Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,050 results · page 37 of 61
Nov 29, 2022The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDirCVE-2022-21126 · Other software · Samtools · reported by report@snyk.ioHigh 7.3
The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.
- Product
- Htsjdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2022Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.CVE-2022-2650 · Other software · wger-project · reported by security@huntr.devCritical 9.8
Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.
- Product
- wger-project/wger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2022CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code execuCVE-2022-23740 · Other software · GitHub · reported by product-cna@github.comHigh 8.8
CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. To exploit this vulnerability, an attacker would need permission to create and build GitHub Pages using GitHub Actions. This vulnerability affected only version 3.7.0 of GitHub Enterprise Server and was fixed in version 3.7.1. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Nov 21, 2022Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2.CVE-2022-4096 · Other software · appsmithorg · reported by security@huntr.devMedium 6.5
Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2.
- Product
- appsmithorg/appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2022Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0.CVE-2022-4070 · Other software · librenms · reported by security@huntr.devCritical 9.8
Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2022Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0.CVE-2022-4069 · Other software · librenms · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2022Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.CVE-2022-4067 · Other software · librenms · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2022Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.CVE-2022-3562 · Other software · librenms · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2022Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0.CVE-2022-3561 · Other software · librenms · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2022Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0.CVE-2022-3525 · Other software · librenms · reported by security@huntr.devHigh 8.8
Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2022Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.CVE-2022-3516 · Other software · librenms · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2022In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email addressCVE-2022-45471 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.5
In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Nov 16, 2022Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.CVE-2022-4018 · Other software · ikus060 · reported by security@huntr.devMedium 4.3
Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.CVE-2022-2166 · Other software · mastodon · reported by security@huntr.devCritical 9.8
Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.
- Product
- mastodon/mastodon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of CVE-2022-45385 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
- Product
- Jenkins CloudBees Docker Hub/Registry Notification Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Nov 14, 2022Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0.CVE-2022-3362 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2022Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3.CVE-2022-3993 · Other software · kareadita · reported by security@huntr.devCritical 9.4
Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3.
- Product
- kareadita/kavita
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3.CVE-2022-3945 · Other software · kareadita · reported by security@huntr.devMedium 5.3
Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3.
- Product
- kareadita/kavita
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2022Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.CVE-2022-41719 · Other software · github.com/shamaton/msgpack/v2 · reported by security@golang.orgHigh 7.5
Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.
- Product
- github.com/shamaton/msgpack/v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.CVE-2022-3873 · Other software · jgraph · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2022Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.CVE-2022-3869 · Other software · froxlor · reported by security@huntr.devMedium 6.1
Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2022Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39.CVE-2022-3721 · Other software · froxlor · reported by security@huntr.devMedium 4.6
Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2022Use of Externally-Controlled Format String in GitHub repository pingcap/tidb prior to 6.4.0, 6.1.3.CVE-2022-3023 · Other software · pingcap · reported by security@huntr.devCritical 9.8
Use of Externally-Controlled Format String in GitHub repository pingcap/tidb prior to 6.4.0, 6.1.3.
- Product
- pingcap/tidb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022An improper cache key vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to access private repository files through a pCVE-2022-23738 · Other software · GitHub · reported by product-cna@github.comMedium 5.7
An improper cache key vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to access private repository files through a public repository. To exploit this, an actor would need to already be authorized on the GitHub Enterprise Server instance, be able to create a public repository, and have a site administrator visit a specially crafted URL. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.6 and was fixed in versions 3.2.20, 3.3.15, 3.4.10, 3.5.7, 3.6.3. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Oct 31, 2022 Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the applicationCVE-2022-39019 · Other software · M-Files · reported by vdp@themissinglink.com.auMedium 6.3
Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server.
- Product
- Hubshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Oct 31, 2022 Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL.CVE-2022-39018 · Other software · M-Files · reported by vdp@themissinglink.com.auHigh 8.2
Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL.
- Product
- Hubshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Oct 31, 2022 Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-sCVE-2022-39017 · Other software · M-Files · reported by vdp@themissinglink.com.auHigh 8.2
Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments.
- Product
- Hubshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Oct 31, 2022 Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload.CVE-2022-39016 · Other software · M-Files · reported by vdp@themissinglink.com.auHigh 8.2
Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload.
