Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,050 results · page 41 of 61
Aug 5, 2022A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14.CVE-2022-24010 · Other software · TCL · reported by talos-cna@cisco.comCritical 9.8
A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the cwmpd binary.
- Product
- LinkHub Mesh Wifi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 5, 2022A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14.CVE-2022-24009 · Other software · TCL · reported by talos-cna@cisco.comCritical 9.8
A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the confsrv binary.
- Product
- LinkHub Mesh Wifi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 5, 2022A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14.CVE-2022-24008 · Other software · TCL · reported by talos-cna@cisco.comCritical 9.8
A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the confcli binary.
- Product
- LinkHub Mesh Wifi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 5, 2022A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14.CVE-2022-24007 · Other software · TCL · reported by talos-cna@cisco.comCritical 9.8
A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the cfm binary.
- Product
- LinkHub Mesh Wifi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 5, 2022A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14.CVE-2022-24006 · Other software · TCL · reported by talos-cna@cisco.comCritical 9.8
A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the arpbrocast binary.
- Product
- LinkHub Mesh Wifi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 5, 2022A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14.CVE-2022-24005 · Other software · TCL · reported by talos-cna@cisco.comCritical 9.8
A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the ap_steer binary.
- Product
- LinkHub Mesh Wifi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 5, 2022A stack-based buffer overflow vulnerability exists in the confsrv set_mf_rule functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14.CVE-2022-23919 · Other software · TCL · reported by talos-cna@cisco.comCritical 9.8
A stack-based buffer overflow vulnerability exists in the confsrv set_mf_rule functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability leverages the name field within the protobuf message to cause a buffer overflow.
- Product
- LinkHub Mesh Wifi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 5, 2022A stack-based buffer overflow vulnerability exists in the confsrv set_mf_rule functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14.CVE-2022-23918 · Other software · TCL · reported by talos-cna@cisco.comCritical 9.8
A stack-based buffer overflow vulnerability exists in the confsrv set_mf_rule functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability leverages the ethAddr field within the protobuf message to cause a buffer overflow.
- Product
- LinkHub Mesh Wifi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 5, 2022A stack-based buffer overflow vulnerability exists in the confsrv set_port_fwd_rule functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14.CVE-2022-23399 · Other software · TCL · reported by talos-cna@cisco.comCritical 9.8
A stack-based buffer overflow vulnerability exists in the confsrv set_port_fwd_rule functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.
- Product
- LinkHub Mesh Wifi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 5, 2022A stack-based buffer overflow vulnerability exists in the confsrv confctl_set_app_language functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14.CVE-2022-23103 · Other software · TCL · reported by talos-cna@cisco.comCritical 9.8
A stack-based buffer overflow vulnerability exists in the confsrv confctl_set_app_language functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.
- Product
- LinkHub Mesh Wifi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 5, 2022A hard-coded password vulnerability exists in the libcommonprod.so prod_change_root_passwd functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14.CVE-2022-22144 · Other software · TCL · reported by talos-cna@cisco.comCritical 9.8
A hard-coded password vulnerability exists in the libcommonprod.so prod_change_root_passwd functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. During system startup this functionality is always called, leading to a known root password. An attacker does not have to do anything to trigger this vulnerability.
- Product
- LinkHub Mesh Wifi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 5, 2022An os command injection vulnerability exists in the confsrv ucloud_add_node functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14.CVE-2022-22140 · Other software · TCL · reported by talos-cna@cisco.comCritical 9.8
An os command injection vulnerability exists in the confsrv ucloud_add_node functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a malicious packet to trigger this vulnerability.
- Product
- LinkHub Mesh Wifi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 5, 2022A stack-based buffer overflow vulnerability exists in the confers ucloud_add_node_new functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14.CVE-2022-21201 · Other software · TCL · reported by talos-cna@cisco.comHigh 8.8
A stack-based buffer overflow vulnerability exists in the confers ucloud_add_node_new functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.
- Product
- LinkHub Mesh Wifi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 5, 2022An os command injection vulnerability exists in the confsrv ucloud_add_new_node functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14.CVE-2022-21178 · Other software · TCL · reported by talos-cna@cisco.comCritical 9.8
An os command injection vulnerability exists in the confsrv ucloud_add_new_node functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a malicious packet to trigger this vulnerability.
- Product
- LinkHub Mesh Wifi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 5, 2022Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.CVE-2022-2636 · Other software · hestiacp · reported by security@huntr.devHigh 8.5
Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.CVE-2022-2626 · Other software · hestiacp · reported by security@huntr.devHigh 7.2
Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2022Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5.CVE-2022-2651 · Other software · bookwyrm-social · reported by security@huntr.devCritical 9.8
Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5.
- Product
- bookwyrm-social/bookwyrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 2, 2022Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0.CVE-2022-2631 · Other software · tooljet · reported by security@huntr.devHigh 8.8
Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0.
