Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
39,009 results · page 388 of 781
Sep 15, 2023An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996.CVE-2023-36657 · Other software · Opswat · reported by MITRECritical 9.8
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalation.
- Product
- Metadefender Kiosk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opswat.comdocs.opswat.com
Sep 14, 2023Bl Modules xmlfeeds before v3.9.8 was discovered to contain a SQL injection vulnerability via the component SearchApiXml::Xmlfeeds().CVE-2023-39643 · Other software · Blmodules · reported by MITRECritical 9.8
Bl Modules xmlfeeds before v3.9.8 was discovered to contain a SQL injection vulnerability via the component SearchApiXml::Xmlfeeds().
- Product
- Xmlfeeds Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurity.friendsofpresta.org
Sep 14, 2023Carts Guru cartsguru up to v2.4.2 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::display().CVE-2023-39642 · Other software · Carts.guru · reported by MITRECritical 9.8
Carts Guru cartsguru up to v2.4.2 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::display().
- Product
- Cartsguru
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurity.friendsofpresta.org
Sep 14, 2023Active Design psaffiliate before v1.9.8 was discovered to contain a SQL injection vulnerability via the component PsaffiliateGetaffiliatesdetailsModuleFrontContCVE-2023-39641 · Other software · Activedesign · reported by MITRECritical 9.8
Active Design psaffiliate before v1.9.8 was discovered to contain a SQL injection vulnerability via the component PsaffiliateGetaffiliatesdetailsModuleFrontController::initContent().
- Product
- Full Affiliates
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurity.friendsofpresta.org
Sep 14, 2023LeoTheme leoblog up to v3.1.2 was discovered to contain a SQL injection vulnerability via the component LeoBlogBlog::getListBlogs.CVE-2023-39639 · Other software · Leotheme · reported by MITRECritical 9.8
LeoTheme leoblog up to v3.1.2 was discovered to contain a SQL injection vulnerability via the component LeoBlogBlog::getListBlogs.
- Product
- Leoblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurity.friendsofpresta.org
Sep 14, 2023SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the `sort` parameter to taskService.list(), bareMetalSeCVE-2023-42405 · Other software · Fit2cloud · reported by MITRECritical 9.8
SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the `sort` parameter to taskService.list(), bareMetalService.list(), and switchService.list().
- Product
- Rackshift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023D-LINK DIR-859 A1 1.05 and A1 1.06B01 Beta01 was discovered to contain a command injection vulnerability via the lxmldbc_system function at /htdocs/cgibin.CVE-2023-39638 · Network & remote access · d-link · reported by MITRECritical 9.8
D-LINK DIR-859 A1 1.05 and A1 1.06B01 Beta01 was discovered to contain a command injection vulnerability via the lxmldbc_system function at /htdocs/cgibin.
- Product
- dir-859_a1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddlink.com.cngithub.com
Sep 14, 2023SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username paraCVE-2023-38912 · Other software · Superstorefinder · reported by MITRECritical 9.8
SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter.
- Product
- PHP Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netpacketstormsecurity.com
Sep 14, 2023I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation.CVE-2023-37756 · Other software · I-doit · reported by MITRECritical 9.8
I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack.
- Product
- I-doit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023Incorrect Use of Privileged APIs vulnerability in Yepas Digital Yepas allows Collect Data as Provided by Users.CVE-2023-4972 · Other software · Yepas · reported by iletisim@usom.gov.trCritical 9.8
Incorrect Use of Privileged APIs vulnerability in Yepas Digital Yepas allows Collect Data as Provided by Users. This issue affects Digital Yepas: before 1.0.1.
- Product
- Digital Yepas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 14, 2023Authentication Bypass Using an Alternate Path or Channel vulnerability in Yepas Digital Yepas allows Authentication Bypass.CVE-2023-4702 · Other software · Yepas · reported by iletisim@usom.gov.trCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Yepas Digital Yepas allows Authentication Bypass. This issue affects Digital Yepas: before 1.0.1.
- Product
- Digital Yepas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 14, 2023i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask usCVE-2023-37755 · Other software · I-doit · reported by MITRECritical 9.8
i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator privileges, resulting in them being able to perform arbitrary system operations or cause a Denial of Service (DoS).
- Product
- I-doit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Movus allows SQL Injection.CVE-2023-4766 · Other software · Movus · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Movus allows SQL Injection. This issue affects Movus: before 20230913.
- Product
- Movus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 14, 2023Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass.CVE-2023-4669 · Other software · Exagate · reported by iletisim@usom.gov.trCritical 9.8
Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass. This issue affects SYSGuard 3001: before 3.2.20.0.
- Product
- SYSGuard 3001
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 14, 2023Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary coCVE-2023-41011 · Other software · china_mobile_communications · reported by MITRECritical 9.8
Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code via the shortcut_telnet.cg component.
- Product
- china_mobile_intelligent_home_gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aceka Company Management allows SQL Injection.CVE-2023-4832 · Other software · Aceka · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aceka Company Management allows SQL Injection. This issue affects Company Management: before 3072 .
