Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,633 results · page 39 of 73
Feb 21, 2022Translation Exchange: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settingsCVE-2021-25057 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settings.
- Product
- Translation Exchange
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Translation Exchange to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 15, 2022Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure permCVE-2022-25210 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure permission to capture passwords of the jobs that will be configured.
- Product
- Jenkins Convertigo Mobile Platform Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and ImporterVCVE-2021-43941 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.5
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and ImporterValueMappingsPage.jspa) via a Cross-Site Request Forgery (CSRF) vulnerability in the jira-importers-plugin. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.
- Product
- Jira Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comjira.atlassian.com
Feb 14, 2022Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-SitCVE-2021-43952 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.3
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/RestoreDefaults.jspa endpoint. The affected versions are before version 8.21.0.
- Product
- Jira Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comjira.atlassian.com
Feb 14, 2022In galois_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector.CVE-2022-24988 · Other software · Galois 2p8 Project · reported by MITRECritical 9.8
In galois_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector.
- Product
- Galois 2p8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data.CVE-2020-13676 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.5
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022The Entity Embed module provides a filter to allow embedding entities in content fields.CVE-2020-13673 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.1
The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.
- Product
- Entity Embed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2022A persistent cross-site scripting (XSS) vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore applicatCVE-2022-23321 · Other software · Xerox · reported by MITREMedium 4.8
A persistent cross-site scripting (XSS) vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore application on version 12.3.7244.0.
- Product
- Xmpie Ustore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtriaxiomsecurity.comxmpie.com
Feb 8, 2022Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.CVE-2021-45329 · Other software · Gitea · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.iogithub.com
Feb 7, 2022Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each rCVE-2022-0474 · Other software · OTRS AG · reported by security@otrs.comLow 2.4
Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient individually. This issue affects: OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 and prior versions.
- Product
- OTRSCustomContactFields
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2022OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check.CVE-2022-0473 · Other software · OTRS AG · reported by security@otrs.comLow 3.8
OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the agent interface, malicious code might be exectued in the browser. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.31 and prior versions.
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022A Cross Site Scripting (XSS) vulnerability exists in Codex before 1.4.0 via Notebook/Page name field, which allows malicious users to execute arbitrary code viaCVE-2021-43635 · Other software · Codexnotes · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) vulnerability exists in Codex before 1.4.0 via Notebook/Page name field, which allows malicious users to execute arbitrary code via a crafted http code in a .json file.
- Product
- Codex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2022An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O.CVE-2021-41840 · Other software · Siemens · reported by MITREHigh 8.2
An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of Functionality from an Untrusted Control Sphere.
- Product
- SIMATIC Field PG M5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comsecurity.netapp.com
Feb 2, 2022A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIMCVE-2020-5953 · Other software · Siemens · reported by MITREHigh 7.5
A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating privilege from ring 0 to ring -2).
- Product
- SIMATIC Field PG M5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comsecurity.netapp.com
Feb 2, 2022Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection.CVE-2022-24300 · Other software · Minetest · reported by MITRECritical 9.8
Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection.
- Product
- Minetest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggithub.com
Feb 1, 2022Ninja Tables: Does not sanitise and escape some of its table fieldsCVE-2021-24900 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Ninja Tables
- Fixed in
- 4.1.8
- What to do
- Update Ninja Tables to 4.1.8 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jan 31, 2022MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE).CVE-2021-46661 · Other software · Mariadb · reported by MITREMedium 5.5
MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE).
- Product
- Mariadb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mariadb.orglists.fedoraproject.org
Jan 29, 2022The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.CVE-2022-24124 · Other software · Casbin · reported by MITREHigh 7.5
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 27, 2022A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitraCVE-2021-46065 · Email & office · Zohocorp · reported by MITREMedium 4.8
A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commanageengine.com
Jan 26, 2022BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field.CVE-2021-43334 · Other software · Buddyboss · reported by MITREMedium 5.4
BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field.
- Product
- Buddyboss
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbuddyboss.comcygenta.co.uk
Jan 26, 2022SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields.CVE-2021-44120 · Other software · Spip · reported by MITREMedium 5.4
SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site and wants to read the author's information, the malicious code will be executed. The "Who are you" and "Website Name" fields are vulnerable.
- Product
- Spip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.spip.netgit.spip.net
Jan 24, 2022Easy Forms for Mailchimp: Does not sanitise and escape the field_name and field_type parameters before outputting them back in attributesCVE-2021-24985 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the field_name and field_type parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.6
- What to do
- Update Easy Forms for Mailchimp to 6.8.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Advanced Custom Fields: Extended: Does not validate the order and orderby parameters before using them in a SQL statementCVE-2021-24865 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue
- Product
- Advanced Custom Fields: Extended
- Fixed in
- 0.8.8.7
- What to do
- Update Advanced Custom Fields: Extended to 0.8.8.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 21, 2022A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_dump_vrml_sffield () at scene_manager/scene_dump.c.CVE-2021-46240 · Other software · Gpac · reported by MITREMedium 5.5
A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_dump_vrml_sffield () at scene_manager/scene_dump.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2022A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_sg_vrml_field_pointer_del () at scenegraph/vrml_tools.c.CVE-2021-46236 · Other software · Gpac · reported by MITREMedium 5.5
A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_sg_vrml_field_pointer_del () at scenegraph/vrml_tools.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2022IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could be vulnerable to unauthorized modifications by using public fields in public classes.CVE-2020-4877 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could be vulnerable to unauthorized modifications by using public fields in public classes. IBM X-Force ID: 190843.
