Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
428 results · page 4 of 9
Jul 15, 2024TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php.CVE-2024-40624 · Other software · torrentpier · reported by GitHubCritical 9.8
TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In `torrentpier/library/includes/functions.php`, `get_tracks()` uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to an arbitrary file, and execute commands on the system. For instance, the cookie bb_t will be deserialized when browsing to viewforum.php. This issue has been addressed in commit `ed37e6e52` which is expected to be included in release version 2.4.4. Users are advised to upgrade as soon as the new release is available. There are no known workarounds for this vulnerability.
- Product
- torrentpier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2024WP Visitors Tracker: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35737 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Loopus WP Visitors Tracker allows Reflected XSS.This issue affects WP Visitors Tracker: from n/a through 2.3.
- Product
- WP Visitors Tracker
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update WP Visitors Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 29, 2024In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possibleCVE-2024-36369 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
May 20, 2024In the Linux kernel, the following vulnerability has been resolved: ax25: Fix netdev refcount issue The dev_tracker is added to ax25_cb in ax25_bind().CVE-2024-36009 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: ax25: Fix netdev refcount issue The dev_tracker is added to ax25_cb in ax25_bind(). When the ax25 device is detaching, the dev_tracker of ax25_cb should be deallocated in ax25_kill_by_device() instead of the dev_tracker of ax25_dev. The log reported by ref_tracker is shown below: [ 80.884935] ref_tracker: reference already released. [ 80.885150] ref_tracker: allocated in: [ 80.885349] ax25_dev_device_up+0x105/0x540 [ 80.885730] ax25_device_event+0xa4/0x420 [ 80.885730] notifier_call_chain+0xc9/0x1e0 [ 80.885730] __dev_notify_flags+0x138/0x280 [ 80.885730] dev_change_flags+0xd7/0x180 [ 80.885730] dev_ifsioc+0x6a9/0xa30 [ 80.885730] dev_ioctl+0x4d8/0xd90 [ 80.885730] sock_do_ioctl+0x1c2/0x2d0 [ 80.885730] sock_ioctl+0x38b/0x4f0 [ 80.885730] __se_sys_ioctl+0xad/0xf0 [ 80.885730] do_syscall_64+0xc4/0x1b0 [ 80.885730] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 80.885730] ref_tracker: freed in: [ 80.885730] ax25_device_event+0x272/0x420 [ 80.885730] notifier_call_chain+0xc9/0x1e0 [ 80.885730] dev_close_many+0x272/0x370 [ 80.885730] unregister_netdevice_many_notify+
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 14, 2024WP etracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34431 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-etracker WP etracker allows Reflected XSS.This issue affects WP etracker: from n/a through 1.0.2.
- Product
- WP etracker
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WP etracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024MantisBT (Mantis Bug Tracker) is an open source issue tracker.CVE-2024-34081 · Other software · mantisbt · reported by GitHubMedium 6.6
MantisBT (Mantis Bug Tracker) is an open source issue tracker. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when resolving or closing issues (`bug_change_status_page.php`) belonging to a project linking said custom field, viewing issues (`view_all_bug_page.php`) when the custom field is displayed as a column, or printing issues (`print_all_bug_page.php`) when the custom field is displayed as a column. Version 2.26.2 contains a patch for the issue. As a workaround, ensure Custom Field Names do not contain HTML tags.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024MantisBT (Mantis Bug Tracker) is an open source issue tracker.CVE-2024-34080 · Other software · mantisbt · reported by GitHubMedium 5.3
MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024MantisBT (Mantis Bug Tracker) is an open source issue tracker.CVE-2024-34077 · Other software · mantisbt · reported by GitHubHigh 7.3
MantisBT (Mantis Bug Tracker) is an open source issue tracker. Insufficient access control in the registration and password reset process allows an attacker to reset another user's password and takeover their account, if the victim has an incomplete request pending. The exploit is only possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has been opened, and the user did not complete the process by updating their password. A brute-force attack calling account_update.php with increasing user IDs is possible. A successful takeover would grant the attacker full access to the compromised account, including sensitive information and functionalities associated with the account, the extent of which depends on its privileges and the data it has access to. Version 2.26.2 contains a patch for the issue. As a workaround, one may mitigate the risk by reducing the verification token's validity (change the value of the `TOKEN_EXPIRY_AUTHENTICATED` constant in `constants_inc.php`).
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2024Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input to the trackers_datCVE-2024-27630 · Other software · savannah · reported by MITREHigh 7.5
Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input to the trackers_data_delete_file function.
