Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
39,009 results · page 383 of 781
Oct 10, 2023A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through CVE-2023-36548 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.8
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
- Product
- FortiWLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Oct 10, 2023A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through CVE-2023-36547 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.8
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
- Product
- FortiWLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Oct 10, 2023A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through CVE-2023-34993 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.8
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
- Product
- FortiWLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Oct 10, 2023A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized CVE-2023-34992 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 10
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via crafted API requests.
- Product
- FortiSIEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Oct 10, 2023In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random.CVE-2020-27636 · Other software · Microchip · reported by MITRECritical 9.1
In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random.
- Product
- Mplab Network Creator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023In PicoTCP 1.7.0, TCP ISNs are improperly random.CVE-2020-27635 · Other software · Capgemini · reported by MITRECritical 9.1
In PicoTCP 1.7.0, TCP ISNs are improperly random.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023In Contiki 4.5, TCP ISNs are improperly random.CVE-2020-27634 · Other software · Contiki-ng · reported by MITRECritical 9.1
In Contiki 4.5, TCP ISNs are improperly random.
- Product
- Contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023In FNET 4.6.3, TCP ISNs are improperly random.CVE-2020-27633 · Other software · Butok · reported by MITRECritical 9.1
In FNET 4.6.3, TCP ISNs are improperly random.
- Product
- Fnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023In Oryx CycloneTCP 1.9.6, TCP ISNs are improperly random.CVE-2020-27631 · Other software · Oryx-embedded · reported by MITRECritical 9.8
In Oryx CycloneTCP 1.9.6, TCP ISNs are improperly random.
- Product
- Cyclonetcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random.CVE-2020-27630 · Other software · Silabs · reported by MITRECritical 9.8
In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random.
- Product
- Uc/tcp-ip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability.CVE-2023-30806 · Other software · Sangfor · reported by VulnCheckCritical 9.8
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /cgi-bin/login.cgi endpoint. This is due to mishandling of shell meta-characters in the PHPSESSID cookie.
- Product
- Net-Gen Application Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comlabs.watchtowr.com
Oct 10, 2023The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability.CVE-2023-30805 · Other software · Sangfor · reported by VulnCheckCritical 9.8
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /LogInOut.php endpoint. This is due to mishandling of shell meta-characters in the "un" parameter.
- Product
- Net-Gen Application Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comlabs.watchtowr.com
Oct 10, 2023The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability.CVE-2023-30803 · Other software · Sangfor · reported by VulnCheckCritical 9.8
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can bypass authentication and access administrative functionality by sending HTTP requests using a crafted Y-forwarded-for header.
- Product
- Net-Gen Application Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comlabs.watchtowr.com
Oct 10, 2023Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow VulnerabilityCVE-2023-4966 · Network & remote access · Citrix · reported by secure@citrix.comExploitedRansomwareCritical 9.4
Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
- Product
- NetScaler ADC and NetScaler Gateway
- On CISA’s list since
- Oct 18, 2023 (federal fix deadline Nov 8, 2023)
- What to do
- Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comsupport.citrix.com
Oct 10, 2023All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled.CVE-2023-30801 · Other software · qBittorrent · reported by VulnCheckCritical 9.8
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.
- Product
- qBittorrent client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Oct 10, 2023 A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP systeCVE-2023-41373 · Network & remote access · F5 · reported by f5sirt@f5.comCritical 9.9
A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023A vulnerability has been identified in Simcenter Amesim (All versions < V2021.1).CVE-2023-43625 · Other software · Siemens · reported by productcert@siemens.comCritical 9.8
A vulnerability has been identified in Simcenter Amesim (All versions < V2021.1). The affected application contains a SOAP endpoint that could allow an unauthenticated remote attacker to perform DLL injection and execute arbitrary code in the context of the affected application process.
