Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,672 results · page 38 of 54
May 23, 2023The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can result in an out-of-bCVE-2023-23306 · Other software · Garmin · reported by MITRECritical 9.8
The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can result in an out-of-bounds write operation. A malicious application could create a specially crafted `Toybox.Ant.BurstPayload` object, call its `add` method, override arbitrary memory and hijack the execution of the device's firmware.
- Product
- Connect-iq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.garmin.comgithub.com
May 16, 2023A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload iCVE-2023-31544 · Other software · Alkacon · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module.
- Product
- Opencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections via a crafted payload.CVE-2023-29819 · Other software · Webroot · reported by MITREMedium 5.5
An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections via a crafted payload.
- Product
- Secureanywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspenceralessi.comspenceralessi.com
May 9, 2023Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes CVE-2023-31807 · Other software · Chamilo · reported by MITREMedium 5.4
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes function.
- Product
- Chamilo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.chamilo.orgsupport.chamilo.org
May 9, 2023Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress funCVE-2023-31806 · Other software · Chamilo · reported by MITREMedium 5.4
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress function.
- Product
- Chamilo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.chamilo.orgsupport.chamilo.org
May 9, 2023Sngrep v1.6.0 was discovered to contain a stack buffer overflow via the function packet_set_payload at /src/packet.c.CVE-2023-31981 · Other software · Irontec · reported by MITREHigh 7.8
Sngrep v1.6.0 was discovered to contain a stack buffer overflow via the function packet_set_payload at /src/packet.c.
- Product
- Sngrep
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4118 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin through 1.7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by authenticated users
- Product
- Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 4, 2023A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected iCVE-2023-30094 · Other software · Totaljs · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module.
- Product
- Flow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comedoardoottavianelli.it
May 4, 2023A stored cross-site scripting (XSS) vulnerability in Typecho v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected intCVE-2023-30184 · Other software · Typecho · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Typecho v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter at /index.php/archives/1/comment.
- Product
- Typecho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2023An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload.CVE-2023-30331 · Other software · Beetl Project · reported by MITRECritical 9.8
An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload.
- Product
- Beetl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2023A stored cross-site scripting (XSS) vulnerability in DouPHP v1.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into tCVE-2023-30205 · Other software · Douphp · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in DouPHP v1.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the unique_id parameter in /admin/article.php.
- Product
- Douphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2023Quick Paypal Payments: Does not sanitise and escape some of its settingsCVE-2023-1554 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Quick Paypal Payments
- Fixed in
- 5.7.26.4
- What to do
- Update Quick Paypal Payments to 5.7.26.4 or newer.
Apr 27, 2023IBM Counter Fraud Management for Safer Payments 6.1.0.00 through 6.1.1.02, 6.2.0.00 through 6.2.2.02, 6.3.0.00 through 6.3.1.02, 6.4.0.00 through 6.4.2.01, and CVE-2023-27557 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Counter Fraud Management for Safer Payments 6.1.0.00 through 6.1.1.02, 6.2.0.00 through 6.2.2.02, 6.3.0.00 through 6.3.1.02, 6.4.0.00 through 6.4.2.01, and 6.5.0.00 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 249192.
- Product
- Safer Payments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 27, 2023IBM Counter Fraud Management for Safer Payments 5.7.0.00 through 5.7.0.10, 6.0.0.00 through 6.0.0.07, 6.1.0.00 through 6.1.0.05, and 6.2.0.00 through 6.2.1.00 cCVE-2020-4729 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Counter Fraud Management for Safer Payments 5.7.0.00 through 5.7.0.10, 6.0.0.00 through 6.0.0.07, 6.1.0.00 through 6.1.0.05, and 6.2.0.00 through 6.2.1.00 could allow an authenticated attacker under special circumstances to send multiple specially crafted API requests that could cause the application to crash. IBM X-Force ID: 188052.
- Product
- Safer Payments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 27, 2023IBM Counter Fraud Management for Safer Payments 6.1.0.00, 6.2.0.00, 6.3.0.00 through 6.3.1.03, 6.4.0.00 through 6.4.2.02 and 6.5.0.00 does not properly allocateCVE-2023-27556 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Counter Fraud Management for Safer Payments 6.1.0.00, 6.2.0.00, 6.3.0.00 through 6.3.1.03, 6.4.0.00 through 6.4.2.02 and 6.5.0.00 does not properly allocate resources without limits or throttling which could allow a remote attacker to cause a denial of service. IBM X-Force ID: 249190.