- Product
- savane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024Information exposure vulnerability in RT software affecting version 4.4.1.CVE-2024-3262 · Other software · Best Practical Solutions · reported by cve-coordination@incibe.esMedium 5.5
Information exposure vulnerability in RT software affecting version 4.4.1. This vulnerability allows an attacker with local access to the device to retrieve sensitive information about the application, such as vulnerability tickets, because the application stores the information in the browser cache, leading to information exposure despite session termination.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordincibe.eslists.debian.org
Feb 20, 2024MantisBT is an open source issue tracker.CVE-2024-23830 · Other software · mantisbt · reported by GitHubHigh 8.3
MantisBT is an open source issue tracker. Prior to version 2.26.1, an unauthenticated attacker who knows a user's email address and username can hijack the user's account by poisoning the link in the password reset notification message. A patch is available in version 2.26.1. As a workaround, define `$g_path` as appropriate in `config_inc.php`.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Simple Expense Tracker v1.0 was discovered to contain a SQL injection vulnerability via the category parameter at /endpoint/delete_category.php.CVE-2024-25211 · Other software · Rems · reported by MITRECritical 9.8
Simple Expense Tracker v1.0 was discovered to contain a SQL injection vulnerability via the category parameter at /endpoint/delete_category.php.
- Product
- Simple Expense Tracker App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Simple Expense Tracker v1.0 was discovered to contain a SQL injection vulnerability via the expense parameter at /endpoint/delete_expense.php.CVE-2024-25210 · Other software · Rems · reported by MITRECritical 9.8
Simple Expense Tracker v1.0 was discovered to contain a SQL injection vulnerability via the expense parameter at /endpoint/delete_expense.php.
- Product
- Simple Expense Tracker App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php CVE-2024-24496 · Other software · remyandrade · reported by MITRECritical 9.8
An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php components.
- Product
- daily_habit_tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via crafted GET request.CVE-2024-24495 · Other software · Remyandrade · reported by MITRECritical 9.8
SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via crafted GET request.
- Product
- Daily Habit Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, read_book, vitamCVE-2024-24494 · Other software · Remyandrade · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, read_book, vitamins, laundry, alcohol and meat parameters in the add-tracker.php and update-tracker.php components.
- Product
- Daily Habit Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024Budget and Expense Tracker System v1.0 is vulnerable to SQL Injection via /expense_budget/admin/?page=reports/budget&date_start=2023-12-28&date_end=CVE-2024-22628 · Other software · Oretnom23 · reported by MITREHigh 7.2
Budget and Expense Tracker System v1.0 is vulnerable to SQL Injection via /expense_budget/admin/?page=reports/budget&date_start=2023-12-28&date_end=
- Product
- Budget And Expense Tracker System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2023openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.CVE-2023-27150 · Other software · Opencrx · reported by MITREMedium 5.4
openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.
- Product
- Opencrx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordesecforte.comopencrx.org
Dec 15, 2023A Remote Code Execution vulnerability exist in Uffizio's GPS Tracker all versions.CVE-2020-17485 · Other software · Uffizio · reported by MITRECritical 9.8
A Remote Code Execution vulnerability exist in Uffizio's GPS Tracker all versions. The web server can be compromised by uploading and executing a web/reverse shell. An attacker could then run commands, browse system files, and browse local resources
- Product
- GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redireCVE-2020-17484 · Other software · Uffizio · reported by MITREMedium 6.1
An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redirection to an arbitrary external domain.
- Product
- GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023An improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead to sensitive information disclosure of all the connected devicesCVE-2020-17483 · Other software · Uffizio · reported by MITREHigh 7.5
An improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead to sensitive information disclosure of all the connected devices. By visiting the vulnerable host at port 9000, we see it responds with a JSON body that has all the details about the devices which have been deployed.
- Product
- GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023Credit Tracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49152 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labs64 Credit Tracker allows Stored XSS.This issue affects Credit Tracker: from n/a through 1.1.17.
- Product
- Credit Tracker
- Affected
- up to 1.1.17
- What to do
- Affects up to 1.1.17. Update Credit Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 3, 2023Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder.CVE-2023-45024 · Other software · Bestpractical · reported by MITREHigh 7.5
Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Nov 3, 2023Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls.CVE-2023-41260 · Other software · best_practical_solutions · reported by MITREHigh 7.5
Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls.
