Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
314 results · page 4 of 7
Jan 26, 2024An issue in Luxe Beauty Clinic mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-48126 · Other software · Linecorp · reported by MITREMedium 5.4
An issue in Luxe Beauty Clinic mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature.CVE-2024-22636 · Other software · Pluxml · reported by MITREHigh 8.8
PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature. This vulnerability is exploited via injecting a crafted payload into the Content field.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2023SQL Injection vulnerability in the Innovadeluxe Quick Order module for PrestaShop before v.1.4.0, allows local attackers to execute arbitrary code via the getPrCVE-2023-46989 · Other software · Innovadeluxe · reported by MITREHigh 7.8
SQL Injection vulnerability in the Innovadeluxe Quick Order module for PrestaShop before v.1.4.0, allows local attackers to execute arbitrary code via the getProducts() function in the productlist.php file.
- Product
- Quick Order
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Dec 1, 2023A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request.CVE-2023-48886 · Other software · Luxiaoxun · reported by MITRECritical 9.8
A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request.
- Product
- Nettyrpc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remoCVE-2023-47175 · Other software · LuxSoft · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the product.
- Product
- LuxCal Web Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauCVE-2023-46700 · Other software · LuxSoft · reported by vultures@jpcert.or.jpCritical 9.8
SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request, and obtain or alter information stored in the database.
- Product
- LuxCal Web Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2023SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauCVE-2023-39939 · Other software · LuxSoft · reported by vultures@jpcert.or.jpCritical 9.1
SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute arbitrary queries against the database and obtain or alter the information in it.
- Product
- LuxCal Web Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2023Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remoCVE-2023-39543 · Other software · LuxSoft · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product.
- Product
- LuxCal Web Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2023An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.geCVE-2023-38889 · Other software · Alluxio · reported by MITRECritical 9.8
An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).
- Product
- Alluxio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2023Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and thCVE-2023-34034 · Other software · VMware · reported by security@vmware.comCritical 9.1
Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.
- Product
- Spring Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comspring.io
Jul 14, 2023Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in a GitOps way.CVE-2023-34236 · Other software · weaveworks · reported by GitHubHigh 8.5
Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in a GitOps way. A vulnerability has been identified in Weave GitOps Terraform Controller which could allow an authenticated remote attacker to view sensitive information. This vulnerability stems from Weave GitOps Terraform Runners (`tf-runner`), where sensitive data is inadvertently printed - potentially revealing sensitive user data in their pod logs. In particular, functions `tfexec.ShowPlan`, `tfexec.ShowPlanRaw`, and `tfexec.Output` are implicated when the `tfexec` object set its `Stdout` and `Stderr` to be `os.Stdout` and `os.Stderr`. An unauthorized remote attacker could exploit this vulnerability by accessing these prints of sensitive information, which may contain configurations or tokens that could be used to gain unauthorized control or access to resources managed by the Terraform controller. A successful exploit could allow the attacker to utilize this sensitive data, potentially leading to unauthorized access or control of the system. This vulnerability has been addressed in Weave GitOps Terraform Controller versions `v0.14.4` and `v0.15.0-rc.5`. Users
- Product
- tf-controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the browse board component.CVE-2020-21485 · Other software · Alluxio · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the browse board component.
- Product
- Alluxio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023Shoppingfeed PrestaShop is an add-on to the PrestaShop ecommerce platform to synchronize data.CVE-2023-28839 · Other software · shoppingflux · reported by GitHubCritical 9.4
Shoppingfeed PrestaShop is an add-on to the PrestaShop ecommerce platform to synchronize data. The module Shoppingfeed for PrestaShop is vulnerable to SQL injection between version 1.4.0 and 1.8.2 due to a lack of input sanitization. This issue has been addressed in version 1.8.3. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- module-prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023Miniflux is a feed reader.CVE-2023-27592 · Other software · miniflux · reported by GitHubMedium 4.8
Miniflux is a feed reader. Since v2.0.25, Miniflux will automatically proxy images served over HTTP to prevent mixed content errors. When an outbound request made by the Go HTTP client fails, the `html.ServerError` is returned unescaped without the expected Content Security Policy header added to valid responses. By creating an RSS feed item with the inline description containing an `<img>` tag with a `srcset` attribute pointing to an invalid URL like `http:a<script>alert(1)</script>`, we can coerce the proxy handler into an error condition where the invalid URL is returned unescaped and in full. This results in JavaScript execution on the Miniflux instance as soon as the user is convinced (e.g. by a message in the alt text) to open the broken image. An attacker can execute arbitrary JavaScript in the context of a victim Miniflux user when they open a broken image in a crafted RSS feed. This can be used to perform actions on the Miniflux instance as that user and gain administrative access to the Miniflux instance if it is reachable and the victim is an administrator. A patch is available in version 2.0.43. As a workaround sisable image proxy; default value is `http-only`.
- Product
- v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023Miniflux is a feed reader.CVE-2023-27591 · Other software · miniflux · reported by GitHubHigh 7.5
Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the `METRICS_COLLECTOR` configuration option is enabled and `METRICS_ALLOWED_NETWORKS` is set to `127.0.0.1/8` (the default). A patch is available in Miniflux 2.0.43. As a workaround, set `METRICS_COLLECTOR` to `false` (default) or run Miniflux behind a trusted reverse-proxy.
