Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,841 results · page 39 of 77
Aug 22, 2023Stack overflow vulnerability in OpenSC smart card middleware before 0.23 via crafted responses to APDUs.CVE-2021-34193 · Other software · Opensc Project · reported by MITREHigh 7.5
Stack overflow vulnerability in OpenSC smart card middleware before 0.23 via crafted responses to APDUs.
- Product
- Opensc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugs.chromium.org
Aug 14, 2023LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers.CVE-2023-40518 · Other software · Litespeedtech · reported by MITREHigh 7.5
LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers.
- Product
- Openlitespeed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenlitespeed.orglitespeedtech.com
Aug 9, 2023Out-of-bounds Write in BuildOemEmbmsGetSigStrengthResponse of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.CVE-2023-30689 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.7
Out-of-bounds Write in BuildOemEmbmsGetSigStrengthResponse of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Aug 9, 2023Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7 allows the authorized API users to view CVE-2023-38752 · Other software · Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) · reported by vultures@jpcert.or.jpMedium 4.3
Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7 allows the authorized API users to view the attribute information of the poster that is set as"non-disclosure" in the system settings.
- Product
- Special Interest Group Network for Analysis and Liaison
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2023Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7 allows the authorized API users to view CVE-2023-38751 · Other software · Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) · reported by vultures@jpcert.or.jpMedium 4.3
Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7 allows the authorized API users to view the organization information of the information receiver that is set as "non-disclosure" in the information provision operation.
- Product
- Special Interest Group Network for Analysis and Liaison
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2023Information disclosure in Network Services due to buffer over-read while the device receives DNS response.CVE-2023-21625 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.2
Information disclosure in Network Services due to buffer over-read while the device receives DNS response.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Aug 2, 2023Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be.CVE-2023-3978 · Other software · golang.org/x/net · reported by security@golang.orgMedium 6.1
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
- Product
- golang.org/x/net/html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2023The "OX Count" web service did not specify a media-type when processing responses by external resources.CVE-2023-26450 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.4
The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We are now defining the accepted media-type to avoid code execution. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 2, 2023The "OX Chat" web service did not specify a media-type when processing responses by external resources.CVE-2023-26449 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.4
The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We are now defining the accepted media-type to avoid code execution. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 30, 2023 Tadiran Telecom Aeonix - CWE-204: Observable Response DiscrepancyCVE-2023-37217 · Other software · Tadiran · reported by cna@cyber.gov.ilMedium 5.3
Tadiran Telecom Aeonix - CWE-204: Observable Response Discrepancy
- Product
- Telecom Aeonix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2023An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service.CVE-2023-3774 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.9
An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service. Fixed in 1.14.1, 1.13.5, and 1.12.9.
- Product
- Vault Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Jul 21, 2023Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key.CVE-2023-37291 · Other software · Galaxy Software Services · reported by twcert@cert.org.twHigh 8.6
Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter and exploit this vulnerability to access system to operate processes and access data. This issue affects Vitals ESP: from 3.0.8 through 6.2.0.
- Product
- Vitals ESP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 20, 2023A HTTP response header injection vulnerability in Swoole v4.5.2 allows attackers to execute arbitrary code via supplying a crafted URL.CVE-2020-24275 · Other software · Swoole · reported by MITREMedium 6.5
A HTTP response header injection vulnerability in Swoole v4.5.2 allows attackers to execute arbitrary code via supplying a crafted URL.
- Product
- Swoole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.cal1.cngithub.com
Jul 19, 2023 Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only.CVE-2023-35134 · Other software · Weintek · reported by ics-cert@hq.dhs.govHigh 7.4
Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only.
- Product
- Weincloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2023In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.CVE-2023-3638 · Other software · GeoVision · reported by ics-cert@hq.dhs.govCritical 9.8
In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.
- Product
- GV-ADR2701
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023 URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header.CVE-2023-28020 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.7
URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header.
- Product
- HCL BigFix WebUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 17, 2023Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making the server unresponsiveCVE-2023-3614 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making the server unresponsive for an extended period of time by linking to specially crafted image file.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jul 17, 2023An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices.CVE-2023-35818 · Other software · Espressif · reported by MITREMedium 6.8
An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices. An EMFI attack on ECO3 provides the attacker with a capability to influence the PC value at the CPU context level, regardless of Secure Boot and Flash Encryption status. By using this capability, the attacker can exploit another behavior in the chip to gain unauthorized access to the ROM download mode. Access to ROM download mode may be further exploited to read the encrypted flash content in cleartext format or execute stub code.