- Product
- Safer Payments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 27, 2023Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload iCVE-2023-30338 · Other software · Emlog · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Article Title or Article Summary parameters.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Payload is a free and open source headless content management system.CVE-2023-30843 · Other software · payloadcms · reported by GitHubHigh 7.4
Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the CCVE-2022-27979 · Other software · Tooljet · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component.
- Product
- Tooljet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized paCVE-2021-23178 · Other software · Odoo · reported by security@odoo.comHigh 7.5
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized payment method that belongs to another user, causing the victim's payment method to be charged instead.
- Product
- Odoo Community
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023A cross-site scripting (XSS) vulnerability in Pear-Admin-Boot up to v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2023-30417 · Other software · Pearadmin · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Pear-Admin-Boot up to v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title of a private message.
- Product
- Pear Admin Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in TriniTronic Nice PayPal Button Lite plugin <= 1.3.5 versions.CVE-2023-22686 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in TriniTronic Nice PayPal Button Lite plugin <= 1.3.5 versions.
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 19, 2023Pay is a payments engine for Ruby on Rails 6.0 and higher.CVE-2023-30614 · Other software · pay-rails · reported by GitHubHigh 7.1
Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- pay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Book/Internal Transfer).CVE-2023-21915 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.6
Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Book/Internal Transfer). Supported versions that are affected are 14.5, 14.6 and 14.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Payments. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Payments accessible data as well as unauthorized read access to a subset of Oracle Banking Payments accessible data. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N).
- Product
- Banking Payments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software and force the OS to bCVE-2023-26980 · Other software · paxtechnology · reported by MITREHigh 7
PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software and force the OS to boot directly to Android during the boot process. NOTE: the vendor disputes this because the attack is not feasible: the home launcher will be loaded before any user applications.
- Product
- a920_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comdrive.google.com
Apr 12, 2023An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated usCVE-2023-28121 · WordPress plugins & themes · reported by support@hackerone.comCritical 9.8
An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recorddeveloper.woocommerce.comrcesecurity.com
Apr 12, 2023A stored HTML injection vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary code via a crafted payload.CVE-2023-27775 · Other software · Liveaction · reported by MITREMedium 5.4
A stored HTML injection vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary code via a crafted payload.
- Product
- Livesp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected inCVE-2023-26847 · Other software · Opencats · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the state parameter at opencats/index.php?m=candidates.
- Product
- Opencats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopencats.org
Apr 11, 2023A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected inCVE-2023-26846 · Other software · Opencats · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the city parameter at opencats/index.php?m=candidates.
- Product
- Opencats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopencats.org
Apr 4, 2023Cross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login parameter.CVE-2023-27089 · Other software · Ehuacui-bbs Project · reported by MITREHigh 8.2
Cross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login parameter.
- Product
- Ehuacui-bbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023Cross Site Scripting vulnerability found in ZblogCN ZblogPHP v.1.0 allows a local attacker to execute arbitrary code via a crafted payload in title parameter ofCVE-2020-23327 · Other software · Zblogcn · reported by MITREMedium 6.1
Cross Site Scripting vulnerability found in ZblogCN ZblogPHP v.1.0 allows a local attacker to execute arbitrary code via a crafted payload in title parameter of the module management model.
- Product
- Zblogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2023BluePage CMS thru v3.9 processes an insufficiently sanitized HTTP Header allowing MySQL Injection in the 'User-Agent' field using a Time-based blind SLEEP payloCVE-2022-38923 · Other software · Iss-oberlausitz · reported by MITRECritical 9.8
BluePage CMS thru v3.9 processes an insufficiently sanitized HTTP Header allowing MySQL Injection in the 'User-Agent' field using a Time-based blind SLEEP payload.
- Product
- Bluepage CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.combluepage-cms.com
Mar 31, 2023PrestaShop/paypal is an open source module for the PrestaShop web commerce ecosystem which provides paypal payment support.CVE-2023-28843 · Other software · 202ecommerce · reported by GitHubCritical 9.8
PrestaShop/paypal is an open source module for the PrestaShop web commerce ecosystem which provides paypal payment support. A SQL injection vulnerability found in the PrestaShop paypal module from release from 3.12.0 to and including 3.16.3 allow a remote attacker to gain privileges, modify data, and potentially affect system availability. The cause of this issue is that SQL queries were being constructed with user input which had not been properly filtered. Only deployments on PrestaShop 1.6 are affected. Users are advised to upgrade to module version 3.16.4. There are no known workarounds for this vulnerability.
