Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,050 results · page 34 of 61
Jan 11, 2023Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012.CVE-2017-16265 · Other software · Insteon · reported by talos-cna@cisco.comCritical 9.9
Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd l_bt, at 0x9d016104, the value for the `grp` key is copied using `strcpy` to the buffer at `$sp+0x1b4`.This buffer is 8 bytes large, sending anything longer will cause a buffer overflow.
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 11, 2023Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012.CVE-2017-16264 · Other software · Insteon · reported by talos-cna@cisco.comCritical 9.9
Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd l_b, at 0x9d015cfc, the value for the `grp` key is copied using `strcpy` to the buffer at `$sp+0x1b4`.This buffer is 8 bytes large, sending anything longer will cause a buffer overflow.
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 11, 2023Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012.CVE-2017-16263 · Other software · Insteon · reported by talos-cna@cisco.comCritical 9.9
Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd g_b, at 0x9d015a8c, the value for the `val` key is copied using `strcpy` to the buffer at `$sp+0x2b0`.This buffer is 32 bytes large, sending anything longer will cause a buffer overflow.
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 11, 2023Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012.CVE-2017-16262 · Other software · Insteon · reported by talos-cna@cisco.comCritical 9.9
Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd g_b, at 0x9d015864, the value for the `id` key is copied using `strcpy` to the buffer at `$sp+0x290`.This buffer is 32 bytes large, sending anything longer will cause a buffer overflow.
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 11, 2023Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012.CVE-2017-16261 · Other software · Insteon · reported by talos-cna@cisco.comHigh 8.8
Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd g_b, at 0x9d015714, the value for the `grp` key is copied using `strcpy` to the buffer at `$sp+0x280`.This buffer is 16 bytes large, sending anything longer will cause a buffer overflow.
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 11, 2023Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012.CVE-2017-16260 · Other software · Insteon · reported by talos-cna@cisco.comCritical 9.9
Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd s_auth, at 0x9d015478, the value for the `pwd` key is copied using `strcpy` to the buffer at `$sp+0x2b0`.This buffer is 32 bytes large, sending anything longer will cause a buffer overflow.
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 11, 2023Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012.CVE-2017-16259 · Other software · Insteon · reported by talos-cna@cisco.comCritical 9.9
Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd s_auth, at 0x9d015430, the value for the `usr` key is copied using `strcpy` to the buffer at `$sp+0x290`.This buffer is 32 bytes large, sending anything longer will cause a buffer overflow.
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 11, 2023Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012.CVE-2017-16258 · Other software · Insteon · reported by talos-cna@cisco.comCritical 9.9
Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd sn_sx, at 0x9d014f7c, the value for the `cmd4` key is copied using `strcpy` to the buffer at `$sp+0x2b0`.This buffer is 32 bytes large, sending anything longer will cause a buffer overflow.
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 11, 2023Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012.CVE-2017-16257 · Other software · Insteon · reported by talos-cna@cisco.comCritical 9.9
Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd sn_sx, at 0x9d014f28, the value for the `cmd3` key is copied using `strcpy` to the buffer at `$sp+0x2b0`.This buffer is 32 bytes large, sending anything longer will cause a buffer overflow.
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 11, 2023Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012.CVE-2017-16256 · Other software · Insteon · reported by talos-cna@cisco.comCritical 9.9
Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd sn_sx, at 0x9d014ebc, the value for the `cmd2` key is copied using `strcpy` to the buffer at `$sp+0x2d0`.This buffer is 100 bytes large, sending anything longer will cause a buffer overflow.
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 9, 2023An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write access to modify ActiCVE-2022-46258 · Other software · GitHub · reported by product-cna@github.comMedium 6.5
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write access to modify Action Workflow files without a Workflow scope. The Create or Update file contents API should enforce workflow scope. This vulnerability affected all versions of GitHub Enterprise Server prior to version 3.7 and was fixed in versions 3.3.16, 3.4.11, 3.5.8, and 3.6.4. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Jan 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-0112 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-0111 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-0110 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-0108 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-0107 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-0106 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.CVE-2023-0057 · Other software · pyload · reported by security@huntr.devMedium 6.1
Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.
