Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
335 results · page 4 of 7
Sep 20, 2023Cross Site Scripting (XSS) vulnerability in Netbox 3.5.1, allows attackers to execute arbitrary code via Name field in device-roles/add function.CVE-2023-36234 · Other software · Netbox · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in Netbox 3.5.1, allows attackers to execute arbitrary code via Name field in device-roles/add function.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.18, allows attackers to execute arbitrary CVE-2021-26837 · Other software · Fortra · reported by MITRECritical 9.8
SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.18, allows attackers to execute arbitrary code, escalate privileges, and gain sensitive information.
- Product
- Delivernow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.helpsystems.comsusos.co
Aug 10, 2023A stored cross-site scripting (XSS) vulnerability in Netbox v3.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected intoCVE-2023-37625 · Other software · Netbox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Netbox v3.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Link templates.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023Cross Site Scripting (XSS) vulnerability in username field in /WebContent/WEB-INF/lib/chatbox.jsp in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862fCVE-2023-30326 · Other software · Chatengine Project · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in username field in /WebContent/WEB-INF/lib/chatbox.jsp in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code.
- Product
- Chatengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2023 All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory.CVE-2023-3395 · Other software · Ovarro · reported by ics-cert@hq.dhs.govMedium 6.5
All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file to load the document into memory, including sensitive information associated with document, such as password. The attacker could then obtain the plaintext password by using a memory viewer.
- Product
- TBox MS-CPU32
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2023 The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege.CVE-2023-36611 · Other software · Ovarro · reported by ics-cert@hq.dhs.govMedium 6.5
The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. This could allow an attacker with “user” privileges to access files requiring higher privileges by establishing an SSH session and providing the other tokens.
- Product
- TBox MS-CPU32
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2023 The affected TBox RTUs generate software security tokens using insufficient entropy.CVE-2023-36610 · Other software · Ovarro · reported by ics-cert@hq.dhs.govMedium 5.9
The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized correctly, and other parts of the token are generated using predictable time-based values. An attacker with this knowledge could successfully brute force the token and authenticate themselves.
- Product
- TBox MS-CPU32
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2023 The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts.CVE-2023-36609 · Other software · Ovarro · reported by ics-cert@hq.dhs.govHigh 7.2
The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges.
- Product
- TBox MS-CPU32
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2023 The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm.CVE-2023-36608 · Other software · Ovarro · reported by ics-cert@hq.dhs.govMedium 6.5
The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm.
- Product
- TBox MS-CPU32
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2023The affected TBox RTUs are missing authorization for running some API commands.CVE-2023-36607 · Other software · Ovarro · reported by ics-cert@hq.dhs.govMedium 5.3
The affected TBox RTUs are missing authorization for running some API commands. An attacker running these commands could reveal sensitive information such as software versions and web server file contents.
- Product
- TBox RM2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023Netbox 3.5.1 is vulnerable to Cross Site Scripting (XSS) in the "Create Wireless LAN Groups" function.CVE-2023-34565 · Other software · Netbox · reported by MITREMedium 5.4
Netbox 3.5.1 is vulnerable to Cross Site Scripting (XSS) in the "Create Wireless LAN Groups" function.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2023Team Circle Image Slider With Lightbox: Reflected Cross-Site ScriptingCVE-2023-2604 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Team Circle Image Slider With Lightbox
- Affected
- up to 1.0.17
- What to do
- Affects up to 1.0.17. Update Team Circle Image Slider With Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 24, 2023A stored cross-site scripting (XSS) vulnerability in the Create Regions (/dcim/regions/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scrCVE-2023-33800 · Other software · Netbox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Create Regions (/dcim/regions/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A stored cross-site scripting (XSS) vulnerability in the Create Contacts (/tenancy/contacts/) function of Netbox v3.5.1 allows attackers to execute arbitrary weCVE-2023-33799 · Other software · Netbox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Create Contacts (/tenancy/contacts/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A stored cross-site scripting (XSS) vulnerability in the Create Rack (/dcim/rack/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts oCVE-2023-33798 · Other software · Netbox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Create Rack (/dcim/rack/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A stored cross-site scripting (XSS) vulnerability in the Create Sites (/dcim/sites/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scriptsCVE-2023-33797 · Other software · Netbox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Create Sites (/dcim/sites/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to sensitive data storedCVE-2023-33796 · Other software · Netbox · reported by MITRECritical 9.1