- Product
- paypal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), CVE-2023-28462 · Other software · Payara · reported by MITRECritical 9.8
A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), when Java 1.8u181 and earlier is used, allows remote attackers to load malicious code on the server once a JNDI directory scan is performed.
- Product
- Payara Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.payara.fishblog.payara.fish
Mar 27, 2023A cross-site scripting (XSS) vulnerability in File Management Project 1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injeCVE-2023-27245 · Other software · File Management System Project · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in File Management Project 1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Edit User module.
- Product
- File Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions.CVE-2022-47145 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions.
- Fixed in
- 3.5.8
- What to do
- Update the plugin to 3.5.8 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 22, 2023A cross-site scripting (XSS) vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadCVE-2023-27054 · Other software · Mirotalk · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the settings module.
- Product
- Mirotalk P2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.CVE-2022-45003 · Other software · Getgophish · reported by MITREHigh 7.5
Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.
- Product
- Gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compastebin.com
Mar 21, 2023A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentiaCVE-2023-27978 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.8
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
- Product
- IGSS Data Server(IGSSdataServer.exe)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Mar 15, 2023IBM Financial Transaction Manager for High Value Payments for Multi-Platform 3.2.0 through 3.2.10 allows web pages to be stored locally which can be read by anoCVE-2020-4556 · Other software · IBM · reported by psirt@us.ibm.comMedium 4
IBM Financial Transaction Manager for High Value Payments for Multi-Platform 3.2.0 through 3.2.10 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 183329.
- Product
- Financial Transaction Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 13, 2023OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload.CVE-2023-25279 · Other software · Dlink · reported by MITRECritical 9.8
OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload.
- Product
- Dir-820l Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2023A vulnerability was found in ICEPAY REST-API-NET 0.9.CVE-2016-15028 · Other software · ICEPAY · reported by VulDBMedium 4.8
A vulnerability was found in ICEPAY REST-API-NET 0.9. It has been declared as problematic. Affected by this vulnerability is the function RestClient of the file Classes/RestClient.cs of the component Checksum Validation. The manipulation leads to improper validation of integrity check value. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.0 is able to address this issue. The patch is named 61f6b8758e5c971abff5f901cfa9f231052b775f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222847.
- Product
- REST-API-NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Memory corruption in WLAN HAL while arbitrary value is passed in WMI UTF command payload.CVE-2022-25655 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Memory corruption in WLAN HAL while arbitrary value is passed in WMI UTF command payload.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Mar 8, 2023Cross-site Scripting in GitHub repository btcpayserver/btcpayserver prior to 1.8.3.CVE-2023-1270 · Other software · btcpayserver · reported by security@huntr.devMedium 5.4
Cross-site Scripting in GitHub repository btcpayserver/btcpayserver prior to 1.8.3.
- Product
- btcpayserver/btcpayserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023Insufficient policy enforcement in Web Payments API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass content security policy via a crCVE-2023-1226 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Insufficient policy enforcement in Web Payments API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Mar 7, 2023Insufficient policy enforcement in Web Payments API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crCVE-2023-1224 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Insufficient policy enforcement in Web Payments API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Mar 2, 2023Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0.CVE-2023-1149 · Other software · btcpayserver · reported by security@huntr.devMedium 5.4
Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0.
- Product
- btcpayserver/btcpayserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.7 could allow a remote attacker to obtain sensitive information whenCVE-2020-5026 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 193662.
- Product
- Financial Transaction Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 1, 2023The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5.CVE-2023-23315 · Other software · Stripe · reported by MITRECritical 9.8
The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. The method `stripejsValidationModuleFrontController::initContent()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
- Product
- Stripe Payment Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1.CVE-2022-45068 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1.
- Fixed in
- 6.4.0
- What to do
- Update the plugin to 6.4.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 28, 2023An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to view sensitive information via DisplayParallelLogData.aspx.CVE-2022-47076 · Other software · Smartofficepayroll · reported by MITREHigh 7.5
An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to view sensitive information via DisplayParallelLogData.aspx.
- Product
- Smartoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcvewalkthrough.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.