Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,964 results · page 373 of 780
Nov 20, 2023Five Star Restaurant Menu and Food Ordering: Unserializes user input via an AJAX action available to unauthenticated usersCVE-2023-5340 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX action available to unauthenticated users, allowing them to perform PHP Object Injection when a suitable gadget is present on the blog.
- Product
- Five Star Restaurant Menu and Food Ordering
- Fixed in
- 2.4.11
- What to do
- Update Five Star Restaurant Menu and Food Ordering to 2.4.11 or newer.
Nov 20, 2023The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality.CVE-2023-38880 · Other software · Os4ed · reported by MITRECritical 9.8
The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality. Whenever an admin generates a database backup, the backup is stored in the web root while the file name has a format of "opensisBackup<date>.sql" (e.g. "opensisBackup07-20-2023.sql"), i.e. can easily be guessed. This file can be accessed by any unauthenticated actor and contains a dump of the whole database including password hashes.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023The XWiki Admin Tools Application provides tools to help the administration of XWiki.CVE-2023-48292 · Other software · xwiki-contrib · reported by GitHubCritical 9.6
The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker to execute arbitrary shell commands by tricking an admin into loading the URL with the shell command. A very simple possibility for an attack are comments. When the attacker can leave a comment on any page in the wiki it is sufficient to include an image with an URL like `/xwiki/bin/view/Admin/RunShellCommand?command=touch%20/tmp/attacked` in the comment. When an admin views the comment, the file `/tmp/attacked` will be created on the server. The output of the command is also vulnerable to XWiki syntax injection which offers a simple way to execute Groovy in the context of the XWiki installation and thus an even easier way to compromise the integrity and confidentiality of the whole XWiki installation. This has been patched by adding a form token check in version 4.5.1 of the admin tools. Some workarounds are available. The patch can be applied manually to the affected wiki pages. Alternatively, the document `Admin.RunShellC
- Product
- application-admintools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023XWiki Platform is a generic wiki platform.CVE-2023-48240 · Other software · xwiki · reported by GitHubCritical 9
XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actually unchanged image. For this, XWiki requests all embedded images on the server side. These requests are also sent for images from other domains and include all cookies that were sent in the original request to ensure that images with restricted view right can be compared. Starting in version 11.10.1 and prior to versions 14.10.15, 15.5.1, and 15.6, this allows an attacker to steal login and session cookies that allow impersonating the current user who views the diff. The attack can be triggered with an image that references the rendered diff, thus making it easy to trigger. Apart from stealing login cookies, this also allows server-side request forgery (the result of any successful request is returned in the image's source) and viewing protected content as once a resource is cached, it is returned for all users. As only successful requests are cached, the cache will be filled by the first user who is allowed to access the resource. This has been patched in XWiki 14.10.15, 15.5.1 and 15.6. The rendered diff now only download
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023 Versions of INEA ME RTU firmware 3.36b and prior are vulnerable to operating system (OS) command injection, which could allow remote code execution.CVE-2023-35762 · Other software · INEA · reported by ics-cert@hq.dhs.govCritical 9.9
Versions of INEA ME RTU firmware 3.36b and prior are vulnerable to operating system (OS) command injection, which could allow remote code execution.
- Product
- ME RTU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023Versions of INEA ME RTU firmware 3.36b and prior do not require authentication to the "root" account on the host system of the device.CVE-2023-29155 · Other software · INEA · reported by ics-cert@hq.dhs.govCritical 9.8
Versions of INEA ME RTU firmware 3.36b and prior do not require authentication to the "root" account on the host system of the device. This could allow an attacker to obtain admin-level access to the host system.
- Product
- ME RTU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023Apache Software Foundation Apache Submarine has a bug when serializing against yaml.CVE-2023-46302 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 . Apache Submarine uses JAXRS to define REST endpoints. In order to handle YAML requests (using application/yaml content-type), it defines a YamlEntityProvider entity provider that will process all incoming YAML requests. In order to unmarshal the request, the readFrom method is invoked, passing the entityStream containing the user-supplied data in `submarine-server/server-core/src/main/java/org/apache/submarine/server/utils/YamlUtils.java`. We have now fixed this issue in the new version by replacing to `jackson-dataformat-yaml`. This issue affects Apache Submarine: from 0.7.0 before 0.8.0. Users are recommended to upgrade to version 0.8.0, which fixes this issue. If using the version smaller than 0.8.0 and not want to upgrade, you can try cherry-pick PR https://github.com/apache/submarine/pull/1054 and rebuild the submart-server image to fix this.