- Product
- Company Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 14, 2023A remote authentication bypass issue exists in some OneView APIs.CVE-2023-30909 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
A remote authentication bypass issue exists in some OneView APIs.
- Product
- HPE OneView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Sep 14, 2023Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerabilityCVE-2023-38204 · Websites & servers · Adobe · reported by AdobeCritical 9.8
Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
- Product
- ColdFusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Sep 13, 2023Craft CMS is a platform for creating digital experiences.CVE-2023-41892 · Other software · craftcms · reported by GitHubCritical 10
Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 13, 2023NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the optCVE-2023-39916 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlCritical 9.3
NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of responses received for RRDP requests. The location of these stored responses is constructed from the URL of the request. Due to insufficient sanitation of the URL, it is possible for an attacker to craft a URL that results in the response being stored outside of the directory specified for it.
- Product
- Routinator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnlnetlabs.nlnlnetlabs.nl
Sep 13, 2023A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE andCVE-2023-3935 · Other software · Wibu · reported by info@cert.vde.comCritical 9.8
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.
- Product
- CodeMeter Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn.wibu.comcert.vde.com
Sep 12, 2023An issue in SNMP Web Pro v.1.1 allows a remote attacker to execute arbitrary code and obtain senstive information via a crafted request.CVE-2023-39073 · Other software · Voltronicpower · reported by MITRECritical 9.8
An issue in SNMP Web Pro v.1.1 allows a remote attacker to execute arbitrary code and obtain senstive information via a crafted request.
- Product
- Snmp Web Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Sep 12, 2023SOFARPC is a Java RPC framework.CVE-2023-41331 · Other software · sofastack · reported by GitHubCritical 9.8
SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully crafted payload, an attacker can achieve JNDI injection or system command execution. In the default configuration of the SOFARPC framework, a blacklist is used to filter out dangerous classes encountered during the deserialization process. However, the blacklist is not comprehensive, and an actor can exploit certain native JDK classes and common third-party packages to construct gadget chains capable of achieving JNDI injection or system command execution attacks. Version 5.11.0 contains a fix for this issue. As a workaround, users can add `-Drpc_serialize_blacklist_override=javax.sound.sampled.AudioFileFormat` to the blacklist.
- Product
- sofa-rpc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2023Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prCVE-2023-3710 · Other software · Honeywell · reported by psirt@honeywell.comCritical 9.9
Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).
- Product
- PM23/43
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhsmftp.honeywell.comhsmftp.honeywell.com
Sep 12, 2023User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and EnterpCVE-2023-4501 · Other software · OpenText · reported by security@opentext.comCritical 9.8
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows an attacker with access to the product to impersonate any user. Mitigations: The issue is corrected in the upcoming patch update for each affected product. Product overlays and workaround instructions are available through OpenText Support. The vulnerable configurations are believed to be uncommon. Administrators can test for the vulnerability in their installations by attempting to sign on to a Visual COBOL or Enterprise Server component such as ESCWA using a valid username and incorrect password.
- Product
- Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.microfocus.comportal.microfocus.com
Sep 12, 2023DedeCMS 5.7.102 has a File Upload vulnerability via uploads/dede/module_make.php.CVE-2023-40784 · Other software · dedecms · reported by MITRECritical 9.8
DedeCMS 5.7.102 has a File Upload vulnerability via uploads/dede/module_make.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2023OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthenticated attackers to gaCVE-2023-40834 · Other software · Opencart · reported by MITRECritical 9.8
OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthenticated attackers to gain access to the application via a brute force attack to the password parameter.
- Product
- Opencart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopencart.com
Sep 12, 2023 Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve CVE-2023-2071 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comCritical 9.8
Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve remote code executed via crafted malicious packets. The device has the functionality, through a CIP class, to execute exported functions from libraries. There is a routine that restricts it to execute specific functions from two dynamic link library files. By using a CIP class, an attacker can upload a self-made library to the device which allows the attacker to bypass the security check and execute any code written in the function.
- Product
- Fa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.custhelp.comrockwellautomation.custhelp.com
Sep 12, 2023ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution.CVE-2023-39150 · Other software · Maximus5 · reported by MITRECritical 9.8
ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution. This is related to an incomplete fix for CVE-2022-46387.
- Product
- Conemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 12, 2023D-Link DIR-816 A2 1.10 B05 was discovered to contain a command injection vulnerability via the component /goform/Diagnosis.CVE-2023-39637 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link DIR-816 A2 1.10 B05 was discovered to contain a command injection vulnerability via the component /goform/Diagnosis.
- Product
- dir-816_a2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddlink.com.cngithub.com
Sep 12, 2023Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability.CVE-2022-24093 · Websites & servers · Adobe · reported by AdobeCritical 9.1
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Sep 11, 2023SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view CVE-2023-40622 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.9
SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application causing high impact on confidentiality, integrity, and availability.
- Product
- SAP BusinessObjects Business Intelligence Platform (Promotion Management)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulCVE-2023-40309 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.8
SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.
- Product
- SAP CommonCryptoLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism.CVE-2023-39069 · Other software · Strangebee · reported by MITRECritical 9.8
An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism.
