Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,964 results · page 377 of 780
Oct 30, 2023tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input daCVE-2023-47104 · Other software · vareille · reported by MITRECritical 9.8
tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input data. NOTE: this issue exists because of an incomplete fix for CVE-2020-36767, which only considered single and double quote characters.
- Product
- tinyfiledialogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Oct 30, 2023Ads by datafeedr.com: Remote Code ExecutionCVE-2023-5843 · WordPress plugins & themes · reported by WordfenceCritical 9
The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the 'dfads_ajax_load_ads' function. This allows unauthenticated attackers to execute code on the server. The parameters of the callable function are limited, they cannot be specified arbitrarily.
- Product
- Ads by datafeedr.com
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Ads by datafeedr.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2023The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' shoCVE-2023-5199 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to include local file and potentially execute code on the server. While subscribers may need to poison log files or otherwise get a file installed in order to achieve remote code execution, author and above users can upload files by default and achieve remote code execution easily.
- Affected
- up to 0.3
- What to do
- Affects up to 0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 30, 2023Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.CVE-2023-5832 · Other software · mintplex-labs · reported by security@huntr.devCritical 9.1
Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023A Buffer overflow vulnerability in DreamSecurity MagicLine4NX versions 1.0.0.1 to 1.0.0.26 allows an attacker to remotely execute code.CVE-2023-45797 · Other software · Dream Security · reported by vuln@krcert.or.krCritical 9.8
A Buffer overflow vulnerability in DreamSecurity MagicLine4NX versions 1.0.0.1 to 1.0.0.26 allows an attacker to remotely execute code.
- Product
- MagicLine4NX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2023When malicious images are pulled by isula pull, attackers can execute arbitrary code.CVE-2021-33635 · Other software · openEuler · reported by securities@openeuler.orgCritical 9.8
When malicious images are pulled by isula pull, attackers can execute arbitrary code.
- Product
- iSulad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2023Insufficient Session Expiration in GitHub repository linkstackorg/linkstack prior to v4.2.9.CVE-2023-5838 · Other software · linkstackorg · reported by security@huntr.devCritical 9.8
Insufficient Session Expiration in GitHub repository linkstackorg/linkstack prior to v4.2.9.
- Product
- linkstackorg/linkstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2023An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h.CVE-2023-46570 · Other software · Radare · reported by MITRECritical 9.8
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h.
- Product
- Radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 27, 2023An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-dis.h.CVE-2023-46569 · Other software · Radare · reported by MITRECritical 9.8
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-dis.h.
- Product
- Radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 27, 2023An issue in ZIONCOM (Hong Kong) Technology Limited A7000R v.4.1cu.4154 allows an attacker to execute arbitrary code via the cig-bin/cstecgi.cgi to the settings/CVE-2023-46510 · Other software · zioncom · reported by MITRECritical 9.8
An issue in ZIONCOM (Hong Kong) Technology Limited A7000R v.4.1cu.4154 allows an attacker to execute arbitrary code via the cig-bin/cstecgi.cgi to the settings/setPasswordCfg function.
- Product
- a7000r
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 27, 2023An issue in Contec SolarView Compact v.6.0 and before allows an attacker to execute arbitrary code via the texteditor.php component.CVE-2023-46509 · Other software · contec · reported by MITRECritical 9.8
An issue in Contec SolarView Compact v.6.0 and before allows an attacker to execute arbitrary code via the texteditor.php component.
- Product
- solarview_compact
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 27, 2023In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.CVE-2023-46853 · Other software · memcached · reported by MITRECritical 9.8
In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.
- Product
- memcached
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2023Apache ActiveMQ Deserialization of Untrusted Data VulnerabilityCVE-2023-46604 · Websites & servers · Apache · reported by security@apache.orgExploitedRansomwareCritical 10
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
- Product
- ActiveMQ
- On CISA’s list since
- Nov 2, 2023 (federal fix deadline Nov 23, 2023)
- What to do
- Attackers are using this now. Install Apache’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogseclists.orgactivemq.apache.org
Oct 27, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TRtek Software Education Portal allows SQL Injection.CVE-2023-5807 · Other software · TRtek Software · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TRtek Software Education Portal allows SQL Injection. This issue affects Education Portal: before 3.2023.29.