- Product
- Simcenter Amesim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Oct 10, 2023A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11 (only with activated debug support)), CP-8050 MASTER MODULE (All versCVE-2023-36380 · Other software · Siemens · reported by productcert@siemens.comCritical 9.8
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11 (only with activated debug support)), CP-8050 MASTER MODULE (All versions < CPCI85 V05.11 (only with activated debug support)). The affected devices contain a hard-coded ID in the SSH `authorized_keys` configuration file. An attacker with knowledge of the corresponding private key could login to the device via SSH. Only devices with activated debug support are affected.
- Product
- CP-8031 MASTER MODULE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Oct 9, 2023hansun CMS v1.0 was discovered to contain a SQL injection vulnerability via the component /ajax/ajax_login.ashx.CVE-2023-43899 · Other software · Hansuncms Project · reported by MITRECritical 9.8
hansun CMS v1.0 was discovered to contain a SQL injection vulnerability via the component /ajax/ajax_login.ashx.
- Product
- Hansuncms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 9, 2023Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other prCVE-2023-43271 · Other software · 70mai · reported by MITRECritical 9.1
Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other protocols.
- Product
- A500s Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code vCVE-2023-44467 · Other software · Langchain · reported by MITRECritical 9.8
langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via __import__ in Python code, which is not prohibited by pal_chain/base.py.
- Product
- Langchain Experimental
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023HP LIFE Android Mobile application is potentially vulnerable to escalation of privilege and/or information disclosure.CVE-2023-5365 · Other software · HP Inc. · reported by hp-security-alert@hp.comCritical 9.8
HP LIFE Android Mobile application is potentially vulnerable to escalation of privilege and/or information disclosure.
- Product
- HP LIFE Android Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Oct 9, 2023Piwigo is an open source photo gallery application.CVE-2023-44393 · Other software · Piwigo · reported by GitHubCritical 9.3
Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS code into the HTML page, which could then be executed by admin users when they visit the URL with the payload. The vulnerability is caused by the insecure injection of the `plugin_id` value from the URL into the HTML page. An attacker can exploit this vulnerability by crafting a malicious URL that contains a specially crafted `plugin_id` value. When a victim who is logged in as an administrator visits this URL, the malicious code will be injected into the HTML page and executed. This vulnerability can be exploited by any attacker who has access to a malicious URL. However, only users who are logged in as administrators are affected. This is because the vulnerability is only present on the `/admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page, which is only accessible to administrators. Version 14.0.0.beta4 contains a patch for this issue.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution.CVE-2023-45199 · Other software · mbed · reported by MITRECritical 9.8
Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution.
- Product
- mbedtls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmbed-tls.readthedocs.iombed-tls.readthedocs.io
Oct 6, 2023fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any CVE-2023-45311 · Other software · Fsevents Project · reported by MITRECritical 9.8
fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.
- Product
- Fsevents
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the CVE-2023-45239 · Other software · Meta · reported by cve-assign@fb.comCritical 9.8
A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent to tac_plus to inject shell commands and gain remote code execution on the tac_plus server.
- Product
- tac_plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the cancelPing function.CVE-2023-44807 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the cancelPing function.
- Product
- dir-820l
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages.CVE-2023-38703 · Other software · pjsip · reported by GitHubCritical 9.8
PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capability (`PJMEDIA_HAS_SRTP` is set) and use underlying media transport other than UDP. This vulnerability’s impact may range from unexpected application termination to control flow hijack/memory corruption. The patch is available as a commit in the master branch.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participatioCVE-2023-36465 · Other software · decidim · reported by GitHubCritical 9.1
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys. This issue has been patched in version 0.26.8 and 0.27.4.
- Product
- decidim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Turna Advertising Administration Panel allows SQL InjectioCVE-2023-4530 · Other software · Turna · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Turna Advertising Administration Panel allows SQL Injection. This issue affects Advertising Administration Panel: before 1.1.
- Product
- Advertising Administration Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Oct 5, 2023pigcms up to 7.0 was discovered to contain an arbitrary file upload vulnerability.CVE-2023-43269 · Other software · pigcms · reported by MITRECritical 9.8
pigcms up to 7.0 was discovered to contain an arbitrary file upload vulnerability.
