apple.comscrawledsecurityblog.com
Nov 26, 2022In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error.CVE-2022-43705 · Other software · Botan Project · reported by MITRECritical 9.1
In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).
- Product
- Botan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2022"IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could allow access to applicatCVE-2022-43574 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
"IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could allow access to application configurations. IBM X-Force ID: 238679."
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2022 IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to uCVE-2022-42442 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to users with access to the container platform. IBM X-Force ID: 238214.
- Product
- Robotic Process Automation for Cloud Pak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Nov 3, 2022IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attackCVE-2022-38710 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attacks against the system. IBM X-Force ID: 234292.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 18, 2022supybot-fedora implements the command 'refresh', that refreshes the cache of all users from FAS.CVE-2020-15853 · Other software · Fedoraproject · reported by patrick@puiterwijk.orgMedium 5.3
supybot-fedora implements the command 'refresh', that refreshes the cache of all users from FAS. This takes quite a while to run, and zodbot stops responding to requests during this time.
- Product
- Supybot-fedora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2022HIWIN Robot System Software version 3.3.21.9869 does not properly address the terminated command source.CVE-2022-3382 · Other software · HIWIN · reported by ics-cert@hq.dhs.govHigh 7.5
HIWIN Robot System Software version 3.3.21.9869 does not properly address the terminated command source. As a result, an attacker could craft code to disconnect HRSS and the controller and cause a denial-of-service condition.
- Product
- HIWIN Robot System Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022Ree6 is a moderation bot.CVE-2022-39302 · Other software · Ree6-Applications · reported by GitHubMedium 5.5
Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which contain a channel from another server as a target. This would mean you could send log messages to another Guild channel and bypass raid and webhook protections. A specifically crafted log message could allow spamming and mass advertisements. This issue has been patched in version 1.9.9. There are currently no known workarounds.
- Product
- Ree6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022Ree6 is a moderation bot.CVE-2022-39303 · Other software · Ree6-Applications · reported by GitHubHigh 8.1
Ree6 is a moderation bot. This vulnerability allows manipulation of SQL queries. This issue has been patched in version 1.7.0 by using Javas PreparedStatements, which allow object setting without the risk of SQL injection. There are currently no known workarounds.
- Product
- Ree6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross origin resource sharing using the bot api.CVE-2022-41294 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross origin resource sharing using the bot api. IBM X-Force ID: 236807.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 6, 2022IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting.CVE-2022-38709 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 234291.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 6, 2022IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration.CVE-2022-36774 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IBM X-Force ID: 233575.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 6, 2022In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.CVE-2022-2781 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Oct 6, 2022IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of the victim.CVE-2022-22503 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 227125.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 29, 2022IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs.CVE-2022-39168 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. IBM X-Force ID: 235422.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 21, 2022Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting iCVE-2022-41224 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022Zephyr Project Manager: Does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated usersCVE-2022-2840 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
- Product
- Zephyr Project Manager
- Fixed in
- 3.2.5
- What to do
- Update Zephyr Project Manager to 3.2.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.