- Product
- Apache Submarine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comissues.apache.org
Nov 20, 2023A cleverly devised username might bypass LDAP authentication checks.CVE-2022-46337 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the attacker to execute malware which was visible to and executable by the account which booted the Derby server. In LDAP-protected databases which weren't also protected by SQL GRANT/REVOKE authorization, this vulnerability could also let an attacker view and corrupt sensitive data and run sensitive database functions and procedures. Mitigation: Users should upgrade to Java 21 and Derby 10.17.1.0. Alternatively, users who wish to remain on older Java versions should build their own Derby distribution from one of the release families to which the fix was backported: 10.16, 10.15, and 10.14. Those are the releases which correspond, respectively, with Java LTS versions 17, 11, and 8.
- Product
- Apache Derby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Nov 20, 2023SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauCVE-2023-46700 · Other software · LuxSoft · reported by vultures@jpcert.or.jpCritical 9.8
SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request, and obtain or alter information stored in the database.
- Product
- LuxCal Web Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023kodbox 1.46.01 has a security flaw that enables user enumeration.CVE-2023-48028 · Other software · Kodcloud · reported by MITRECritical 9.8
kodbox 1.46.01 has a security flaw that enables user enumeration. This problem is present on the login page, where an attacker can identify valid users based on varying response messages, potentially paving the way for a brute force attack.
- Product
- Kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comnitipoom-jar.github.io
Nov 17, 2023CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.CVE-2023-43177 · Other software · Crushftp · reported by MITRECritical 9.8
CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.
- Product
- Crushftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconvergetp.comgithub.com
Nov 17, 2023Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result inCVE-2023-44353 · Websites & servers · Adobe · reported by AdobeCritical 9.8
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
- Product
- ColdFusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Nov 17, 2023Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result inCVE-2023-44351 · Websites & servers · Adobe · reported by AdobeCritical 9.8
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
- Product
- ColdFusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Nov 17, 2023Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result inCVE-2023-44350 · Websites & servers · Adobe · reported by AdobeCritical 9.8
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
- Product
- ColdFusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Nov 17, 2023Adobe FrameMaker Publishing Server versions 2022 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature byCVE-2023-44324 · Other software · Adobe · reported by AdobeCritical 9.8
Adobe FrameMaker Publishing Server versions 2022 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An unauthenticated attacker can abuse this vulnerability to access the API and leak default admin's password. Exploitation of this issue does not require user interaction.
- Product
- Adobe Framemaker Publishing Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Nov 17, 2023Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject aCVE-2023-47797 · Other software · Liferay · reported by security@liferay.comCritical 9.6
Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script or HTML via the `p_l_back_url_title` parameter.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordliferay.devliferay.dev
Nov 17, 2023An issue was discovered in the captive portal in OpenNDS before version 10.1.3.CVE-2023-41101 · Other software · Opennds · reported by MITRECritical 9.8
An issue was discovered in the captive portal in OpenNDS before version 10.1.3. get_query in http_microhttpd.c does not validate the length of the query string of GET requests. This leads to a stack-based buffer overflow in versions 9.x and earlier, and to a heap-based buffer overflow in versions 10.x and later. Attackers may exploit the issue to crash OpenNDS (Denial-of-Service condition) or to inject and execute arbitrary bytecode (Remote Code Execution). Affected OpenNDS before version 10.1.3 fixed in OpenWrt master and OpenWrt 23.05 on 23. November by updating OpenNDS to version 10.2.0.
- Product
- Opennds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023An issue was discovered in OpenNDS Captive Portal before version 10.1.2.CVE-2023-38316 · Other software · Opennds · reported by MITRECritical 9.8
An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL portion of HTTP GET requests. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3.