- Product
- Education Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Oct 27, 2023Thumbnail Slider With Lightbox: Cross-Site Request Forgery in version 1CVE-2023-5820 · WordPress plugins & themes · reported by WordfenceCritical 9.6
The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the addedit functionality. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Thumbnail Slider With Lightbox
- Affected
- 1.0 to 1.0
- What to do
- Affects 1.0 to 1.0. Update Thumbnail Slider With Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 27, 2023VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials.CVE-2023-45499 · Other software · Vinchin · reported by MITRECritical 9.8
VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials.
- Product
- Vinchin Backup And Recovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 27, 2023VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.CVE-2023-45498 · Other software · Vinchin · reported by MITRECritical 9.8
VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.
- Product
- Vinchin Backup And Recovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 26, 2023SQL injection vulnerability in D-Link Online behavior audit gateway DAR-7000 V31R02B1413C allows a remote attacker to obtain sensitive information and execute aCVE-2023-42406 · Network & remote access · d-link · reported by MITRECritical 9.8
SQL injection vulnerability in D-Link Online behavior audit gateway DAR-7000 V31R02B1413C allows a remote attacker to obtain sensitive information and execute arbitrary code via the editrole.php component.
- Product
- dar-7000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023An issue was discovered on certain ABUS TVIP cameras.CVE-2018-17879 · Other software · Abus · reported by MITRECritical 9.8
An issue was discovered on certain ABUS TVIP cameras. The CGI scripts allow remote attackers to execute code via system() as root. There are several injection points in various scripts.
- Product
- Tvip 10000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023Buffer Overflow vulnerability in certain ABUS TVIP cameras allows attackers to gain control of the program via crafted string sent to sprintf() function.CVE-2018-17878 · Other software · Abus · reported by MITRECritical 9.8
Buffer Overflow vulnerability in certain ABUS TVIP cameras allows attackers to gain control of the program via crafted string sent to sprintf() function.
- Product
- Tvip 10000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6.1CVE-2018-17558 · Other software · abus · reported by MITRECritical 9.8
Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6.18, TVIP11050 MG.1.6.03.05, TVIP20550 LM.1.6.18, TVIP10050 LM.1.6.18, TVIP11550 MG.1.6.03, TVIP21050 MG.1.6.03, and TVIP51550 MG.1.6.03 cameras allow remote attackers to execute code as root.
- Product
- tvip_72500_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023F5 BIG-IP Configuration Utility Authentication Bypass VulnerabilityCVE-2023-46747 · Network & remote access · F5 · reported by f5sirt@f5.comExploitedRansomwareCritical 9.8
F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.
- Product
- BIG-IP Configuration Utility
- On CISA’s list since
- Oct 31, 2023 (federal fix deadline Nov 21, 2023)
- What to do
- Attackers are using this now. Install F5’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.commy.f5.com
Oct 26, 2023 Sielco PolyEco1000 is vulnerable to an authentication bypass vulnerability due to an attacker modifying passwords in a POST request and gain unCVE-2023-46665 · Other software · Sielco · reported by ics-cert@hq.dhs.govCritical 9.8
Sielco PolyEco1000 is vulnerable to an authentication bypass vulnerability due to an attacker modifying passwords in a POST request and gain unauthorized access to the affected device with administrative privileges.
- Product
- PolyEco1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal.CVE-2023-39726 · Other software · Mintty Project · reported by MITRECritical 9.8
An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal.
- Product
- Mintty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023 Sielco PolyEco1000 uses a weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of theCVE-2023-5754 · Other software · Sielco · reported by ics-cert@hq.dhs.govCritical 9.1
Sielco PolyEco1000 uses a weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.
- Product
- PolyEco1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023 Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.CVE-2023-46661 · Other software · Sielco · reported by ics-cert@hq.dhs.govCritical 9.8
Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.
