Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,137 results · page 34 of 43
Sep 5, 2022The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticatedCVE-2022-2376 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users
- Product
- Directorist
- Fixed in
- 7.3.1
- What to do
- Update Directorist to 7.3.1 or newer.
Aug 31, 2022Delta Electronics Delta Robot Automation Studio (DRAS) versions prior to 1.13.20 are affected by improper restrictions where the software processes an XML documCVE-2022-2759 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govMedium 5.5
Delta Electronics Delta Robot Automation Studio (DRAS) versions prior to 1.13.20 are affected by improper restrictions where the software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. This may allow an attacker to view sensitive documents and information on the affected host.
- Product
- Delta Robot Automation Studio (DRAS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated usersCVE-2021-24910 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
- Product
- Transposh WordPress Translation
- Fixed in
- 1.0.8
- What to do
- Update Transposh WordPress Translation to 1.0.8 or newer.
Aug 10, 2022IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackeCVE-2022-35280 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 10, 2022IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain sensitive Azure bot credential information.CVE-2022-22490 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.9
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain sensitive Azure bot credential information. IBM X-Force ID: 226342.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 10, 2022The KUKA SystemSoftware V/KSS in versions prior to 8.6.5 is prone to improper access control as an unauthorized attacker can directly read and write robot confiCVE-2022-2242 · Other software · KUKA · reported by info@cert.vde.comCritical 9.8
The KUKA SystemSoftware V/KSS in versions prior to 8.6.5 is prone to improper access control as an unauthorized attacker can directly read and write robot configurations when access control is not available or not enabled (default).
- Product
- SystemSoftware V/KSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022Using off-the-shelf commodity hardware, the Unitree Go 1 robotics platform version H0.1.7 and H0.1.9 (using firmware version 0.1.35) can be powered down by an aCVE-2022-2675 · Other software · Unitree · reported by cve@rapid7.comMedium 6.5
Using off-the-shelf commodity hardware, the Unitree Go 1 robotics platform version H0.1.7 and H0.1.9 (using firmware version 0.1.35) can be powered down by an attacker within normal RF range without authentication. Other versions may be affected, such as the A1.
- Product
- Go 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code.CVE-2016-3098 · Other software · Thoughtbot · reported by Red HatMedium 5.4
Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code.
- Product
- Administrate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Aug 1, 2022Copyright Proof: Does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated usersCVE-2022-1906 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled.
- Product
- Copyright Proof
- Affected
- up to 4.16
- What to do
- Affects up to 4.16. Update Copyright Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could disclose sensitive information due to improper privilege management for storage provider types.CVE-2022-34338 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could disclose sensitive information due to improper privilege management for storage provider types. IBM X-Force ID: 229962.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 1, 2022IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for users created via a bulk upload.CVE-2022-33169 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for users created via a bulk upload. IBM X-Force ID: 228888.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 1, 2022IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to elevate their privilege to platform administrator through manipulatioCVE-2022-30616 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.2
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to elevate their privilege to platform administrator through manipulation of APIs. IBM X-Force ID: 227978.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 1, 2022IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow IBM tenant credentials to be exposed.CVE-2022-22505 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow IBM tenant credentials to be exposed. IBM X-Force ID: 227288.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 1, 2022IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user to access information from a tenant of which they should not have access.CVE-2022-22334 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user to access information from a tenant of which they should not have access. IBM X-Force ID: 219391.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 28, 2022In zulip before 1.3.12, bot API keys were accessible to other users in the same realm.CVE-2016-4426 · Other software · Zulip · reported by Red HatMedium 4.3
In zulip before 1.3.12, bot API keys were accessible to other users in the same realm.
- Product
- Zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzulip.readthedocs.iozulip.readthedocs.io
Jul 26, 2022IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with access to the local host (client machine) to obtain a login access token.CVE-2022-22412 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.6
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with access to the local host (client machine) to obtain a login access token. IBM X-Force ID: 223019.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 22, 2022Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to send arbitrary intents from anyCVE-2022-1130 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.1
Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to send arbitrary intents from any app via a malicious app.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Jul 17, 2022CDI: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1933 · WordPress plugins & themes · reported by WPScanMedium 6.1
The CDI WordPress plugin before 5.1.9 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting
- Product
- CDI
- Fixed in
- 5.1.9
- What to do
- Update CDI to 5.1.9 or newer.