- Product
- Captive Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023An issue was discovered in MISP before 2.4.176.CVE-2023-48659 · Other software · Misp-project · reported by MITRECritical 9.8
An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023An issue was discovered in MISP before 2.4.176.CVE-2023-48658 · Other software · Misp-project · reported by MITRECritical 9.8
An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023An issue was discovered in MISP before 2.4.176.CVE-2023-48657 · Other software · Misp-project · reported by MITRECritical 9.8
An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023An issue was discovered in MISP before 2.4.176.CVE-2023-48656 · Other software · Misp-project · reported by MITRECritical 9.8
An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023An issue was discovered in MISP before 2.4.176.CVE-2023-48655 · Other software · Misp-project · reported by MITRECritical 9.8
An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions.CVE-2023-48648 · Other software · concretecms · reported by MITRECritical 9.8
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified.
- Product
- concrete_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orgdocumentation.concretecms.org
Nov 16, 2023OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type.CVE-2023-48031 · Other software · opensupports · reported by MITRECritical 9.8
OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions and upload a .bat file by manipulating the file's magic bytes to masquerade as an allowed type. This can enable the attacker to execute arbitrary code or establish a reverse shell, leading to unauthorized file writes or control over the victim's station via a crafted file upload operation.
- Product
- opensupports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugplorer.github.ionitipoom-jar.github.io
Nov 16, 2023In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5.0.0 from MyPrestaModules for PrestaShop, a guest can perform SCVE-2023-45387 · Other software · Myprestamodules · reported by MITRECritical 9.8
In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5.0.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection via `exportProduct::_addDataToDb().`
- Product
- Exportproducts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurity.friendsofpresta.org
Nov 16, 2023SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' parameter.CVE-2023-48078 · Other software · code-projects · reported by MITRECritical 9.8
SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' parameter.
- Product
- simple_crud_functionality
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.CVE-2023-6014 · Other software · mlflow · reported by security@huntr.devCritical 9.8
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.
- Product
- mlflow/mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely withouCVE-2023-6019 · Other software · ray-project · reported by security@huntr.devCritical 9.8
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
- Product
- ray-project/ray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023An attacker can overwrite any file on the server hosting MLflow without any authentication.CVE-2023-6018 · Other software · mlflow · reported by security@huntr.devCritical 9.8
An attacker can overwrite any file on the server hosting MLflow without any authentication.
- Product
- mlflow/mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.CVE-2023-6016 · Other software · h2oai · reported by security@huntr.devCritical 9.8
An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuCVE-2023-47674 · Other software · First Co., Ltd. · reported by vultures@jpcert.or.jpCritical 9.8
Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.
- Product
- CFR-904E, CFR-908E, CFR-916E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the CVE-2023-47213 · Other software · First Co., Ltd. · reported by vultures@jpcert.or.jpCritical 9.8
First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.
- Product
- CFR-904E, CFR-908E, CFR-916E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023An issue in RedisGraph v.2.12.10 allows an attacker to execute arbitrary code and cause a denial of service via a crafted string in DataBlock_ItemIsDeleted.CVE-2023-47003 · Other software · redislabs · reported by MITRECritical 9.8
An issue in RedisGraph v.2.12.10 allows an attacker to execute arbitrary code and cause a denial of service via a crafted string in DataBlock_ItemIsDeleted.
- Product
- redisgraph
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023SQL injection vulnerability in LMXCMS v.1.4 allows attacker to execute arbitrary code via the TagsAction.class.CVE-2021-35437 · Other software · Lmxcms · reported by MITRECritical 9.8
SQL injection vulnerability in LMXCMS v.1.4 allows attacker to execute arbitrary code via the TagsAction.class.
- Product
- Lmxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2023Qlik Sense HTTP Tunneling VulnerabilityCVE-2023-48365 · Other software · Qlik · reported by MITREExploitedRansomwareCritical 9.6
Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
- Product
- Sense
- On CISA’s list since
- Jan 13, 2025 (federal fix deadline Feb 3, 2025)
- What to do
- Attackers are using this now. Install Qlik’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcommunity.qlik.comcommunity.qlik.com
Nov 15, 2023An issue in Kloudq Technologies Limited Tor Equip 1.0, Tor Loco Mini 1.0 through 3.1 allows a remote attacker to execute arbitrary code via a crafted request toCVE-2023-41442 · Other software · Kloudq · reported by MITRECritical 9.8
An issue in Kloudq Technologies Limited Tor Equip 1.0, Tor Loco Mini 1.0 through 3.1 allows a remote attacker to execute arbitrary code via a crafted request to the MQTT component.