- Product
- tooljet/tooljet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2022A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of arbitrary attributes.CVE-2022-23733 · Other software · GitHub · reported by product-cna@github.comMedium 5.4
A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of arbitrary attributes. This injection was blocked by Github's Content Security Policy (CSP). This vulnerability affected all versions of GitHub Enterprise Server prior to 3.6 and was fixed in versions 3.3.11, 3.4.6 and 3.5.3. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Aug 1, 2022Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100.CVE-2022-2598 · Other software · vim · reported by security@huntr.devMedium 6.5
Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10.CVE-2022-2596 · Other software · node-fetch · reported by security@huntr.devMedium 5.9
Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10.
- Product
- node-fetch/node-fetch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1.CVE-2022-2595 · Other software · kromitgmbh · reported by security@huntr.devCritical 10
Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1.
- Product
- kromitgmbh/titra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.3.CVE-2022-2589 · Other software · beancount · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.3.
- Product
- beancount/fava
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104.CVE-2022-2581 · Other software · vim · reported by security@huntr.devHigh 7.8
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102.CVE-2022-2580 · Other software · vim · reported by security@huntr.devHigh 7.8
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101.CVE-2022-2571 · Other software · vim · reported by security@huntr.devHigh 7.8
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2022The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which dCVE-2022-24912 · Other software · Runatlantis · reported by report@snyk.ioHigh 7.5
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.
- Product
- Atlantis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2022Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.CVE-2022-2564 · Other software · automattic · reported by security@huntr.devCritical 9.8
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
- Product
- automattic/mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2022Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equCVE-2022-36885 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature.
- Product
- Jenkins GitHub Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.CVE-2022-2550 · Other software · hestiacp · reported by security@huntr.devHigh 8.8
OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2022NULL Pointer Dereference in GitHub repository gpac/gpac prior to v2.1.0-DEV.CVE-2022-2549 · Other software · gpac · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository gpac/gpac prior to v2.1.0-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.CVE-2022-2523 · Other software · beancount · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.
- Product
- beancount/fava
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2022Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061.CVE-2022-2522 · Other software · vim · reported by security@huntr.devHigh 7.8
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.CVE-2022-2470 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21.CVE-2022-2495 · Other software · microweber · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.CVE-2022-2494 · Other software · openemr · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.CVE-2022-2493 · Other software · openemr · reported by security@huntr.devHigh 8.1
Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.1-DEV.CVE-2022-2454 · Other software · gpac · reported by security@huntr.devHigh 7.8
Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.1-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022Use After Free in GitHub repository gpac/gpac prior to 2.1-DEV.CVE-2022-2453 · Other software · gpac · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository gpac/gpac prior to 2.1-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2022External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.CVE-2022-2400 · Other software · dompdf · reported by security@huntr.devMedium 5.3
External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.
- Product
- dompdf/dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2022The package github.com/containrrr/shoutrrr/pkg/util before 0.6.0 are vulnerable to Denial of Service (DoS) via the util.PartitionMessage function.CVE-2022-25891 · Other software · Containrrr · reported by report@snyk.ioHigh 7.5
The package github.com/containrrr/shoutrrr/pkg/util before 0.6.0 are vulnerable to Denial of Service (DoS) via the util.PartitionMessage function. Exploiting this vulnerability is possible by sending exactly 2000, 4000, or 6000 characters messages.
- Product
- Shoutrrr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2022Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20.CVE-2022-2368 · Other software · microweber · reported by security@huntr.devMedium 6.5
Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The zippies/testplatform repository through 2016-07-19 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31588 · Other software · Testplatform Project · reported by MITRECritical 9.3
The zippies/testplatform repository through 2016-07-19 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Testplatform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31587 · Other software · Kg-fashion-chatbot Project · reported by MITRECritical 9.3
The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Kg-fashion-chatbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The unizar-30226-2019-06/ChangePop-Back repository through 2019-06-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsaCVE-2022-31586 · Other software · Changepop-back Project · reported by MITRECritical 9.3
The unizar-30226-2019-06/ChangePop-Back repository through 2019-06-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Changepop-back
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The umeshpatil-dev/Home__internet repository through 2020-08-28 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31585 · Other software · Home Internet Project · reported by MITRECritical 9.3
The umeshpatil-dev/Home__internet repository through 2020-08-28 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Home Internet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The stonethree/s3label repository through 2019-08-14 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31584 · Other software · S3label Project · reported by MITRECritical 9.3
The stonethree/s3label repository through 2019-08-14 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- S3label
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The sravaniboinepelli/AutomatedQuizEval repository through 2020-04-27 on GitHub allows absolute path traversal because the Flask send_file function is used unsaCVE-2022-31583 · Other software · Automatedquizeval Project · reported by MITRECritical 9.3
The sravaniboinepelli/AutomatedQuizEval repository through 2020-04-27 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Automatedquizeval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The shaolo1/VideoServer repository through 2019-09-21 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31582 · Other software · Videoserver Project · reported by MITRECritical 9.3
The shaolo1/VideoServer repository through 2019-09-21 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Videoserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The scorelab/OpenMF repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31581 · Other software · Scorelab · reported by MITRECritical 9.3
The scorelab/OpenMF repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Openmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.