A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to sensitive data stored in the database. NOTE: the vendor disputes this because the reporter's only query was for the schema of the API, which is public; queries for database objects would have been denied.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A stored cross-site scripting (XSS) vulnerability in the Create Contact Roles (/tenancy/contact-roles/) function of Netbox v3.5.1 allows attackers to execute arCVE-2023-33795 · Other software · Netbox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Create Contact Roles (/tenancy/contact-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A stored cross-site scripting (XSS) vulnerability in the Create Tenants (/tenancy/tenants/) function of Netbox v3.5.1 allows attackers to execute arbitrary web CVE-2023-33794 · Other software · Netbox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Create Tenants (/tenancy/tenants/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A stored cross-site scripting (XSS) vulnerability in the Create Power Panels (/dcim/power-panels/) function of Netbox v3.5.1 allows attackers to execute arbitraCVE-2023-33793 · Other software · Netbox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Create Power Panels (/dcim/power-panels/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A stored cross-site scripting (XSS) vulnerability in the Create Site Groups (/dcim/site-groups/) function of Netbox v3.5.1 allows attackers to execute arbitraryCVE-2023-33792 · Other software · Netbox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Create Site Groups (/dcim/site-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A stored cross-site scripting (XSS) vulnerability in the Create Provider Accounts (/circuits/provider-accounts/) function of Netbox v3.5.1 allows attackers to eCVE-2023-33791 · Other software · Netbox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Create Provider Accounts (/circuits/provider-accounts/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A stored cross-site scripting (XSS) vulnerability in the Create Locations (/dcim/locations/) function of Netbox v3.5.1 allows attackers to execute arbitrary webCVE-2023-33790 · Other software · Netbox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Create Locations (/dcim/locations/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A stored cross-site scripting (XSS) vulnerability in the Create Contact Groups (/tenancy/contact-groups/) function of Netbox v3.5.1 allows attackers to execute CVE-2023-33789 · Other software · Netbox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Create Contact Groups (/tenancy/contact-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A stored cross-site scripting (XSS) vulnerability in the Create Providers (/circuits/providers/) function of Netbox v3.5.1 allows attackers to execute arbitraryCVE-2023-33788 · Other software · Netbox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Create Providers (/circuits/providers/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A stored cross-site scripting (XSS) vulnerability in the Create Tenant Groups (/tenancy/tenant-groups/) function of Netbox v3.5.1 allows attackers to execute arCVE-2023-33787 · Other software · Netbox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Create Tenant Groups (/tenancy/tenant-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A stored cross-site scripting (XSS) vulnerability in the Create Circuit Types (/circuits/circuit-types/) function of Netbox v3.5.1 allows attackers to execute aCVE-2023-33786 · Other software · Netbox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Create Circuit Types (/circuits/circuit-types/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A stored cross-site scripting (XSS) vulnerability in the Create Rack Roles (/dcim/rack-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary wCVE-2023-33785 · Other software · Netbox · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Create Rack Roles (/dcim/rack-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023video carousel slider with lightbox: Reflected Cross-Site ScriptingCVE-2023-2710 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The video carousel slider with lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-32797 may be a duplicate of this.
- Product
- video carousel slider with lightbox
- Affected
- up to 1.0.22
- What to do
- Affects up to 1.0.22. Update video carousel slider with lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.complugins.trac.wordpress.org
Apr 24, 2023Steveas WP Live Chat Shoutbox: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2023-1020 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Steveas WP Live Chat Shoutbox
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Steveas WP Live Chat Shoutbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2023Steveas WP Live Chat Shoutbox: Does not sanitise and escape a parameter before outputting it back in the ShoutboxCVE-2023-0899 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before outputting it back in the Shoutbox, leading to Stored Cross-Site Scripting which could be used against high privilege users such as admins.
- Product
- Steveas WP Live Chat Shoutbox
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Steveas WP Live Chat Shoutbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 5, 2023A heap-based buffer overflow vulnerability exists in the way Ichitaro version 2022 1.0.1.57600 processes certain LayoutBox stream record types.CVE-2023-22660 · Other software · Ichitaro · reported by talos-cna@cisco.comHigh 7
A heap-based buffer overflow vulnerability exists in the way Ichitaro version 2022 1.0.1.57600 processes certain LayoutBox stream record types. A specially crafted document can cause a buffer overflow, leading to memory corruption, which can result in arbitrary code execution.To trigger this vulnerability, the victim would need to open a malicious, attacker-created document.