- Product
- PolyEco1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-44267 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'lnm' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Online Art Gallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023NextGen Healthcare Mirth Connect Deserialization of Untrusted Data VulnerabilityCVE-2023-43208 · Other software · NextGen Healthcare · reported by MITREExploitedRansomwareCritical 9.8
NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request.
- Product
- Mirth Connect
- On CISA’s list since
- May 20, 2024 (federal fix deadline Jun 10, 2024)
- What to do
- Attackers are using this now. Install NextGen Healthcare’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comhorizon3.ai
Oct 26, 2023The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass autheCVE-2023-42769 · Other software · Sielco · reported by ics-cert@hq.dhs.govCritical 9.8
The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass authentication, and manipulate the transmitter.
- Product
- Analog FM transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS CVE-2023-45869 · Other software · Ilias · reported by MITRECritical 9
ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of the ilUtil class (/Services/Utilities/classes/class.ilUtil.php) This allows attackers to inject malicious commands into the system, potentially compromising the integrity, confidentiality, and availability of the ILIAS installation and the underlying operating system.
- Product
- Ilias
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrehmeinfosec.derehmeinfosec.de
Oct 25, 2023An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error.CVE-2023-31422 · Other software · Elastic · reported by security@elastic.coCritical 9
An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the %meta pattern. Elastic has released Kibana 8.10.1 which resolves this issue. The error object recorded in the log contains request information, which can include sensitive data, such as authentication credentials, cookies, authorization headers, query params, request paths, and other metadata. Some examples of sensitive data which can be included in the logs are account credentials for kibana_system, kibana-metricbeat, or Kibana end-users.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.coelastic.co
Oct 25, 2023Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files CVE-2023-30967 · Other software · Palantir · reported by cve-coordination@palantir.comCritical 9.8
Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files on the file system.
- Product
- com.palantir.meta:orbital-simulator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Oct 25, 2023crypto-js is a JavaScript library of crypto standards.CVE-2023-46233 · Other software · brix · reported by GitHubCritical 9.1
crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.
- Product
- crypto-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript.CVE-2023-46133 · Other software · entronad · reported by GitHubCritical 9.1
CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 2.1.0 contains a patch for this issue. As a workaround, configure CryptoES to use SHA256 with at least 250,000 iterations.
- Product
- crypto-es
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2023-45137 · Other software · xwiki · reported by GitHubCritical 9
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. `org.xwiki.platform:xwiki-platform-web` starting in version 3.1-milestone-2 and prior to version 13.4-rc-1, as well as `org.xwiki.platform:xwiki-platform-web-templates` prior to versions 14.10.12 and 15.5-rc-1, are vulnerable to cross-site scripting. When trying to create a document that already exists, XWiki displays an error message in the form for creating it. Due to missing escaping, this error message is vulnerable to raw HTML injection and thus XSS. The injected code is the document reference of the existing document so this requires that the attacker first creates a non-empty document whose name contains the attack code. This has been patched in `org.xwiki.platform:xwiki-platform-web` version 13.4-rc-1 and `org.xwiki.platform:xwiki-platform-web-templates` versions 14.10.12 and 15.5-rc-1 by adding the appropriate escaping. The vulnerable template file `createinline.vm` is part of XWiki's WAR and can be patched by manually applying the changes from the fix.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_422BD4 function.CVE-2023-46424 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_422BD4 function.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_417094 function.CVE-2023-46423 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_417094 function.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411994 function.CVE-2023-46422 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411994 function.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411D00 function.CVE-2023-46421 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411D00 function.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41590C function.CVE-2023-46420 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41590C function.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415730 function.CVE-2023-46419 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415730 function.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_412688 function.CVE-2023-46418 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_412688 function.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415498 function.CVE-2023-46417 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415498 function.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 function.CVE-2023-46416 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 function.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41E588 function.CVE-2023-46415 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41E588 function.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ 41D494 function.CVE-2023-46414 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ 41D494 function.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_4155DC function.CVE-2023-46413 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_4155DC function.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_41D998 function.CVE-2023-46412 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_41D998 function.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_415258 function.CVE-2023-46411 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_415258 function.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 416F60 function.CVE-2023-46410 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 416F60 function.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.