- Product
- Esp32-d0wd-v3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordespressif.comespressif.com
Jul 17, 2023 Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind CVE-2023-34036 · Other software · Spring · reported by security@vmware.comMedium 5.3
Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server. For the application to be affected, it needs to satisfy the following requirements: * It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses. * The application infrastructure does not guard against clients submitting (X-)Forwarded… headers.
- Product
- Spring HATEOAS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023Server information leak of configuration data when an error is generated in response to a specially crafted message.CVE-2023-25948 · Other software · Honeywell · reported by psirt@honeywell.comHigh 7.5
Server information leak of configuration data when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.
- Product
- Experion Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprocess.honeywell.comprocess.honeywell.com
Jul 13, 2023Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message.CVE-2023-25770 · Other software · Honeywell · reported by psirt@honeywell.comCritical 9.8
Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.
- Product
- C300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprocess.honeywell.comprocess.honeywell.com
Jul 10, 2023In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Referrer-Policy response header is not imCVE-2023-36919 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Referrer-Policy response header is not implemented, allowing an unauthenticated attacker to obtain referrer details, resulting in information disclosure.
- Product
- SAP Enable Now
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jul 10, 2023In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header isCVE-2023-36918 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header is not implemented, allowing an unauthenticated attacker to trigger MIME type sniffing, which leads to Cross-Site Scripting, which could result in disclosure or modification of information.
- Product
- SAP Enable Now
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jul 10, 2023Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given duringCVE-2023-35698 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt.
- Product
- ICR890-4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addCVE-2023-26137 · Other software · Drogon · reported by report@snyk.ioHigh 7.2
All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content.
- Product
- Drogon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsecurity.snyk.io
Jul 5, 2023Out-of-bounds Write in BuildOemSecureSimLockResponse of libsec-ril prior to SMR Jul-2023 Release 1 allows local attacker to execute arbitrary code.CVE-2023-30668 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.7
Out-of-bounds Write in BuildOemSecureSimLockResponse of libsec-ril prior to SMR Jul-2023 Release 1 allows local attacker to execute arbitrary code.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jul 4, 2023Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.CVE-2023-24854 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jul 4, 2023Memory Corruption in WLAN HOST while parsing QMI response message from firmware.CVE-2023-24851 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jul 1, 2023Event Espresso 4 Decaf: Cross-Site Request ForgeryCVE-2021-4404 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event Espresso 4 Decaf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.11. This is due to missing or incorrect nonce validation on the ajaxHandler() function. This makes it possible for unauthenticated attackers to op into notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Event Espresso 4 Decaf
- Affected
- up to 4.10.11
- What to do
- Affects up to 4.10.11. Update Event Espresso 4 Decaf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jun 30, 2023In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when aCVE-2023-29147 · Other software · Malwarebytes · reported by MITREMedium 5.5
In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when a file is replaced, and because two files on different filesystems can have the same identifier.
- Product
- Endpoint Detection And Response
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmalwarebytes.commalwarebytes.com
Jun 30, 2023The Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by executable files, allowing arbitrary code exCVE-2023-29145 · Other software · Malwarebytes · reported by MITREHigh 7.8
The Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by executable files, allowing arbitrary code execution. The attacker can set LD_LIBRARY_PATH, set LD_PRELOAD, or run an executable file in a debugger.
- Product
- Endpoint Detection And Response
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmalwarebytes.commalwarebytes.com
Jun 30, 2023Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other CVE-2023-3485 · Other software · Temporal Technologies Inc. · reported by security@temporal.ioLow 3
Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires the namespace UUID and information from the workflow history for the target namespace. Under these conditions, it is possible to interfere with pending tasks in other namespaces, such as marking a task failed or completed. If a task is targeted for completion by the attacker, the targeted namespace must also be using the same data converter configuration as the initial, valid, namespace for the task completion payload to be decoded by workers in the target namespace.
- Product
- Temporal Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 responds with a "404 - Not Found" status code if a path is accessed that does notCVE-2023-33276 · Other software · gira · reported by MITREMedium 6.1
The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 responds with a "404 - Not Found" status code if a path is accessed that does not exist. However, the value of the path is reflected in the response. As the application will reflect the supplied path without context-sensitive HTML encoding, it is vulnerable to reflective cross-site scripting (XSS).