Jul 16, 2022WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.CVE-2021-36711 · Other software · Octobot · reported by MITRECritical 9.8
WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.
- Product
- Octobot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jul 11, 2022Awin Data Feed: Does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1937 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting
- Product
- Awin Data Feed
- Fixed in
- 1.8
- What to do
- Update Awin Data Feed to 1.8 or newer.
Jul 10, 2022The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31587 · Other software · Kg-fashion-chatbot Project · reported by MITRECritical 9.3
The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Kg-fashion-chatbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022IOBit Advanced System Care (Asc.exe) 15 and Action Download Center both download components of IOBit suite into ProgramData folder, ProgramData folder has "rwx"CVE-2022-24138 · Other software · Iobit · reported by MITREHigh 7.8
IOBit Advanced System Care (Asc.exe) 15 and Action Download Center both download components of IOBit suite into ProgramData folder, ProgramData folder has "rwx" permissions for unprivileged users. Low privilege users can use SetOpLock to wait for CreateProcess and switch the genuine component with a malicious executable thus gaining code execution as a high privilege user (Low Privilege -> high integrity ADMIN).
- Product
- Advanced Systemcare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2022Gallery: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1946 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
- Product
- Gallery
- Fixed in
- 2.0.0
- What to do
- Update Gallery to 2.0.0 or newer.
Jun 27, 2022Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenCVE-2022-1916 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected cross-Site Scripting
- Product
- Active Products Tables for WooCommerce. Professional products tables for WooCommerce store
- Fixed in
- 1.0.5
- What to do
- Update Active Products Tables for WooCommerce. Professional products tables for WooCommerce store to 1.0.5 or newer.
Jun 27, 2022Pricing Tables: Does not sanitise and escape parameter before outputting it back in a page available to any user (both authenticated and unauthenticated)CVE-2022-1904 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page available to any user (both authenticated and unauthenticated) when a specific setting is enabled, leading to a Reflected Cross-Site Scripting
- Product
- Pricing Tables
- Fixed in
- 3.2.1
- What to do
- Update Pricing Tables to 3.2.1 or newer.
Jun 24, 2022IBM Robotic Process Automation 21.0.1 and 21.0.2 could allow a user with psychical access to the system to obtain sensitive information due to insufficiently prCVE-2022-33953 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.6
IBM Robotic Process Automation 21.0.1 and 21.0.2 could allow a user with psychical access to the system to obtain sensitive information due to insufficiently protected access tokens. IBM X-Force ID: 229198.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 24, 2022IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to cross-site scripting.CVE-2022-22502 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227124.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 23, 2022Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripting (XSS) vulnerabiliCVE-2022-34182 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripting (XSS) vulnerability.
- Product
- Jenkins Nested View Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments conCVE-2022-34175 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in CVE-2022-34173 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scriptiCVE-2022-34172 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons inCVE-2022-34171 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is partCVE-2022-34170 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2022IBM Robotic Process Automation 21.0.2 could allow a local user to obtain sensitive web service configuration credentials from system memory.CVE-2022-22414 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM Robotic Process Automation 21.0.2 could allow a local user to obtain sensitive web service configuration credentials from system memory. IBM X-Force ID: 223026.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 17, 2022IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information dueCVE-2022-30607 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information due to information properly masked in the control center UI. IBM X-Force ID: 227294.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 2, 2022ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=responses/view_response&id=.CVE-2022-31971 · Other software · Chatbot App With Suggestion Project · reported by MITREHigh 7.2
ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=responses/view_response&id=.
- Product
- Chatbot App With Suggestion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=responses/manage_response&id=.CVE-2022-31970 · Other software · Chatbot App With Suggestion Project · reported by MITREHigh 7.2
ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=responses/manage_response&id=.