- Product
- pigcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2023SQL injection vulnerability in KnowBand Module One Page Checkout, Social Login & Mailchimp (supercheckout) v.8.0.3 and before allows a remote attacker to executCVE-2023-44024 · Other software · Knowband · reported by MITRECritical 9.8
SQL injection vulnerability in KnowBand Module One Page Checkout, Social Login & Mailchimp (supercheckout) v.8.0.3 and before allows a remote attacker to execute arbitrary code via a crafted request to the updateCheckoutBehaviour function in the supercheckout.php component.
- Product
- ONE Page Checkout, Social Login & Mailchimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Oct 5, 2023Presto Changeo attributegrid up to 2.0.3 was discovered to contain a SQL injection vulnerability via the component disable_json.php.CVE-2023-43983 · Other software · Presto-changeo · reported by MITRECritical 9.8
Presto Changeo attributegrid up to 2.0.3 was discovered to contain a SQL injection vulnerability via the component disable_json.php.
- Product
- Attribute Grid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Oct 5, 2023Presto Changeo testsitecreator up to 1.1.1 was discovered to contain a deserialization vulnerability via the component delete_excluded_folder.php.CVE-2023-43981 · Other software · presto-changeo · reported by MITRECritical 9.8
Presto Changeo testsitecreator up to 1.1.1 was discovered to contain a deserialization vulnerability via the component delete_excluded_folder.php.
- Product
- test_site_creator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Oct 5, 2023Prixan prixanconnect up to v1.62 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::importProductsCVE-2023-40920 · Other software · Prixan · reported by MITRECritical 9.8
Prixan prixanconnect up to v1.62 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::importProducts().
- Product
- Prixanconnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Oct 5, 2023 Dell SmartFabric Storage Software version 1.3 and lower contain an improper input validation vulnerability.CVE-2023-32485 · Other software · Dell · reported by security_alert@emc.comCritical 9.8
Dell SmartFabric Storage Software version 1.3 and lower contain an improper input validation vulnerability. A remote unauthenticated attacker may exploit this vulnerability and escalate privileges up to the highest administration level. This is a critical severity vulnerability affecting user authentication. Dell recommends customers to upgrade at the earliest opportunity.
- Product
- Dell SmartFabric Storage Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2023 Qognify NiceVision versions 3.1 and prior are vulnerable to exposing sensitive information using hard-coded credentials.CVE-2023-2306 · Other software · Qognify · reported by ics-cert@hq.dhs.govCritical 10
Qognify NiceVision versions 3.1 and prior are vulnerable to exposing sensitive information using hard-coded credentials. With these credentials an attacker can retrieve information about the cameras, user information, and modify database records.
- Product
- NiceVision
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023IQ Engine before 10.6r2 on Extreme Network AP devices has a Buffer Overflow.CVE-2023-35803 · Other software · extremenetworks · reported by MITRECritical 9.8
IQ Engine before 10.6r2 on Extreme Network AP devices has a Buffer Overflow.
- Product
- iq_engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.extremenetworks.comcommunity.extremenetworks.com
Oct 4, 2023TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective LifetiCVE-2023-41094 · Other software · Silicon Labs · reported by product-security@silabs.comCritical 10
TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration This issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected
- Product
- Ember ZNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.silabs.comcommunity.silabs.com
Oct 4, 2023Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users.CVE-2023-36619 · Other software · Unify · reported by MITRECritical 9.8
Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users.
- Product
- Session Border Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetworks.unify.compacketstormsecurity.com
Oct 4, 2023Redisson is a Java Redis client that uses the Netty framework.CVE-2023-42809 · Other software · redisson · reported by GitHubCritical 9.6
Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages received from the Redis server contain Java objects that the client deserializes without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running in. Version 3.22.0 contains a patch for this issue. Some post-fix advice is available. Do NOT use `Kryo5Codec` as deserialization codec, as it is still vulnerable to arbitrary object deserialization due to the `setRegistrationRequired(false)` call. On the contrary, `KryoCodec` is safe to use. The fix applied to `SerializationCodec` only consists of adding an optional allowlist of class names, even though making this behavior the default is recommended. When instantiating `SerializationCodec` please use the `SerializationCodec(ClassLoader classLoader, Set<String> allowedClasses)` constructor to restrict the allowed classes for deserialization.