- Product
- Cortex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.CVE-2023-4897 · Other software · mintplex-labs · reported by security@huntr.devCritical 9.8
Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow.CVE-2023-35681 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Sep 11, 2023Schoolmate 1.3 is vulnerable to SQL Injection in the variable $username from SESSION in ValidateLogin.php.CVE-2023-40946 · Other software · Schoolmate Project · reported by MITRECritical 9.8
Schoolmate 1.3 is vulnerable to SQL Injection in the variable $username from SESSION in ValidateLogin.php.
- Product
- Schoolmate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023Schoolmate 1.3 is vulnerable to SQL Injection in the variable $schoolname from Database at ~\header.php.CVE-2023-40944 · Other software · Schoolmate Project · reported by MITRECritical 9.8
Schoolmate 1.3 is vulnerable to SQL Injection in the variable $schoolname from Database at ~\header.php.
- Product
- Schoolmate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023 Softneta MedDream PACS does not perform an authentication check and performs some dangerous functionality, which could result in unauthenticated remote code exCVE-2023-40150 · Other software · Softneta · reported by ics-cert@hq.dhs.govCritical 9.8
Softneta MedDream PACS does not perform an authentication check and performs some dangerous functionality, which could result in unauthenticated remote code execution.0
- Product
- MedDream PACS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023 Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 are vulnerable to authentication bypaCVE-2023-41256 · Other software · Dover Fueling Solutions · reported by ics-cert@hq.dhs.govCritical 9.1
Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 are vulnerable to authentication bypass that could allow an unauthorized attacker to obtain user access.
- Product
- MAGLINK LX Web Console Configuration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023An issue was discovered in TSplus Remote Access through 16.0.2.14.CVE-2023-31069 · Other software · Tsplus · reported by MITRECritical 9.8
An issue was discovered in TSplus Remote Access through 16.0.2.14. Credentials are stored as cleartext within the HTML source code of the login page.
- Product
- Tsplus Remote Work
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Sep 11, 2023An issue was discovered in TSplus Remote Access through 16.0.2.14.CVE-2023-31068 · Other software · Tsplus · reported by MITRECritical 9.8
An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on some directories under %PROGRAMFILES(X86)%\TSplus\UserDesktop\themes.
- Product
- Tsplus Remote Work
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Sep 11, 2023An issue was discovered in TSplus Remote Access through 16.0.2.14.CVE-2023-31067 · Other software · Tsplus · reported by MITRECritical 9.8
An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on some directories under %PROGRAMFILES(X86)%\TSplus\Clients\www.
- Product
- Tsplus Remote Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Sep 11, 2023An issue in Diebold Aglis XFS for Opteva v.4.1.61.1 allows a remote attacker to execute arbitrary code via a crafted payload to the ResolveMethod() parameter.CVE-2020-19559 · Other software · Dieboldnixdorf · reported by MITRECritical 9.8
An issue in Diebold Aglis XFS for Opteva v.4.1.61.1 allows a remote attacker to execute arbitrary code via a crafted payload to the ResolveMethod() parameter.
- Product
- Agilis XFS For Opteva
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023Buffer overflow vulnerability in DLINK 619L version B 2.06beta via the curTime parameter on login.CVE-2020-19320 · Network & remote access · d-link · reported by MITRECritical 9.8
Buffer overflow vulnerability in DLINK 619L version B 2.06beta via the curTime parameter on login.
- Product
- dir-619l
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023Buffer overflow vulnerability in DLINK 619L version B 2.06beta via the FILECODE parameter on login.CVE-2020-19319 · Network & remote access · d-link · reported by MITRECritical 9.8
Buffer overflow vulnerability in DLINK 619L version B 2.06beta via the FILECODE parameter on login.
- Product
- 202l
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023novel-plus 3.6.2 is vulnerable to SQL Injection.CVE-2023-30058 · Other software · Xxyopen · reported by MITRECritical 9.8
novel-plus 3.6.2 is vulnerable to SQL Injection.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023In PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accounts.CVE-2023-36140 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
In PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accounts.
- Product
- Cleaning Business Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Sep 11, 2023The wave.ai.browser application through 1.0.35 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent.CVE-2023-42471 · Other software · Wave-ai · reported by MITRECritical 9.8
The wave.ai.browser application through 1.0.35 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. It contains a manifest entry that exports the wave.ai.browser.ui.splash.SplashScreen activity. This activity uses a WebView component to display web content and doesn't adequately validate or sanitize the URI or any extra data passed in the intent by a third party application (with no permissions).
- Product
- Wave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023The Imou Life com.mm.android.smartlifeiot application through 6.8.0 for Android allows Remote Code Execution via a crafted intent to an exported component.CVE-2023-42470 · Other software · Imoulife · reported by MITRECritical 9.8
The Imou Life com.mm.android.smartlifeiot application through 6.8.0 for Android allows Remote Code Execution via a crafted intent to an exported component. This relates to the com.mm.android.easy4ip.MainActivity activity. JavaScript execution is enabled in the WebView, and direct web content loading occurs.
- Product
- Life
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.