- Product
- TOR Loco MIN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwriteups.ayyappan.mewriteups.ayyappan.me
Nov 15, 2023Pre-School Enrollment version 1.0 is vulnerable to SQL Injection via the username parameter in preschool/admin/ page.CVE-2023-47445 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Pre-School Enrollment version 1.0 is vulnerable to SQL Injection via the username parameter in preschool/admin/ page.
- Product
- Pre-school Enrollment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023An improper access control vulnerability exists in RT-AC87U all versions.CVE-2023-47678 · Network & remote access · ASUSTeK COMPUTER INC. · reported by vultures@jpcert.or.jpCritical 9.1
An improper access control vulnerability exists in RT-AC87U all versions. An attacker may read or write files that are not intended to be accessed by connecting to a target device via tftp.
- Product
- RT-AC87U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023In the module "Newsletter Popup PRO with Voucher/Coupon code" (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL inCVE-2023-47308 · Websites & servers · prestashop · reported by MITRECritical 9.8
In the module "Newsletter Popup PRO with Voucher/Coupon code" (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL injection in affected versions. The method `NewsletterpopsendVerificationModuleFrontController::checkEmailSubscription()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
- Product
- newsletter_popup_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023ETS Soft ybc_blog before v4.4.0 was discovered to contain a SQL injection vulnerability via the component Ybc_blogBlogModuleFrontController::getPosts().CVE-2023-43979 · Other software · Prestahero · reported by MITRECritical 9.8
ETS Soft ybc_blog before v4.4.0 was discovered to contain a SQL injection vulnerability via the component Ybc_blogBlogModuleFrontController::getPosts().
- Product
- YBC Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Nov 14, 2023A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extractCVE-2023-39337 · Network & remote access · Ivanti · reported by support@hackerone.comCritical 9.1
A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extract sensitive information, including device and environment configuration details, as well as secrets. This vulnerability poses a serious security risk, potentially exposing confidential data and system integrity.
- Product
- EPMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
Nov 14, 2023A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to impersonate any existinCVE-2023-39335 · Network & remote access · Ivanti · reported by support@hackerone.comCritical 9.8
A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to impersonate any existing user during the device enrollment process. This issue poses a significant security risk, as it enables unauthorized access and potential misuse of user accounts and resources.
- Product
- EPMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
Nov 14, 2023There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution by sending specially CVE-2023-45616 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Ser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Nov 14, 2023There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted paCVE-2023-45615 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Ser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Nov 14, 2023There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted paCVE-2023-45614 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Ser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Nov 14, 2023VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from an older versiCVE-2023-34060 · Other software · VMware · reported by security@vmware.comCritical 9.8
VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from an older version. On an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with network access to the appliance can bypass login restrictions when authenticating on port 22 (ssh) or port 5480 (appliance management console) . This bypass is not present on port 443 (VCD provider and tenant login). On a new installation of VMware Cloud Director Appliance 10.5, the bypass is not present. VMware Cloud Director Appliance is impacted since it uses an affected version of sssd from the underlying Photon OS. The sssd issue is no longer present in versions of Photon OS that ship with sssd-2.8.1-11 or higher (Photon OS 3) or sssd-2.8.2-9 or higher (Photon OS 4 and 5).
- Product
- Cloud Director
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to potentially enable escalation of privilege via nCVE-2023-31273 · Other software · Intel · reported by secure@intel.comCritical 10
Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
- Product
- Data Center Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Improper input validation in the SMM Supervisor may allow an attacker with a compromised SMI handler to gain Ring0 access potentially leading to arbitrary code CVE-2023-20596 · Other software · AMD · reported by psirt@amd.comCritical 9.8
Improper input validation in the SMM Supervisor may allow an attacker with a compromised SMI handler to gain Ring0 access potentially leading to arbitrary code execution.
- Product
- Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics Formerly codenamed “Cezanne” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution.CVE-2022-23821 · Other software · AMD · reported by psirt@amd.comCritical 9.8
Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution.
- Product
- Ryzen™ 3000 Series Desktop Processors “Matisse”
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.