- Product
- v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023Luxon is a library for working with dates and times in JavaScript.CVE-2023-22467 · Other software · moment · reported by GitHubHigh 7.5
Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.
- Product
- luxon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022A vulnerability was found in rAthena FluxCP.CVE-2022-4421 · Other software · rAthena · reported by VulDBLow 3.5
A vulnerability was found in rAthena FluxCP. It has been classified as problematic. Affected is an unknown function of the file themes/default/servicedesk/view.php of the component Service Desk Image URL Handler. The manipulation of the argument sslink leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 8a39b2b2bf28353b3503ff1421862393db15aa7e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215304.
- Product
- FluxCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being adjacent to the devCVE-2021-34577 · Other software · Kaden · reported by info@cert.vde.comMedium 6.5
In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being adjacent to the device.
- Product
- PICOFLUX AiR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfit.vutbr.czfit.vutbr.cz
Oct 21, 2022Flux is an open and extensible continuous delivery solution for Kubernetes.CVE-2022-39272 · Other software · fluxcd · reported by GitHubMedium 5
Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.
- Product
- flux2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2022Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to deCVE-2022-36049 · Other software · fluxcd · reported by GitHubHigh 7.7
Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK that affects flux2 v0.0.17 until v0.32.0 and helm-controller v0.0.4 until v0.23.0 allows for specific data inputs to cause high memory consumption. In some platforms, this could cause the controller to panic and stop processing reconciliations. In a shared cluster multi-tenancy environment, a tenant could create a HelmRelease that makes the controller panic, denying all other tenants from their Helm releases being reconciled. Patches are available in flux2 v0.32.0 and helm-controller v0.23.0.
- Product
- flux2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugs.chromium.org
Sep 2, 2022influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands.CVE-2022-36640 · Other software · Influxdata · reported by MITRECritical 9.8
influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization."
- Product
- Influxdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrsecu.comdl.influxdata.com
Aug 31, 2022Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration (like Git repositories), and automating updates to configuration when thereCVE-2022-36035 · Other software · fluxcd · reported by GitHubHigh 7.7
Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration (like Git repositories), and automating updates to configuration when there is new code to deploy. Flux CLI allows users to deploy Flux components into a Kubernetes cluster via command-line. The vulnerability allows other applications to replace the Flux deployment information with arbitrary content which is deployed into the target Kubernetes cluster instead. The vulnerability is due to the improper handling of user-supplied input, which results in a path traversal that can be controlled by the attacker. Users sharing the same shell between other applications and the Flux CLI commands could be affected by this vulnerability. In some scenarios no errors may be presented, which may cause end users not to realize that something is amiss. A safe workaround is to execute Flux CLI in ephemeral and isolated shell environments, which can ensure no persistent values exist from previous processes. However, upgrading to the latest version of the CLI is still the recommended mitigation strategy.
- Product
- flux2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022The GitOps Tools Extension for VSCode can make it easier to manage Flux objects.CVE-2022-35975 · Other software · weaveworks · reported by GitHubCritical 9
The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the machine running the extension, in the context of the user that is running VSCode. Users using the VSCode extension to manage clusters that are shared amongst other users are affected by this issue. The only safe mitigation is to update to the latest version of the extension.
- Product
- vscode-gitops-tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.CVE-2022-35628 · Other software · In2code · reported by MITRECritical 9.8
A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.
- Product
- Living User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The Luxas98/logstash-management-api repository through 2020-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafelyCVE-2022-31520 · Other software · Logstash-management-api Project · reported by MITRECritical 9.3
The Luxas98/logstash-management-api repository through 2020-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Logstash-management-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a cookie value.CVE-2021-45915 · Other software · Luxsoft · reported by MITRECritical 9.8
In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a cookie value. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator.
- Product
- Luxcal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comh1pmnh.github.io
May 24, 2022In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request.CVE-2021-45914 · Other software · Luxsoft · reported by MITRECritical 9.8
In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator.
- Product
- Luxcal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comh1pmnh.github.io
May 5, 2022Flux is an open and extensible continuous delivery solution for Kubernetes.CVE-2022-24878 · Other software · fluxcd · reported by GitHubHigh 7.7
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0. Users are recommended to upgrade.
- Product
- flux2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022Flux is an open and extensible continuous delivery solution for Kubernetes.CVE-2022-24877 · Other software · fluxcd · reported by GitHubCritical 9.9
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user's CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0.
- Product
- flux2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022Flux2 is an open and extensible continuous delivery solution for Kubernetes.CVE-2022-24817 · Other software · fluxcd · reported by GitHubCritical 9.9
Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0
- Product
- flux2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail patCVE-2022-25020 · Other software · Pluxml · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcvedetails.com
Feb 28, 2022Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.CVE-2022-25018 · Other software · Pluxml · reported by MITREHigh 8.8
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2022In Alluxio before 2.7.3, the logserver does not validate the input stream.CVE-2022-23848 · Other software · Alluxio · reported by MITRECritical 9.8
In Alluxio before 2.7.3, the logserver does not validate the input stream. NOTE: this is not the same as the CVE-2021-44228 Log4j vulnerability.
