Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
39,009 results · page 387 of 781
Sep 20, 2023Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28CVE-2023-5074 · Network & remote access · D-Link · reported by vulnreport@tenable.comCritical 9.8
Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28
- Product
- D-View 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Sep 20, 2023 A buffer overflow vulnerability exists in the Rockwell Automation select 1756-EN* communication devices.CVE-2023-2262 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comCritical 9.8
A buffer overflow vulnerability exists in the Rockwell Automation select 1756-EN* communication devices. If exploited, a threat actor could potentially leverage this vulnerability to perform a remote code execution. To exploit this vulnerability, a threat actor would have to send a maliciously crafted CIP request to device.
- Product
- 1756-EN2T Series A, B, C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.custhelp.comrockwellautomation.custhelp.com
Sep 20, 2023A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17.CVE-2023-42464 · Other software · Netatalk · reported by MITRECritical 9.8
A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. When parsing Spotlight RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the underlying protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a malicious actor may be able to fully control the value of the pointer and theoretically achieve Remote Code Execution on the host. This issue is similar to CVE-2023-34967.
- Product
- Netatalk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Sep 20, 2023D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config_upload_handler.CVE-2023-43207 · Other software · dlink · reported by MITRECritical 9.8
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config_upload_handler. This vulnerability allows attackers to execute arbitrary commands via the configRestore parameter.
- Product
- dwl-6610ap_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_download_handler.CVE-2023-43206 · Other software · dlink · reported by MITRECritical 9.8
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_download_handler. This vulnerability allows attackers to execute arbitrary commands via the certDownload parameter.
- Product
- dwl-6610ap_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50.CVE-2023-43204 · Other software · dlink · reported by MITRECritical 9.8
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parameter.
- Product
- dwl-6610ap_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a stack overflow vulnerability in the function update_users.CVE-2023-43203 · Other software · dlink · reported by MITRECritical 9.8
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a stack overflow vulnerability in the function update_users.
- Product
- dwl-6610ap_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_download_handler.CVE-2023-43202 · Other software · dlink · reported by MITRECritical 9.8
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_download_handler. This vulnerability allows attackers to execute arbitrary commands via the update.device.packet-capture.tftp-file-name parameter.
- Product
- dwl-6610ap_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the hi_up parameter in the qos_ext.asp function.CVE-2023-43201 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the hi_up parameter in the qos_ext.asp function.
- Product
- di-7200gv2.e1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the id parameter in the yyxz.data function.CVE-2023-43200 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the id parameter in the yyxz.data function.
- Product
- di-7200gv2.e1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the prev parameter in the H5/login.cgi function.CVE-2023-43199 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the prev parameter in the H5/login.cgi function.
- Product
- di-7200gv2.e1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the popupId parameter in the H5/hi_block.asp function.CVE-2023-43198 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the popupId parameter in the H5/hi_block.asp function.
- Product
- di-7200gv2.e1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the fn parameter in the tgfile.asp function.CVE-2023-43197 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the fn parameter in the tgfile.asp function.
- Product
- di-7200gv2.e1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023D-Link DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the zn_jb parameter in the arp_sys.asp function.CVE-2023-43196 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the zn_jb parameter in the arp_sys.asp function.
- Product
- di-7200gv2.e1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023An arbitrary code execution flaw was found in Foreman.CVE-2023-0118 · Other software · Red Hat · reported by Red HatCritical 9.1
An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.
- Product
- Red Hat Satellite 6.11 for RHEL 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 20, 2023paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element inCVE-2019-19450 · Other software · Reportlab · reported by MITRECritical 9.8
paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.
- Product
- Reportlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Sep 20, 2023A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicioCVE-2023-22644 · Other software · SUSE · reported by meissner@suse.deCritical 9.4
A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.
- Product
- neuvector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Sep 20, 2023Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernelCVE-2023-2163 · Computers, phones & browsers · Linux · reported by cve-coordination@google.comCritical 10
Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orgbughunters.google.com
Sep 19, 2023Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to exCVE-2023-4088 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpCritical 9.3
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.
- Product
- GX Works3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2023Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code vCVE-2023-38888 · Other software · Dolibarr · reported by MITRECritical 9.6
Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2023JetBrains TeamCity Authentication Bypass VulnerabilityCVE-2023-42793 · Other software · JetBrains · reported by cve@jetbrains.comExploitedRansomwareCritical 9.8
JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.