- Product
- Cognos Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 19, 2022Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the group_prefix field during the creation of a new group vCVE-2021-3816 · Other software · Cacti · reported by Red HatMedium 5.4
Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the group_prefix field during the creation of a new group via "Copy" method at user_group_admin.php.
- Product
- Cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the "new_username" field during creation of aCVE-2021-23225 · Other software · Cacti · reported by Red HatMedium 5.4
Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the "new_username" field during creation of a new user via "Copy" method at user_admin.php.
- Product
- Cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgcacti.net
Jan 18, 2022SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts in certain fields (e.g.CVE-2021-38695 · Other software · Softvibe · reported by MITREMedium 5.4
SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts in certain fields (e.g. subject, description) of the document form.
- Product
- Saraban
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfoma.netorangeo.tech
Jan 17, 2022ACF Photo Gallery Field: Does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_editCVE-2021-24909 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_edit.php file before outputing back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- ACF Photo Gallery Field
- Fixed in
- 1.7.5
- What to do
- Update ACF Photo Gallery Field to 1.7.5 or newer.
Jan 12, 2022MartDevelopers Inc iResturant v1.0 allows Stored XSS by placing a payload in the username field during a login attempt.CVE-2021-43436 · Other software · Iresturant Project · reported by MITREMedium 5.4
MartDevelopers Inc iResturant v1.0 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.
- Product
- Iresturant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.CVE-2022-22844 · Other software · Libtiff · reported by MITREMedium 5.5
LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.
- Product
- Libtiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order.CVE-2021-22569 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comHigh 7.5
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
- Product
- protobuf-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jan 6, 2022The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.CVE-2021-36739 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.
- Product
- Apache Portals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jan 6, 2022The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks.CVE-2021-36738 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact
- Product
- Apache Portals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jan 6, 2022The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks.CVE-2021-36737 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact
- Product
- Apache Portals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jan 3, 2022WP Travel Engine: Does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pagesCVE-2021-24680 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed
- Product
- WP Travel Engine
- Fixed in
- 5.3.1
- What to do
- Update WP Travel Engine to 5.3.1 or newer.
Dec 29, 2021In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.CVE-2021-25990 · Other software · ifmeorg · reported by vulnerabilitylab@mend.ioMedium 5.4
In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.
- Product
- ifme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Dec 27, 2021Tickera: Does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboardCVE-2021-24797 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
- Product
- Tickera
- Fixed in
- 3.4.8.3
- What to do
- Update Tickera to 3.4.8.3 or newer.
Dec 21, 2021A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_dump_vrml_dyn_field.isra function, which causes a segmentation fault and application craCVE-2021-44923 · Other software · Gpac · reported by MITREMedium 5.5
A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_dump_vrml_dyn_field.isra function, which causes a segmentation fault and application crash.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2021A Null Pointer Dereference vulnerability exists in gpac 1.1.0 in the gf_node_get_field function, which can cause a segmentation fault and application crash.CVE-2021-44918 · Other software · Gpac · reported by MITREMedium 5.5
A Null Pointer Dereference vulnerability exists in gpac 1.1.0 in the gf_node_get_field function, which can cause a segmentation fault and application crash.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2021PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field.CVE-2012-20001 · Websites & servers · Prestashop · reported by MITREMedium 6.1
PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field.
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 20, 2021Stored XSS in Signup Form in iResturant 1.0 Allows Remote Attacker to Inject Arbitrary code via NAME and ADDRESS fieldCVE-2021-43438 · Other software · Iresturant Project · reported by MITREMedium 5.4
Stored XSS in Signup Form in iResturant 1.0 Allows Remote Attacker to Inject Arbitrary code via NAME and ADDRESS field
- Product
- Iresturant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021In code generated by BuildParcelFields of generate_cpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory of a target process CVE-2021-0966 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In code generated by BuildParcelFields of generate_cpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory of a target process due to uninitialized data. This could lead to local information disclosure across Binder transactions with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-198346478
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2021Get Custom Field Values: Allows users with a roleCVE-2021-24872 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata.
- Product
- Get Custom Field Values
- Fixed in
- 4.0
- What to do
- Update Get Custom Field Values to 4.0 or newer.
Dec 13, 2021Get Custom Field Values: Does not escape custom fields before outputting them in the pageCVE-2021-24871 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- Get Custom Field Values
- Fixed in
- 4.0.1
- What to do
- Update Get Custom Field Values to 4.0.1 or newer.
Dec 13, 2021Display Post Metadata: Adds a shortcode to print out custom fieldsCVE-2021-24855 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
- Product
- Display Post Metadata
- Fixed in
- 1.5.0
- What to do
- Update Display Post Metadata to 1.5.0 or newer.
Dec 13, 2021Flex Local Fonts: Does not escape the Class Name fieldCVE-2021-24782 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could allow hight privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Flex Local Fonts
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Flex Local Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021Inspirational Quote Rotator: Does not sanitize and escape some of its quote fieldsCVE-2021-24771 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Inspirational Quote Rotator WordPress plugin through 1.0.0 does not sanitize and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the "Quotes list" even when the unfiltered_html capability is disallowed
- Product
- Inspirational Quote Rotator
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Inspirational Quote Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021moving the field group which may allow a user to move the unauthorized field group: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20867 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors.
- Product
- moving the field group which may allow a user to move the unauthorized field group
- What to do
- Update moving the field group which may allow a user to move the unauthorized field group to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.