Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,050 results · page 38 of 61
Oct 6, 2022Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.CVE-2022-3376 · Other software · ikus060 · reported by security@huntr.devMedium 5.3
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.CVE-2022-3273 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-3002 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2022Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.CVE-2022-3371 · Other software · ikus060 · reported by security@huntr.devHigh 7.5
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2022Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0.CVE-2022-2922 · Other software · dnnsoftware · reported by security@huntr.devMedium 4.9
Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0.
- Product
- dnnsoftware/dnn.platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2022Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.CVE-2022-3364 · Other software · ikus060 · reported by security@huntr.devHigh 7.5
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2022Use After Free in GitHub repository vim/vim prior to 9.0.0614.CVE-2022-3352 · Other software · vim · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository vim/vim prior to 9.0.0614.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2022Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3.CVE-2022-3355 · Other software · inventree · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3.
- Product
- inventree/inventree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959.CVE-2022-1725 · Other software · vim · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Sep 28, 2022Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2.CVE-2022-1719 · Other software · polonel · reported by security@huntr.devMedium 5.4
Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript code in web page
- Product
- polonel/trudesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9.CVE-2022-3326 · Other software · ikus060 · reported by security@huntr.devMedium 4.3
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.CVE-2022-3292 · Other software · ikus060 · reported by security@huntr.devMedium 4.6
Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2022Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598.CVE-2022-3324 · Other software · vim · reported by security@huntr.devHigh 7.8
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.CVE-2022-3298 · Other software · ikus060 · reported by security@huntr.devHigh 7.5
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.CVE-2022-3290 · Other software · ikus060 · reported by security@huntr.devHigh 7.5
Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.CVE-2022-3272 · Other software · ikus060 · reported by security@huntr.devHigh 7.5
Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Use after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HCVE-2022-3042 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Sep 26, 2022Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.CVE-2022-3295 · Other software · ikus060 · reported by security@huntr.devHigh 7.5
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Improper Cleanup on Thrown Exception in GitHub repository ikus060/rdiffweb prior to 2.4.8.CVE-2022-3301 · Other software · ikus060 · reported by security@huntr.devLow 2.4
Improper Cleanup on Thrown Exception in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2022Use After Free in GitHub repository vim/vim prior to 9.0.0579.CVE-2022-3297 · Other software · vim · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository vim/vim prior to 9.0.0579.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2022Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.CVE-2022-3296 · Other software · vim · reported by security@huntr.devHigh 7.8
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552.CVE-2022-3278 · Other software · vim · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.CVE-2022-3269 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.7.CVE-2022-3274 · Other software · ikus060 · reported by security@huntr.devLow 3.5
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.7.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022Use After Free in GitHub repository vim/vim prior to 9.0.0530.CVE-2022-3256 · Other software · vim · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository vim/vim prior to 9.0.0530.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2.CVE-2022-3268 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2.
- Product
- ikus060/minarca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6.CVE-2022-3267 · Other software · ikus060 · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6.CVE-2022-3233 · Other software · ikus060 · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2.CVE-2022-3251 · Other software · ikus060 · reported by security@huntr.devMedium 5.3
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2.
- Product
- ikus060/minarca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6.CVE-2022-3250 · Other software · ikus060 · reported by security@huntr.devMedium 5.3
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause, CVE-2022-41239 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
- Product
- Jenkins DotCi Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.CVE-2022-3068 · Other software · octoprint · reported by security@huntr.devHigh 8.8
Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.
- Product
- octoprint/octoprint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.CVE-2022-2872 · Other software · octoprint · reported by security@huntr.devMedium 5.4
Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.
- Product
- octoprint/octoprint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022Code Injection in GitHub repository microweber/microweber prior to 1.3.2.CVE-2022-3242 · Other software · microweber · reported by security@huntr.devMedium 6.1
Code Injection in GitHub repository microweber/microweber prior to 1.3.2.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-3005 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-3004 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-3000 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3.CVE-2022-2924 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2022Use After Free in GitHub repository vim/vim prior to 9.0.0490.CVE-2022-3235 · Other software · vim · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository vim/vim prior to 9.0.0490.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2022Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483.CVE-2022-3234 · Other software · vim · reported by security@huntr.devHigh 7.8
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2022Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.5.CVE-2022-3232 · Other software · ikus060 · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.5.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2022Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.9.0.CVE-2022-3231 · Other software · librenms · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.9.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2022Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.CVE-2022-3173 · Other software · snipe · reported by security@huntr.devMedium 4.3
Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV.CVE-2022-39217 · Other software · some-natalie · reported by GitHubMedium 5.8
some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. This issue has been addressed in version `v1`. Users are advised to use `v1` or later. There are no known workarounds for this issue.
- Product
- ghas-to-csv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20.CVE-2022-3225 · Other software · budibase · reported by security@huntr.devHigh 8.8
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20.
- Product
- budibase/budibase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1.CVE-2022-3223 · Other software · jgraph · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C.CVE-2022-39209 · Other software · github · reported by GitHubHigh 7.5
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.
- Product
- cmark-gfm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.wikipedia.orggithub.com
Sep 15, 2022The login form /Login in ECi Printanista Hub (formerly FMAudit Printscout) before 5.5.2 (July 2023) performs expensive RSA key-generation operations, which alloCVE-2022-40306 · Other software · Ecisolutions · reported by MITREMedium 5.9
The login form /Login in ECi Printanista Hub (formerly FMAudit Printscout) before 5.5.2 (July 2023) performs expensive RSA key-generation operations, which allows attackers to cause a denial of service (DoS) by requesting that form repeatedly.
- Product
- Printanista Managed Print Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordreleasenotes.printanista.netecisolutions.com
Sep 15, 2022Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.6.CVE-2022-3211 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.6.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0.CVE-2022-3224 · Other software · ionicabizau · reported by security@huntr.devMedium 6.1
Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0.
- Product
- ionicabizau/parse-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.