Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,628 results · page 33 of 73
Apr 21, 2022An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database.CVE-2022-24272 · Other software · MongoDB Inc. · reported by cna@mongodb.comMedium 6.5
An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may result in mongod denial of service or server crash. This issue affects: MongoDB Inc. MongoDB Server v5.0 versions, prior to and including v5.0.6.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgjira.mongodb.org
Apr 20, 2022Databasir is a team-oriented relational database model document management platform.CVE-2022-24862 · Other software · vran-dev · reported by GitHubHigh 7.7
Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Server-Side Request Forgery vulnerability. During the download verification process of a JDBC driver the corresponding JDBC driver download address will be downloaded first, but this address will return a response page with complete error information when accessing a non-existent URL. Attackers can take advantage of this feature for SSRF.
- Product
- databasir
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2022Databasir is a team-oriented relational database model document management platform.CVE-2022-24861 · Other software · vran-dev · reported by GitHubCritical 9.9
Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has remote code execution vulnerability. JDBC drivers are not validated prior to use and may be provided by users of the system. This can lead to code execution by any basic user who has access to the system. Users are advised to upgrade. There are no known workarounds to this issue.
- Product
- databasir
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2022Databasir is a team-oriented relational database model document management platform.CVE-2022-24860 · Other software · vran-dev · reported by GitHubHigh 7.4
Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An attacker can use hard coding to generate login credentials of any user and log in to the service background located at different IP addresses.
- Product
- databasir
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2022Vulnerability in the Java VM component of Oracle Database Server.CVE-2022-21498 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure privilege with network access via multiple protocols to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
- Product
- Database - Enterprise Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2022Vulnerability in the RDBMS Gateway / Generic ODBC Connectivity component of Oracle Database Server.CVE-2022-21411 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.4
Vulnerability in the RDBMS Gateway / Generic ODBC Connectivity component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise RDBMS Gateway / Generic ODBC Connectivity. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of RDBMS Gateway / Generic ODBC Connectivity accessible data as well as unauthorized read access to a subset of RDBMS Gateway / Generic ODBC Connectivity accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
- Product
- Database - Enterprise Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2022Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server.CVE-2022-21410 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.2
Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any Procedure privilege with network access via Oracle Net to compromise Oracle Database - Enterprise Edition Sharding. Successful attacks of this vulnerability can result in takeover of Oracle Database - Enterprise Edition Sharding. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
- Product
- Database - Enterprise Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2022A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database.CVE-2022-27927 · Other software · Microfinance Management System Project · reported by MITRECritical 9.8
A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database. An attacker can issue SQL commands to the MySQL database through the vulnerable course_code and/or customer_number parameter.
- Product
- Microfinance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 12, 2022SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the servCVE-2022-27670 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the server with some queries that use indirect identifiers.
- Product
- SAP SQL Anywhere Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Apr 4, 2022Directus is a real-time API and App dashboard for managing SQL database content.CVE-2022-24814 · Other software · directus · reported by GitHubHigh 8.8
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript (JS) can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run any arbitrary JS. This issue was resolved in version 9.7.0. As a workaround, disable the live embed in the what-you-see-is-what-you-get by adding `{ "media_live_embeds": false }` to the _Options Overrides_ option of the Rich Text HTML interface.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing moduleCVE-2022-27534 · Other software · Kaspersky · reported by vulnerability@kaspersky.comCritical 9.8
Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing module that potentially allowed an attacker to execute arbitrary code. The fix was delivered automatically. Credits: Georgy Zaytsev (Positive Technologies).
- Product
- Anti-virus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.kaspersky.comsupport.kaspersky.com
Mar 31, 2022Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format.CVE-2022-24798 · Other software · irrdnet · reported by GitHubHigh 7.5
Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. IRRd did not always filter password hashes in query responses relating to `mntner` objects and database exports. This may have allowed adversaries to retrieve some of these hashes, perform a brute-force search for the clear-text passphrase, and use these to make unauthorised changes to affected IRR objects. This issue only affected instances that process password hashes, which means it is limited to IRRd instances that serve authoritative databases. IRRd instances operating solely as mirrors of other IRR databases are not affected. This has been fixed in IRRd 4.2.3 and the main branch. Versions in the 4.1.x series never were affected. Users of the 4.2.x series are strongly recommended to upgrade. There are no known workarounds for this issue.