- Product
- request_tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Nov 3, 2023Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or CVE-2023-41259 · Other software · best_practical_solutions · reported by MITREHigh 7.5
Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call.
- Product
- request_tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Oct 16, 2023MantisBT is an open source bug tracker.CVE-2023-44394 · Other software · mantisbt · reported by GitHubMedium 4.3
MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs. This issue has been addressed in commit `65c44883f` which has been included in release `2.25.8`. Users are advised to upgrade. Users unable to upgrade should disable wiki integration ( `$g_wiki_enable = OFF;`).
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2023A flaw was found in the tracker-miners package.CVE-2023-5557 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
- Product
- Red Hat Enterprise Linux 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 14, 2023CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new recoCVE-2023-36250 · Other software · Gnome · reported by MITREHigh 7.8
CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record.
- Product
- Gnome-time Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2023Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticated attackers to register as an Admin accCVE-2023-37759 · Other software · Trendylogics · reported by MITRECritical 9.8
Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request.
- Product
- Crypto Currency Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netpacketstormsecurity.com
Sep 6, 2023PendingIntent hijacking in LmsAssemblyTrackerCTC prior to SMR Sep-2023 Release 1 allows local attacker to gain arbitrary file access.CVE-2023-30720 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.7
PendingIntent hijacking in LmsAssemblyTrackerCTC prior to SMR Sep-2023 Release 1 allows local attacker to gain arbitrary file access.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Aug 24, 2023Silverware Games is a premium social network where people can play games online.CVE-2023-40182 · Other software · mesosoi · reported by GitHubLow 3.7
Silverware Games is a premium social network where people can play games online. When using the Recovery form, a noticeably different amount of time passes depending of whether the specified email address presents in our database or not. This has been fixed in version 1.3.7.
- Product
- silverwaregames-io-issue-tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023Silverware Games is a premium social network where people can play games online.CVE-2023-40179 · Other software · mesosoi · reported by GitHubMedium 5.3
Silverware Games is a premium social network where people can play games online. Prior to version 1.3.6, the Password Recovery form would throw an error if the specified email was not found in our database. It would only display the "Enter the code" form if the email is associated with a member of the site. Since version 1.3.6, the "Enter the code" form is always returned, showing the message "If the entered email is associated with an account, a code will be sent now". This change prevents potential violators from determining if our site has a user with the specified email.
- Product
- silverwaregames-io-issue-tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2023In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackersCVE-2023-39174 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jul 10, 2023A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to.CVE-2023-30960 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 4.3
A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was rolled out to all affected Foundry instances. No further intervention is required.
- Product
- com.palantir.foundry.jobtracker:job-tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Jun 28, 2023In getCurrentPrivilegedPackagesForAllUsers of CarrierPrivilegesTracker.java, there is a possible permission bypass due to a logic error in the code.CVE-2023-21184 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In getCurrentPrivilegedPackagesForAllUsers of CarrierPrivilegesTracker.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-267809568
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
May 15, 2023anuko timetracker is an open source time tracking system.CVE-2023-32308 · Other software · anuko · reported by GitHubHigh 8.2
anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for errors before adjusting invoice sorting order. Because of this, it was possible to craft a POST request with malicious SQL for Time Tracker database. This issue has been fixed in version 1.22.11.5781. Users are advised to upgrade. Users unable to upgrade may insert an additional check for errors in a condition before calling `ttGroupHelper::getActiveInvoices()` in invoices.php.
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023Time Tracker is an open source time tracking system.CVE-2023-32306 · Other software · anuko · reported by GitHubHigh 8.8
Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `reports.php` page was not validating all parameters in POST requests. Because some parameters were not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue is fixed in version 1.22.13.5792. As a workaround, use the fixed code in `ttReportHelper.class.php` from version 1.22.13.5792.
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Time Tracker is an open source time tracking system.CVE-2023-32066 · Other software · anuko · reported by GitHubMedium 5.4
Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then be executed in user browser on subsequent requests to week view. This issue is fixed in version 1.22.12.5783. As a workaround, use `htmlspecialchars` when calling `$field->setTitle` on line #245 in the `week.php` file, as happens in version 1.22.12.5783.
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Medicine Tracker System in PHP 1.0.0 is vulnerable to SQL Injection.CVE-2023-30112 · Other software · Medicine Tracker System Project · reported by MITREHigh 7.5
Medicine Tracker System in PHP 1.0.0 is vulnerable to SQL Injection.