- Product
- redisson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Oct 4, 2023 A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tampering of files on the peCVE-2023-5399 · Other software · Schneider Electric · reported by cybersecurity@se.comCritical 9.8
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tampering of files on the personal computer running C-Bus when using the File Command.
- Product
- C-Bus Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Oct 4, 2023 A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a CVE-2023-5391 · Other software · Schneider Electric · reported by cybersecurity@se.comCritical 9.8
A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a specifically crafted packet to the application.
- Product
- EcoStruxure Power Monitoring Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Oct 4, 2023Hydra is the layer-two scalability solution for Cardano.CVE-2023-38701 · Other software · input-output-hk · reported by GitHubCritical 9.1
Hydra is the layer-two scalability solution for Cardano. Users of the Hydra head protocol send the UTxOs they wish to commit into the Hydra head first to the `commit` validator, where they remain until they are either collected into the `head` validator or the protocol initialisation is aborted and the value in the committed UTxOs is returned to the users who committed them. Prior to version 0.12.0, the `commit` validator contains a flawed check when the `ViaAbort` redeemer is used, which allows any user to spend any UTxO which is at the validator arbitrarily, meaning an attacker can steal the funds that users are trying to commit into the head validator. The intended behavior is that the funds must be returned to the user which committed the funds and can only be performed by a participant of the head. The `initial` validator also is similarly affected as the same flawed check is performed for the `ViaAbort` redeemer. Due to this issue, an attacker can steal any funds that user's try to commit into a Hydra head. Also, an attacker can prevent any Hydra head from being successfully opened. It does not allow an attacker to take funds which have been successfully collected into and cu
- Product
- hydra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023 A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used over the network.CVE-2023-5402 · Other software · Schneider Electric · reported by cybersecurity@se.comCritical 9.8
A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used over the network.
- Product
- C-Bus Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Oct 4, 2023A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has dCVE-2023-20101 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.
- Product
- Cisco Emergency Responder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Oct 4, 2023TCMAN GIM v8.0.1 is vulnerable to a SQL injection via the 'SqlWhere' parameter inside the function 'BuscarESM'.CVE-2022-36276 · Other software · TCMAN · reported by cve-coordination@incibe.esCritical 9.9
TCMAN GIM v8.0.1 is vulnerable to a SQL injection via the 'SqlWhere' parameter inside the function 'BuscarESM'. The exploitation of this vulnerability might allow a remote attacker to directly interact with the database.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Atlassian Confluence Data Center and Server Broken Access Control VulnerabilityCVE-2023-22515 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedRansomwareCritical 9.8
Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
- Product
- Confluence Data Center and Server
- On CISA’s list since
- Oct 5, 2023 (federal fix deadline Oct 13, 2023)
- What to do
- Attackers are using this now. Install Atlassian’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comconfluence.atlassian.com
Oct 4, 2023Stack-based buffer overflow vulnerability in Easy Chat Server 3.1 version.CVE-2023-4494 · Other software · EFS Software · reported by cve-coordination@incibe.esCritical 9.8
Stack-based buffer overflow vulnerability in Easy Chat Server 3.1 version. An attacker could send an excessively long username string to the register.ghp file asking for the name via a GET request resulting in arbitrary code execution on the remote machine.
- Product
- Easy Chat Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Buffer overflow vulnerability in Easy Address Book Web Server 1.6 version.CVE-2023-4491 · Other software · EFS Software · reported by cve-coordination@incibe.esCritical 9.8
Buffer overflow vulnerability in Easy Address Book Web Server 1.6 version. The exploitation of this vulnerability could allow an attacker to send a very long username string to /searchbook.ghp, asking for the name via a POST request, resulting in arbitrary code execution on the remote machine.
- Product
- Easy Address Book Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.