- Product
- TeamCity
- On CISA’s list since
- Oct 4, 2023 (federal fix deadline Oct 25, 2023)
- What to do
- Attackers are using this now. Install JetBrains’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comattackerkb.com
Sep 19, 2023Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials.CVE-2022-47558 · Other software · Ormazabal · reported by cve-coordination@incibe.esCritical 9.4
Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or modify existing users, modify configuration files, install rootkits or backdoors.
- Product
- ekorCCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2023Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated priviCVE-2022-47555 · Other software · Ormazabal · reported by cve-coordination@incibe.esCritical 9.3
Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated privileges or set up a backdoor.
- Product
- ekorCCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2023A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functionaliCVE-2023-29245 · Other software · Nozomi Networks · reported by prodsec@nozominetworks.comCritical 9.2
A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functionality of our IDS, may allow an unauthenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application by sending specially crafted malicious network packets. Malicious users with extensive knowledge on the underlying system may be able to extract arbitrary information from the DBMS in an uncontrolled way, alter its structure and data, and/or affect its availability.
- Product
- Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.nozominetworks.comsecurity.nozominetworks.com
Sep 19, 2023The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface.CVE-2023-0773 · Other software · Uniview · reported by vdisclose@cert-in.org.inCritical 9.1
The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device. Successful exploitation of this vulnerability could allow the attacker to gain complete control of the targeted device.
- Product
- Uniview IP Camera IPC322LB-SF28-A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordglobal.uniview.comcert-in.org.in
Sep 19, 2023A SQL injection in the flutter_downloader component through 1.11.1 for iOS allows remote attackers to steal session tokens and overwrite arbitrary files inside CVE-2023-41387 · Other software · patreon · reported by MITRECritical 9.1
A SQL injection in the flutter_downloader component through 1.11.1 for iOS allows remote attackers to steal session tokens and overwrite arbitrary files inside the app's container. The internal database of the framework is exposed to the local user if an app uses UIFileSharingEnabled and LSSupportsOpeningDocumentsInPlace properties. As a result, local users can obtain the same attack primitives as remote attackers by tampering with the internal database of the framework on the device.
- Product
- flutter_downloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account.CVE-2022-28357 · Computers, phones & browsers · Linuxfoundation · reported by MITRECritical 9.8
NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account.
- Product
- Nats-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.nats.iogithub.com
Sep 18, 2023SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.18, allows attackers to execute arbitrary CVE-2021-26837 · Other software · Fortra · reported by MITRECritical 9.8
SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.18, allows attackers to execute arbitrary code, escalate privileges, and gain sensitive information.
- Product
- Delivernow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.helpsystems.comsusos.co
Sep 18, 2023SQLpage is a SQL-only webapp builder.CVE-2023-42454 · Other software · lovasoa · reported by GitHubCritical 10
SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly, with a database connection string specified in the `sqlpage/sqlpage.json` configuration file (not in an environment variable), with the web_root is the current working directory (the default), and with their database exposed publicly, is vulnerable to an attacker retrieving database connection information from SQLPage and using it to connect to their database directly. Version 0.11.0 fixes this issue. Some workarounds are available. Using an environment variable instead of the configuration file to specify the database connection string prevents exposing it on vulnerable versions. Using a different web root (that is not a parent of the SQLPage configuration directory) fixes the issue. One should also avoid exposing one's database publicly.
- Product
- SQLpage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023 Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the wCVE-2023-41084 · Other software · Socomec · reported by ics-cert@hq.dhs.govCritical 10
Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device.
- Product
- MODULYS GP (MOD3GP-SY-120K)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST rCVE-2023-33831 · Other software · Frangoteam · reported by MITRECritical 9.8
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.
- Product
- Fuxa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023Buffer Overflow vulnerability in Tenda AC10V4 v.US_AC10V4.0si_V16.03.10.13_cn_TDC01 allows a remote attacker to cause a denial of service via the mac parameter CVE-2023-42320 · Network & remote access · tenda · reported by MITRECritical 9.8
Buffer Overflow vulnerability in Tenda AC10V4 v.US_AC10V4.0si_V16.03.10.13_cn_TDC01 allows a remote attacker to cause a denial of service via the mac parameter in the GetParentControlInfo function.
- Product
- ac10v4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023SQL injection vulnerability in Exam Form Submission in PHP with Source Code v.1.0 allows a remote attacker to escalate privileges via the val-username parameterCVE-2023-42359 · Other software · Exam Form Submission IN PHP With Source Code Project · reported by MITRECritical 9.8
SQL injection vulnerability in Exam Form Submission in PHP with Source Code v.1.0 allows a remote attacker to escalate privileges via the val-username parameter in /index.php.