- Product
- Medicine Tracker System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Apr 25, 2023Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS).CVE-2023-30111 · Other software · Medicine Tracker System Project · reported by MITREMedium 6.1
Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS).
- Product
- Medicine Tracker System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Apr 24, 2023A username enumeration issue was discovered in Medicine Tracker System 1.0.CVE-2023-30458 · Other software · Medicine Tracker System Project · reported by MITREMedium 5.3
A username enumeration issue was discovered in Medicine Tracker System 1.0. The login functionality allows a malicious user to guess a valid username due to a different response time from invalid usernames. When one enters a valid username, the response time increases depending on the length of the supplied password.
- Product
- Medicine Tracker System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Apr 10, 2023SilverwareGames.io versions before 1.2.19 allow users with access to the game upload panel to edit download links for games uploaded by other developers.CVE-2023-29192 · Other software · mesosoi · reported by GitHubLow 2.7
SilverwareGames.io versions before 1.2.19 allow users with access to the game upload panel to edit download links for games uploaded by other developers. This has been fixed in version 1.2.19.
- Product
- silverwaregames-io-issue-tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2023Cross Site Scripting vulnerability found in Sales Tracker Management System v.1.0 allows a remote attacker to gain privileges via the product list function in tCVE-2023-26773 · Other software · Sales Tracker Management System Project · reported by MITREMedium 6.1
Cross Site Scripting vulnerability found in Sales Tracker Management System v.1.0 allows a remote attacker to gain privileges via the product list function in the Master.php file.
- Product
- Sales Tracker Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comtwitter.com
Apr 10, 2023An issue found in Sales Tracker Management System v.1.0 allows a remote attacker to access sensitive information via sales.php component of the admin/reports enCVE-2023-26774 · Other software · Sales Tracker Management System Project · reported by MITREHigh 7.5
An issue found in Sales Tracker Management System v.1.0 allows a remote attacker to access sensitive information via sales.php component of the admin/reports endpoint.
- Product
- Sales Tracker Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comtwitter.com
Mar 28, 2023A potential memory vulnerability due to insufficient input validation in PDFXEditCore.x64.dll in PDF-XChange Editor version 9.3 by Tracker Software may allow atCVE-2023-24308 · Other software · Pdf-xchange · reported by MITREHigh 7.8
A potential memory vulnerability due to insufficient input validation in PDFXEditCore.x64.dll in PDF-XChange Editor version 9.3 by Tracker Software may allow attackers to execute code when a user opens a crafted PDF file. The issue occurs when handling a large number of objects in a PDF file.
- Product
- Pdf-xchange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsit.fraunhofer.desit.fraunhofer.de
Feb 23, 2023Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2023-22476 · Other software · mantisbt · reported by GitHubMedium 4.3
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can access to the _Summary_ field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted `bug_arr[]` parameter in *bug_actiongroup_ext.php*. This issue is fixed in version 2.25.6. There are no workarounds.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commantisbt.org
Feb 17, 2023An issue in Schism Tracker v20200412 fixed in v.20200412 allows attacker to obtain sensitive information via the fmt_mtm_load_song function in fmt/mtm.c.CVE-2021-32419 · Other software · Schismtracker · reported by MITREMedium 5.3
An issue in Schism Tracker v20200412 fixed in v.20200412 allows attacker to obtain sensitive information via the fmt_mtm_load_song function in fmt/mtm.c.
- Product
- Schism Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability classified as critical was found in visegripped Stracker.CVE-2022-4889 · Other software · visegripped · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file doc_root/public_html/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is 63e1b040373ee5b6c7d1e165ecf5ae1603d29e0a. It is recommended to apply a patch to fix this issue. The identifier VDB-218377 was assigned to this vulnerability.
- Product
- Stracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability, which was classified as critical, was found in Seiji42 cub-scout-tracker.CVE-2014-125046 · Other software · Seiji42 · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Seiji42 cub-scout-tracker. This affects an unknown part of the file databaseAccessFunctions.js. The manipulation leads to sql injection. The patch is named b4bc1a328b1f59437db159f9d136d9ed15707e31. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217551.
- Product
- cub-scout-tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2023A vulnerability classified as problematic has been found in OpenACS bug-tracker.CVE-2016-15009 · Other software · OpenACS · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in OpenACS bug-tracker. Affected is an unknown function of the file lib/nav-bar.adp of the component Search. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The name of the patch is aee43e5714cd8b697355ec3bf83eefee176d3fc3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217440.
- Product
- bug-tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.