- Product
- Ichitaro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jptalosintelligence.com
Mar 27, 2023Gallery Blocks with Lightbox: Has an AJAX endpoint that can be accessed by any authenticated usersCVE-2023-0441 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as subscriber. The callback function allows numerous actions, the most serious one being reading and updating the WordPress options which could be used to enable registration with a default administrator user role.
- Product
- Gallery Blocks with Lightbox
- Fixed in
- 3.0.8
- What to do
- Update Gallery Blocks with Lightbox to 3.0.8 or newer.
Feb 13, 2023Lightbox Gallery: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4682 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Lightbox Gallery
- Fixed in
- 0.9.5
- What to do
- Update Lightbox Gallery to 0.9.5 or newer.
Jan 30, 2023 Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior are vulnerable to a heap-based buffer overflow, which could allow an attacker to execute arbitrary coCVE-2023-23582 · Other software · Snap One · reported by ics-cert@hq.dhs.govMedium 5.3
Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior are vulnerable to a heap-based buffer overflow, which could allow an attacker to execute arbitrary code or crash the device remotely.
- Product
- Wattbox WB-300-IP-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2023 Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior store passwords in a plaintext file when the device configuration is exported via Save/Restore–>BackuCVE-2023-22389 · Other software · Snap One · reported by ics-cert@hq.dhs.govMedium 5.7
Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior store passwords in a plaintext file when the device configuration is exported via Save/Restore–>Backup Settings, which could be read by any user accessing the file.
- Product
- Wattbox WB-300-IP-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2023 Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a login.CVE-2023-24020 · Other software · Snap One · reported by ics-cert@hq.dhs.govHigh 7.5
Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a login.
- Product
- Wattbox WB-300-IP-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2023 Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior use a proprietary local area network (LAN) protocol that does not verify updates to the device.CVE-2023-22315 · Other software · Snap One · reported by ics-cert@hq.dhs.govMedium 6.7
Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior use a proprietary local area network (LAN) protocol that does not verify updates to the device. An attacker could upload a malformed update file to the device and execute arbitrary code.
- Product
- Wattbox WB-300-IP-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023WP Video Lightbox: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4465 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- WP Video Lightbox
- Fixed in
- 1.9.7
- What to do
- Update WP Video Lightbox to 1.9.7 or newer.
Dec 19, 2022Responsive Lightbox2: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3987 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Lightbox2 WordPress plugin before 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Responsive Lightbox2
- Fixed in
- 1.0.4
- What to do
- Update Responsive Lightbox2 to 1.0.4 or newer.
Jul 28, 2022An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code executionCVE-2021-22650 · Other software · Ovarro · reported by ics-cert@hq.dhs.govHigh 7.5
An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code execution.
- Product
- TBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2022Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file.CVE-2021-22648 · Other software · Ovarro · reported by ics-cert@hq.dhs.govHigh 8.8
Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file.
- Product
- TBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2022The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.CVE-2021-22646 · Other software · Ovarro · reported by ics-cert@hq.dhs.govHigh 8.8
The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.
- Product
- TBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2022Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key.CVE-2021-22644 · Other software · Ovarro · reported by ics-cert@hq.dhs.govHigh 7.5
Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key.
- Product
- TBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2022An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system.CVE-2021-22642 · Other software · Ovarro · reported by ics-cert@hq.dhs.govHigh 7.5
An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system.
- Product
- TBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2022An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks.CVE-2021-22640 · Other software · Ovarro · reported by ics-cert@hq.dhs.govHigh 7.5
An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks.
- Product
- TBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2022WP Video Lightbox: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2022-2189 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- WP Video Lightbox
- Fixed in
- 1.9.5
- What to do
- Update WP Video Lightbox to 1.9.5 or newer.
May 23, 2022Inout Blockchain AltExchanger 1.2.1 allows index.php/coins/update_marketboxslider marketcurrency SQL injection.CVE-2022-31488 · Other software · Inoutscripts · reported by MITREHigh 7.5
Inout Blockchain AltExchanger 1.2.1 allows index.php/coins/update_marketboxslider marketcurrency SQL injection.
- Product
- Blockchain Altexchanger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2022In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for savinCVE-2019-12254 · Other software · TECSON · reported by info@cert.vde.comCritical 9.8
In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules.
- Product
- e-litro net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Apr 26, 2022CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.CVE-2022-27985 · Other software · Cuppacms · reported by MITRECritical 9.8
CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcuppacms.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.