- Product
- Exam Form Submission IN PHP With Source Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordupbeat-washer-def.notion.siteupbeat-washer-def.notion.site
Sep 15, 2023Allow PHP in Posts and Pages: Remote Code ExecutionCVE-2023-4994 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server.
- Product
- Allow PHP in Posts and Pages
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Allow PHP in Posts and Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 15, 2023An issue in NETIS SYSTEMS WF2409Ev4 v.1.0.1.705 allows a remote attacker to execute arbitrary code and obtain sensitive information via the password parameter iCVE-2023-42336 · Other software · netis-systems · reported by MITRECritical 9.8
An issue in NETIS SYSTEMS WF2409Ev4 v.1.0.1.705 allows a remote attacker to execute arbitrary code and obtain sensitive information via the password parameter in the /etc/shadow.sample component.
- Product
- wf2409e
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interCVE-2023-39612 · Other software · Filebrowser · reported by MITRECritical 9
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL.
- Product
- Filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfebin0x4e4a.wordpress.comgithub.com
Sep 15, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-36735 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 15, 2023OpenRefine is a powerful free, open source tool for working with messy data.CVE-2023-41887 · Other software · OpenRefine · reported by GitHubCritical 9.8
OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.
- Product
- OpenRefine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023An issue in zzCMS v.2023 allows a remote attacker to execute arbitrary code and obtain sensitive information via the ueditor component in controller.php.CVE-2023-42398 · Other software · Zzcms · reported by MITRECritical 9.8
An issue in zzCMS v.2023 allows a remote attacker to execute arbitrary code and obtain sensitive information via the ueditor component in controller.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023Freewill iFIS (aka SMART Trade) 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page.CVE-2023-28614 · Other software · Freewillsolutions · reported by MITRECritical 9.8
Freewill iFIS (aka SMART Trade) 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page.
- Product
- Smart Trade
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfreewillsolutions.com
Sep 15, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CF Software Oil Management Software allows SQL Injection.CVE-2023-4835 · Other software · CF Software · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CF Software Oil Management Software allows SQL Injection. This issue affects Oil Management Software: before 20230912 .
- Product
- Oil Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 15, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Besttem Network Marketing Software allows SQL Injection.CVE-2023-4833 · Other software · Besttem · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Besttem Network Marketing Software allows SQL Injection. This issue affects Network Marketing Software: before 1.0.2309.6.
- Product
- Network Marketing Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 15, 2023Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion.CVE-2023-4662 · Network & remote access · Saphira · reported by iletisim@usom.gov.trCritical 9.8
Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion. This issue affects Saphira Connect: before 9.
- Product
- Saphira Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 15, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saphira Saphira Connect allows SQL Injection.CVE-2023-4661 · Network & remote access · Saphira · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saphira Saphira Connect allows SQL Injection. This issue affects Saphira Connect: before 9.
- Product
- Saphira Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 15, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncode Ncep allows SQL Injection.This issue affects Ncep: bCVE-2023-4831 · Other software · Ncode · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncode Ncep allows SQL Injection.This issue affects Ncep: before 20230914 .
- Product
- Ncep
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordusom.gov.trusom.gov.tr
Sep 15, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Innosa Probbys allows SQL Injection.CVE-2023-4670 · Other software · Innosa · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Innosa Probbys allows SQL Injection. This issue affects Probbys: before 2.
- Product
- Probbys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 15, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cevik Informatics Online Payment System allows SQL InjectiCVE-2023-4231 · Other software · Cevik Informatics · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cevik Informatics Online Payment System allows SQL Injection. This issue affects Online Payment System: before 4.09.
- Product
- Online Payment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 15, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tura Signalix allows SQL Injection.CVE-2023-4830 · Other software · Tura · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tura Signalix allows SQL Injection. This issue affects Signalix: 7T_0228.
- Product
- Signalix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 15, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sanalogy Turasistan allows SQL Injection.CVE-2023-4673 · Other software · Sanalogy · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sanalogy Turasistan allows SQL Injection. This issue affects Turasistan: before 20230911 .
- Product
- Turasistan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 15, 2023An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996.CVE-2023-36659 · Other software · Opswat · reported by MITRECritical 9.8
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Long inputs were not properly processed, which allows remote attackers to cause a denial of service (loss of communication).
- Product
- Metadefender Kiosk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opswat.comdocs.opswat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.