- Product
- Alluxio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HCVE-2022-24587 · Other software · Pluxml · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts orCVE-2022-24585 · Other software · Pluxml · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the author parameter.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scriptsCVE-2022-24586 · Other software · Pluxml · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content and thumbnail parameters.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2022Fluxbb v1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability.CVE-2021-43677 · Other software · Fluxbb · reported by MITREMedium 6.1
Fluxbb v1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability.
- Product
- Fluxbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2021kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined with Kubernetes manCVE-2021-41254 · Other software · fluxcd · reported by GitHubHigh 8.8
kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined with Kubernetes manifests and assembled with Kustomize. Users that can create Kubernetes Secrets, Service Accounts and Flux Kustomization objects, could execute commands inside the kustomize-controller container by embedding a shell script in a Kubernetes Secret. This can be used to run `kubectl` commands under the Service Account of kustomize-controller, thus allowing an authenticated Kubernetes user to gain cluster admin privileges. In affected versions multitenant environments where non-admin users have permissions to create Flux Kustomization objects are affected by this issue. This vulnerability was fixed in kustomize-controller v0.15.0 (included in flux2 v0.18.0) released on 2021-10-08. Starting with v0.15, the kustomize-controller no longer executes shell commands on the container OS and the `kubectl` binary has been removed from the container image. To prevent the creation of Kubernetes Service Accounts with `secrets` in namespaces owned by tenants, a Kubernetes validation webhook such as Gatekeeper OPA or Kyverno can be used.
- Product
- kustomize-controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2021In Kaden PICOFLUX Air in all known versions an information exposure through observable discrepancy exists.CVE-2021-34576 · Other software · Kaden · reported by info@cert.vde.comMedium 4.3
In Kaden PICOFLUX Air in all known versions an information exposure through observable discrepancy exists. This may give sensitive information (water consumption without distinct values) to third parties.
- Product
- PICOFLUX AiR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfit.vutbr.czfit.vutbr.cz
Aug 12, 2021PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field.CVE-2021-38603 · Other software · Pluxml · reported by MITREMedium 4.8
PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 12, 2021PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content.CVE-2021-38602 · Other software · Pluxml · reported by MITREMedium 4.8
PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2021In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creCVE-2021-22118 · Other software · VMware · reported by security@vmware.comHigh 7.8
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- Product
- Spring Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comtanzu.vmware.com
Apr 12, 2021Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme bCVE-2021-24220 · WordPress plugins & themes · reported by WPScanCritical 9.1
Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.
- Fixed in
- 2.0.0
- What to do
- Update the plugin to 2.0.0 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Mar 17, 2021Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form.CVE-2020-28873 · Other software · Fluxbb · reported by MITREHigh 7.5
Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sent, the password hashing process will result in CPU and memory exhaustion on the server.
- Product
- Fluxbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordacunetix.comacunetix.com
Feb 23, 2021When loading a specially crafted file, Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering verCVE-2021-22651 · Other software · Luxion · reported by ics-cert@hq.dhs.govHigh 7.8
When loading a specially crafted file, Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are, while processing the extraction of temporary files, suffering from a directory traversal vulnerability, which allows an attacker to store arbitrary scripts into automatic startup folders.
- Product
- Keyshot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comus-cert.cisa.gov
Feb 22, 2021Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR vCVE-2021-22649 · Other software · Luxion · reported by ics-cert@hq.dhs.govHigh 7.8
Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 have multiple NULL pointer dereference issues while processing project files, which may allow an attacker to execute arbitrary code.
- Product
- Keyshot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comus-cert.cisa.gov
Feb 22, 2021Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR vCVE-2021-22647 · Other software · Luxion · reported by ics-cert@hq.dhs.govHigh 7.8
Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are vulnerable to multiple out-of-bounds write issues while processing project files, which may allow an attacker to execute arbitrary code.
- Product
- Keyshot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comus-cert.cisa.gov
Feb 22, 2021Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR vCVE-2021-22645 · Other software · Luxion · reported by ics-cert@hq.dhs.govHigh 7.8
Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are vulnerable to an attack because the .bip documents display a “load” command, which can be pointed to a .dll from a remote network share. As a result, the .dll entry point can be executed without sufficient UI warning.
- Product
- Keyshot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comus-cert.cisa.gov
Feb 22, 2021Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR vCVE-2021-22643 · Other software · Luxion · reported by ics-cert@hq.dhs.govHigh 7.8
Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are vulnerable to an out-of-bounds read while processing project files, which may allow an attacker to execute arbitrary code.
- Product
- Keyshot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comus-cert.cisa.gov
Dec 30, 2020FluxBB 1.5.11 is affected by cross-site scripting (XSS in the Blog Content component.CVE-2020-35240 · Other software · Fluxbb · reported by MITREMedium 4.8
FluxBB 1.5.11 is affected by cross-site scripting (XSS in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in "Blog Content" and each time any user will visit the blog, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.
- Product
- Fluxbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.