- Product
- Hubshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Oct 31, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.CVE-2022-3766 · Other software · thorsten · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8.CVE-2022-3765 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2022Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.CVE-2022-3754 · Other software · thorsten · reported by security@huntr.devCritical 9.8
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022DataHub is an open-source metadata platform.CVE-2022-39366 · Other software · datahub-project · reported by GitHubCritical 9.9
DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This vulnerability occurs because the `StatelessTokenService` of the Metadata service uses the `parse` method of `io.jsonwebtoken.JwtParser`, which does not perform a verification of the cryptographic token signature. This means that JWTs are accepted regardless of the used algorithm. This issue may lead to an authentication bypass. Version 0.8.45 contains a patch for the issue. There are no known workarounds.
- Product
- datahub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeql.github.comgithub.com
Oct 27, 2022The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted.CVE-2022-40967 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.CVE-2022-3363 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022kartverket/github-workflows are shared reusable workflows for GitHub Actions.CVE-2022-39326 · Other software · kartverket · reported by GitHubHigh 8.8
kartverket/github-workflows are shared reusable workflows for GitHub Actions. Prior to version 2.7.5, all users of the `run-terraform` reusable workflow from the kartverket/github-workflows repo are affected by a code injection vulnerability. A malicious actor could potentially send a PR with a malicious payload leading to execution of arbitrary JavaScript code in the context of the workflow. Users should upgrade to at least version 2.7.5 to resolve the issue. As a workaround, review any pull requests from external users for malicious payloads before allowing them to trigger a build.
- Product
- github-workflows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow.CVE-2022-39321 · Other software · actions · reported by GitHubHigh 8.8
GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands was discovered in versions prior to 2.296.2, 2.293.1, 2.289.4, 2.285.2, and 2.283.4 that allows an input to escape the environment variable and modify that docker command invocation directly. Jobs that use container actions, job containers, or service containers alongside untrusted user inputs in environment variables may be vulnerable. The Actions Runner has been patched, both on `github.com` and hotfixes for GHES and GHAE customers in versions 2.296.2, 2.293.1, 2.289.4, 2.285.2, and 2.283.4. GHES and GHAE customers may want to patch their instance in order to have their runners automatically upgrade to these new runner versions. As a workaround, users may consider removing any container actions, job containers, or service containers from their jobs until they are able to upgrade their runner versions.
- Product
- runner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.CVE-2022-3327 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022A deserialization of untrusted data vulnerability was identified in GitHub Enterprise Server that could potentially lead to remote code execution on the SVNBridCVE-2022-23734 · Other software · GitHub · reported by product-cna@github.comHigh 8.8
A deserialization of untrusted data vulnerability was identified in GitHub Enterprise Server that could potentially lead to remote code execution on the SVNBridge. To exploit this vulnerability, an attacker would need to gain access via a server-side request forgery (SSRF) that would let an attacker control the data being deserialized. This vulnerability affected all versions of GitHub Enterprise Server prior to v3.6 and was fixed in versions 3.5.3, 3.4.6, 3.3.11, and 3.2.16. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Oct 19, 2022Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha.CVE-2022-3608 · Other software · thorsten · reported by security@huntr.devHigh 8.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3.CVE-2022-3607 · Other software · octoprint · reported by security@huntr.devMedium 6
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3.
- Product
- octoprint/octoprint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2022Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1.CVE-2022-3552 · Other software · boxbilling · reported by security@huntr.devHigh 7.2
Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1.
- Product
- boxbilling/boxbilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 17, 2022devhub 0.102.0 was discovered to contain a broken session control.CVE-2022-41542 · Other software · Devhubapp · reported by MITREMedium 5.4
devhub 0.102.0 was discovered to contain a broken session control.
- Product
- Devhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapp.devhubapp.comdevhubapp.com
Oct 14, 2022Cross-site Scripting (XSS) - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3.CVE-2022-3506 · Other software · barrykooij · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3.
- Product
- barrykooij/related-posts-for-wp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.CVE-2022-3439 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5.CVE-2022-3457 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.CVE-2022-3456 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2022Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.CVE-2022-3438 · Other software · ikus060 · reported by security@huntr.devMedium 6.1
Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022In sensorhub, there is a possible out of bounds write due to an incorrect calculation of buffer size.CVE-2022-26474 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In sensorhub, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07129717; Issue ID: ALPS07129717.
- Product
- MT6789, MT6855, MT6879, MT6895, MT6983
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Oct 7, 2022Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.CVE-2022-3423 · Other software · nocodb · reported by security@huntr.devHigh 7.3
Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.
- Product
- nocodb/nocodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022Path Traversal in GitHub repository ikus060/rdiffweb prior to 2.4.10.CVE-2022-3389 · Other software · ikus060 · reported by security@huntr.devHigh 7.5
Path Traversal in GitHub repository ikus060/rdiffweb prior to 2.4.10.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.