- Product
- irrd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022Database Peek: Does not sanitize and escape the match parameter before outputting it back in an admin pageCVE-2022-0619 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Database Peek
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Database Peek to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 20223CX System through 2022-03-17 stores cleartext passwords in a database.CVE-2021-45491 · Other software · 3cx · reported by MITREMedium 6.5
3CX System through 2022-03-17 stores cleartext passwords in a database.
- Product
- 3cx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.com3cx.com
Mar 25, 2022ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user's data.CVE-2022-25577 · Other software · Alf-banco · reported by MITRECritical 9.1
ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user's data. Attackers who are able to gain remote or local access to the system are able to read and modify the data.
- Product
- Alf-banco
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2022A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication.CVE-2022-0996 · Other software · Redhat · reported by Red HatMedium 6.5
A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication.
- Product
- 389 Directory Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Mar 22, 2022In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of tCVE-2022-25518 · Other software · Tecnoteca · reported by MITREMedium 6.5
In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of the users who login to the application by querying the database table.
- Product
- Cmdbuild
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcmdbuild.orgcmdbuild.org
Mar 3, 2022OS4ED openSIS 8.0 is affected by SQL Injection in CheckDuplicateName.php, which can extract information from the database.CVE-2021-40636 · Other software · Os4ed · reported by MITREHigh 7.5
OS4ED openSIS 8.0 is affected by SQL Injection in CheckDuplicateName.php, which can extract information from the database.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2022Insecure permissions in the file database.sdb of BatFlat CMS v1.3.6 allows attackers to dump the entire database.CVE-2021-41652 · Other software · Batflat · reported by MITREHigh 7.5
Insecure permissions in the file database.sdb of BatFlat CMS v1.3.6 allows attackers to dump the entire database.
- Product
- Batflat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeathflash1411.github.iogithub.com
Feb 28, 2022A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local CVE-2021-42767 · Other software · Neo4j · reported by MITRECritical 9.1
A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1.
- Product
- Awesome Procedures
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022SQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the information in the database via unspecifiCVE-2022-23986 · Other software · Dojin Club MICMNIS · reported by vultures@jpcert.or.jpHigh 7.5
SQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the information in the database via unspecified vectors.
- Product
- phpUploader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2022Database Backup for: Does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboardCVE-2022-0255 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
- Product
- Database Backup for
- Fixed in
- 2.5.1
- What to do
- Update Database Backup for to 2.5.1 or newer.
Feb 21, 2022Advanced Database Cleaner: Does not sanitise and escape $_GET keys and values before outputting them back in attributesCVE-2021-24921 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Advanced Database Cleaner
- Fixed in
- 3.0.4
- What to do
- Update Advanced Database Cleaner to 3.0.4 or newer.
Feb 15, 2022The Database component of TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition contains an easily exploitable vulnerability that allows an unauthenticaCVE-2021-43049 · Other software · TIBCO Software Inc. · reported by security@tibco.comCritical 9.8
The Database component of TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to obtain the usernames and passwords of users of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition: versions 1.1.0 and below.
- Product
- TIBCO BusinessConnect Container Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBCCVE-2022-25206 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials.
- Product
- Jenkins dbCharts Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022A cross-site request forgery (CSRF) vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-specified database viaCVE-2022-25205 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-specified database via JDBC using attacker-specified credentials and to determine if a class is available in the Jenkins instance.
- Product
- Jenkins dbCharts Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is pCVE-2021-45346 · Other software · Sqlite · reported by MITREMedium 4.3
A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.
- Product
- Sqlite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Feb 14, 2022Futurio Extra: Is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the databaseCVE-2021-25109 · WordPress plugins & themes · reported by WPScanLow 2.7
The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against logged in admins by making send open a malicious link.