- Product
- pyload/pyload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32.CVE-2023-0055 · Other software · pyload · reported by security@huntr.devMedium 5.3
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32.
- Product
- pyload/pyload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.CVE-2023-0054 · Other software · vim · reported by security@huntr.devHigh 7.8
Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Jan 4, 2023Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.CVE-2023-0051 · Other software · vim · reported by security@huntr.devHigh 7.8
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Jan 4, 2023Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.CVE-2023-0049 · Other software · vim · reported by security@huntr.devHigh 7.8
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Jan 4, 2023Code Injection in GitHub repository lirantal/daloradius prior to master-branch.CVE-2023-0048 · Other software · lirantal · reported by security@huntr.devHigh 8.8
Code Injection in GitHub repository lirantal/daloradius prior to master-branch.
- Product
- lirantal/daloradius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch.CVE-2023-0046 · Other software · lirantal · reported by security@huntr.devHigh 7.2
Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch.
- Product
- lirantal/daloradius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2023kenny2automate is a Discord bot.CVE-2023-22452 · Other software · Kenny2github · reported by GitHubMedium 6.5
kenny2automate is a Discord bot. In the web interface for server settings, form elements were generated with Discord channel IDs as part of input names. Prior to commit a947d7c, no validation was performed to ensure that the channel IDs submitted actually belonged to the server being configured. Thus anyone who has access to the channel ID they wish to change settings for and the server settings panel for any server could change settings for the requested channel no matter which server it belonged to. Commit a947d7c resolves the issue and has been deployed to the official instance of the bot. The only workaround that exists is to disable the web config entirely by changing it to run on localhost. Note that a workaround is only necessary for those who run their own instance of the bot.
- Product
- kenny2automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2022Cross-site Scripting (XSS) - Stored in GitHub repository linagora/twake prior to 2023.Q1.1200+.CVE-2023-0028 · Other software · linagora · reported by security@huntr.devMedium 5.7
Cross-site Scripting (XSS) - Stored in GitHub repository linagora/twake prior to 2023.Q1.1200+.
- Product
- linagora/twake
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2022Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.CVE-2022-4868 · Other software · froxlor · reported by security@huntr.devMedium 4.3
Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2022Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.CVE-2022-4867 · Other software · froxlor · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2022Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4866 · Other software · usememos · reported by security@huntr.devCritical 9
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2022Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4865 · Other software · usememos · reported by security@huntr.devCritical 9
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.CVE-2022-4864 · Other software · froxlor · reported by security@huntr.devMedium 5.4
Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022Improper Handling of Insufficient Permissions or Privileges in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4863 · Other software · usememos · reported by security@huntr.devMedium 6.5
Improper Handling of Insufficient Permissions or Privileges in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4851 · Other software · usememos · reported by security@huntr.devMedium 5.3
Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4850 · Other software · usememos · reported by security@huntr.devMedium 6.5
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4849 · Other software · usememos · reported by security@huntr.devMedium 6.5
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4848 · Other software · usememos · reported by security@huntr.devMedium 5.7
Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4847 · Other software · usememos · reported by security@huntr.devMedium 6.5
Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4846 · Other software · usememos · reported by security@huntr.devMedium 6.5
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4845 · Other software · usememos · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4844 · Other software · usememos · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.CVE-2022-4843 · Other software · radareorg · reported by security@huntr.devHigh 7.5
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.
- Product
- radareorg/radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4841 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4840 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4839 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4814 · Other software · usememos · reported by security@huntr.devMedium 4.3
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4813 · Other software · usememos · reported by security@huntr.devMedium 4.3
Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4812 · Other software · usememos · reported by security@huntr.devMedium 6.5
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4810 · Other software · usememos · reported by security@huntr.devMedium 4.3
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4809 · Other software · usememos · reported by security@huntr.devHigh 8.8
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4808 · Other software · usememos · reported by security@huntr.devHigh 8.8
Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.