- Product
- Chatbot App With Suggestion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=user/manage_user&id=.CVE-2022-31969 · Other software · Chatbot App With Suggestion Project · reported by MITRECritical 9.8
ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=user/manage_user&id=.
- Product
- Chatbot App With Suggestion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022ChatBot App with Suggestion v1.0 is vulnerable to Delete any file via /simple_chat_bot/classes/Master.php?f=delete_img.CVE-2022-31966 · Other software · Chatbot App With Suggestion Project · reported by MITREMedium 6.5
ChatBot App with Suggestion v1.0 is vulnerable to Delete any file via /simple_chat_bot/classes/Master.php?f=delete_img.
- Product
- Chatbot App With Suggestion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Bottle before 0.12.20 mishandles errors during early request binding.CVE-2022-31799 · Other software · Bottlepy · reported by MITRECritical 9.8
Bottle before 0.12.20 mishandles errors during early request binding.
- Product
- Bottle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2022github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs).CVE-2022-29220 · Other software · fastify · reported by GitHubMedium 6.5
github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs). Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set to `dependabot[bot]` to determine if the PR is a legit PR. Theoretically, an owner of a seemingly valid and legit action in the pipeline can check if the PR is created by dependabot and if their own action has enough permissions to modify the PR in the pipeline. If so, they can modify the PR by adding a second seemingly valid and legit commit to the PR, as they can set arbitrarily the username and email in for commits in git. Because the bot only checks if the actor is valid, it would pass the malicious changes through and merge the PR automatically, without getting noticed by project maintainers. It would probably not be possible to determine where the malicious commit came from, as it would only say `dependabot[bot]` and the corresponding email-address. Version 3.2.0 contains a patch for this issue.
- Product
- github-action-merge-dependabot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2022The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.CVE-2021-27780 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
- Product
- HCL BigFix Mobile / Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 24, 2022ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to Cross Site Scripting (XSS) via /simple_chat_bot/classes/Master.php?f=save_response.CVE-2022-30464 · Other software · Chatbot App With Suggestion Project · reported by MITREMedium 5.4
ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to Cross Site Scripting (XSS) via /simple_chat_bot/classes/Master.php?f=save_response.
- Product
- Chatbot App With Suggestion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to SQL Injection via /simple_chat_bot/classes/Master.php?f=delete_response, id.CVE-2022-30459 · Other software · Chatbot App With Suggestion Project · reported by MITREHigh 8.8
ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to SQL Injection via /simple_chat_bot/classes/Master.php?f=delete_response, id.
- Product
- Chatbot App With Suggestion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022ChatBot Application with a Suggestion Feature 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /simple_chat_bot/admin/responsCVE-2022-30518 · Other software · Chatbot Application With A Suggestion Feature Project · reported by MITRECritical 9.8
ChatBot Application with a Suggestion Feature 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /simple_chat_bot/admin/responses/view_response.php.
- Product
- Chatbot Application With A Suggestion Feature
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.compacketstormsecurity.com
May 19, 2022Mobotix Control Center (MxCC) through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the MxCC.ini config file.CVE-2022-30018 · Other software · Mobotix · reported by MITREHigh 8.8
Mobotix Control Center (MxCC) through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the MxCC.ini config file. The credential storage method in this software enables an attacker/user of the machine to gain admin access to the software and gain access to recordings/recording locations.
- Product
- Mxcontrolcenter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2022A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized bCVE-2022-1734 · Computers, phones & browsers · Linux · reported by Red HatHigh 7
A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
May 17, 2022In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameCVE-2022-26650 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.
- Product
- Apache ShenYu (incubating)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
May 12, 2022IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to SQL injection.CVE-2022-22413 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 223022.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 9, 2022IBM Robotic Process Automation 21.0.1 could allow a register user on the system to physically delete a queue that could cause disruption for any scripts dependeCVE-2022-22319 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Robotic Process Automation 21.0.1 could allow a register user on the system to physically delete a queue that could cause disruption for any scripts dependent on the queue. IBM X-Force ID: 218366.
- Product
- Robotic Process Automation as a Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.