- Product
- knx_ip_router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023In LogResponse of Dns.cpp, there is a possible out of bounds read due to a missing bounds check.CVE-2023-21186 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In LogResponse of Dns.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-261079188
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 28, 2023In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE.CVE-2022-44276 · Other software · Tecrail · reported by MITRECritical 9.8
In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE.
- Product
- Responsive Filemanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2023An issue was discovered in espcms version P8.18101601.CVE-2020-18404 · Other software · Ecisp · reported by MITREMedium 4.8
An issue was discovered in espcms version P8.18101601. There is a cross site scripting (XSS) vulnerability that allows arbitrary code to be executed via the title parameter.
- Product
- Espcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2023KiviCare: Does not restrict the information returned in a response and returns all user dataCVE-2023-2623 · WordPress plugins & themes · reported by WPScanMedium 6.5
The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users
- Product
- KiviCare
- Fixed in
- 3.2.1
- What to do
- Update KiviCare to 3.2.1 or newer.
Jun 27, 2023Responsive CSS EDITOR: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2482 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admin.
- Product
- Responsive CSS EDITOR
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Responsive CSS EDITOR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2023Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoriCVE-2023-2828 · Other software · ISC · reported by security-officer@isc.orgHigh 7.5
Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit. It has been discovered that the effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
- Product
- BIND 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comkb.isc.org
Jun 21, 2023A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SECVE-2023-34981 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
- Product
- Apache Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgsecurity.netapp.com
Jun 20, 2023When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes.CVE-2023-26434 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 4.3
When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted POP3 server response to reasonable length/size. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 20, 2023When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes.CVE-2023-26433 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 4.3
When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue IMAP service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted IMAP server response to reasonable length/size. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 20, 2023When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes.CVE-2023-26432 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 4.3
When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue SMTP service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted SMTP server response to reasonable length/size. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 19, 2023Responsive Tabs For WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0368 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Responsive Tabs For WPBakery Page Builder (formerly Visual Composer)
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2023An information disclosure vulnerability in the faye endpoint in Proofpoint Threat Response / Threat Response Auto-Pull (PTR/TRAP) could be used by an attacker oCVE-2023-2820 · Other software · Proofpoint · reported by security@proofpoint.comMedium 6.1
An information disclosure vulnerability in the faye endpoint in Proofpoint Threat Response / Threat Response Auto-Pull (PTR/TRAP) could be used by an attacker on an adjacent network to obtain credentials to integrated services via a man-in-the-middle position or cryptanalysis of the session traffic. An attacker could use these credentials to impersonate PTR/TRAP to these services. All versions prior to 5.10.0 are affected.
- Product
- Threat Response Auto Pull
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordproofpoint.comproofpoint.com
Jun 14, 2023A stored cross-site scripting vulnerability in the Sources UI in Proofpoint Threat Response/ Threat Response Auto Pull (PTR/TRAP) could allow an authenticated aCVE-2023-2819 · Other software · Proofpoint · reported by security@proofpoint.comMedium 4.3
A stored cross-site scripting vulnerability in the Sources UI in Proofpoint Threat Response/ Threat Response Auto Pull (PTR/TRAP) could allow an authenticated administrator on an adjacent network to replace the image file with an arbitrary MIME type. This could result in arbitrary javascript code execution in an admin context. All versions prior to 5.10.0 are affected.
- Product
- Threat Response Auto Pull
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordproofpoint.comproofpoint.com
Jun 9, 2023WP Responsive Tabs horizontal vertical and accordion Tabs: Reflected Cross-Site ScriptingCVE-2023-2184 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Responsive Tabs horizontal vertical and accordion Tabs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.1.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Responsive Tabs horizontal vertical and accordion Tabs
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update WP Responsive Tabs horizontal vertical and accordion Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 8, 2023Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter shareSpeed at /goform/WifiGuestSet.CVE-2023-34571 · Network & remote access · Tenda · reported by MITREMedium 6.7
Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter shareSpeed at /goform/WifiGuestSet.
- Product
- Ac10 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023Transient DOS while parsing WLAN beacon or probe-response frame.CVE-2023-21661 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Transient DOS while parsing WLAN beacon or probe-response frame.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 6, 2023Transient DOS in WLAN Firmware while processing the received beacon or probe response frame.CVE-2023-21658 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Transient DOS in WLAN Firmware while processing the received beacon or probe response frame.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.