- Product
- Futurio Extra
- Fixed in
- 1.6.3
- What to do
- Update Futurio Extra to 1.6.3 or newer.
Feb 1, 2022Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users.CVE-2021-44451 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jan 25, 2022In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges.CVE-2021-46089 · Other software · Jeecg · reported by MITRECritical 9.8
In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATICVE-2022-23221 · Other software · H2database · reported by MITRECritical 9.8
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
- Product
- H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 19, 2022Vulnerability in the Java VM component of Oracle Database Server.CVE-2022-21393 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java VM. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
- Product
- Database - Enterprise Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022Vulnerability in the Core RDBMS component of Oracle Database Server.CVE-2022-21247 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 2.7
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Session, Execute Catalog Role privilege with network access via Oracle Net to compromise Core RDBMS. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Core RDBMS accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).
- Product
- Database - Enterprise Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2022In Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database via SQLi, an attacker can log in and leverage an arbitrary file uCVE-2021-45411 · Other software · Printable Staff ID Card Creator System Project · reported by MITRECritical 9.8
In Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database via SQLi, an attacker can log in and leverage an arbitrary file upload vulnerability to obtain remote code execution.
- Product
- Printable Staff ID Card Creator System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsourcecodester.com
Jan 11, 2022SpiceDB is a database system for managing security-critical application permissions.CVE-2022-21646 · Other software · authzed · reported by GitHubHigh 8.1
SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as "accessible" if it is *not* accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In `v1.3.0`, the wildcard is ignored entirely in lookup's dispatch, resulting in the `banned` wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page.CVE-2021-46166 · Email & office · Zohocorp · reported by MITREMedium 6.5
Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jan 10, 2022The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database.CVE-2021-42392 · Other software · h2database · reported by reefs@jfrog.comCritical 9.8
The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.
- Product
- h2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21664 · WordPress plugins & themes · reported by GitHubHigh 7.4
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 4.1.34. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
- What to do
- Update the plugin to the newest version.
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21663 · WordPress plugins & themes · reported by GitHubMedium 6.6
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordblog.sonarsource.comgithub.com
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21662 · WordPress plugins & themes · reported by GitHubHigh 8
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21661 · WordPress plugins & themes · reported by GitHubHigh 8
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 6, 2022Apache Kylin allows users to read data from other database systems using JDBC.CVE-2021-36774 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Kylin server processes. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions.
- Product
- Apache Kylin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Dec 29, 2021Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on tCVE-2021-36722 · Other software · Emuse · reported by cna@cyber.gov.ilHigh 7.1
Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on the affected endpoints. The SQLi caused by CWE-209: Generation of Error Message Containig Sensetive Information, showing parts of the aspx code and the webroot location , information an attacker can leverage to further compromise the host.
- Product
- eServices / eNvoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2021lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular expression denial of service) or other impCVE-2021-45470 · Other software · Circl · reported by MITREHigh 7.5
lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular expression denial of service) or other impacts.
- Product
- Cve-search
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2021Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).CVE-2021-36886 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).
- Affected
- up to 1.2.5.9
- What to do
- Affects up to 1.2.5.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Dec 22, 2021Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).CVE-2021-36885 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).
- Affected
- up to 1.2.6.1
- What to do
- Affects up to 1.2.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Dec 15, 2021In several functions of DatabaseManager.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure.CVE-2021-1006 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In several functions of DatabaseManager.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-183961974
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 15, 2021Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege VulnerabilityCVE-2021-42293 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege Vulnerability
- Product
- Microsoft Office LTSC 2021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Dec 14, 2021If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions 1CVE-2021-42064 · Websites & servers · SAP SE · reported by cna@sap.comCritical 9.8
If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker to execute crafted database queries, exposing backend database. The vulnerability is present if the parameterized "in" clause accepts more than 1000 values.
- Product
- SAP Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Dec 13, 2021Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data.CVE-2021-43822 · Other software · jackalope · reported by GitHubHigh 8.5
Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`. Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected.
- Product
- jackalope-doctrine-dbal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.