Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,841 results · page 41 of 77
Mar 20, 2023GetResponse for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0167 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GetResponse for WordPress plugin through 5.5.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GetResponse for
- Affected
- up to 5.5.31
- What to do
- Affects up to 5.5.31. Update GetResponse for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2023A vulnerability has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54 and classified as critical.CVE-2023-1489 · Other software · Lespeed · reported by VulDBHigh 7.8
A vulnerability has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54 and classified as critical. Affected by this vulnerability is the function 0x9C402088 in the library WiseHDInfo64.dll of the component IoControlCode Handler. The manipulation leads to improper access controls. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223375.
- Product
- WiseCleaner Wise System Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 18, 2023A vulnerability, which was classified as problematic, was found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54.CVE-2023-1488 · Other software · Lespeed · reported by VulDBLow 3.3
A vulnerability, which was classified as problematic, was found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54. Affected is the function 0x9C40A0D8/0x9C40A0DC/0x9C40A0E0 in the library WiseHDInfo64.dll of the component IoControlCode Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-223374 is the identifier assigned to this vulnerability.
- Product
- WiseCleaner Wise System Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 18, 2023A vulnerability, which was classified as problematic, has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54.CVE-2023-1487 · Other software · Lespeed · reported by VulDBMedium 5.5
A vulnerability, which was classified as problematic, has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54. This issue affects the function 0x9C40208C/0x9C402000/0x9C402084/0x9C402088/0x9C402004/0x9C4060C4/0x9C4060CC/0x9C4060D0/0x9C4060D4/0x9C40A0DC/0x9C40A0D8/0x9C40A0DC/0x9C40A0E0 in the library WiseHDInfo64.dll of the component IoControlCode Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-223373 was assigned to this vulnerability.
- Product
- WiseCleaner Wise System Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 18, 2023A vulnerability classified as problematic was found in Lespeed WiseCleaner Wise Force Deleter 1.5.3.54.CVE-2023-1486 · Other software · Lespeed · reported by VulDBMedium 4.4
A vulnerability classified as problematic was found in Lespeed WiseCleaner Wise Force Deleter 1.5.3.54. This vulnerability affects the function 0x220004 in the library WiseUnlock64.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223372.
- Product
- WiseCleaner Wise Force Deleter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 15, 2023An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via the respwd method in SysUserController.CVE-2023-24760 · Other software · Ofcms Project · reported by MITREHigh 8.8
An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via the respwd method in SysUserController.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2023Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the shareSpeed parameter at /goform/WifiGuestSet.CVE-2023-27239 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the shareSpeed parameter at /goform/WifiGuestSet.
- Product
- Ax3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow.CVE-2023-27581 · Other software · rlespinasse · reported by GitHubHigh 8.8
github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. This can be used to execute code on the GitHub runners and to exfiltrate any secrets one uses in the CI pipeline. A patched action is available in version 4.4.1. No workaround is available.
- Product
- github-slug-action
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response.CVE-2022-40537 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.3
Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Mar 10, 2023Memory corruption in modem due to integer overflow to buffer overflow while handling APDU responseCVE-2022-25705 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Mar 7, 2023HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi.CVE-2023-27522 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpd.apache.orglists.debian.org
Mar 6, 2023eVision Responsive Column Layout Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0064 · WordPress plugins & themes · reported by WPScanMedium 5.4
The eVision Responsive Column Layout Shortcodes WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- eVision Responsive Column Layout Shortcodes
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update eVision Responsive Column Layout Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 1, 2023Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group withouCVE-2022-3162 · Other software · Kubernetes · reported by jordan@liggitt.netMedium 6.5
Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.
- Product
- Kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Feb 28, 2023SOLDR (System of Orchestration, Lifecycle control, Detection and Response) 1.1.0 allows stored XSS via the module editor.CVE-2023-26608 · Other software · Vxcontrol · reported by MITREMedium 5.4
SOLDR (System of Orchestration, Lifecycle control, Detection and Response) 1.1.0 allows stored XSS via the module editor.
- Product
- Soldr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 can lead to theme deletion.CVE-2023-23983 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 can lead to theme deletion.
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 27, 2023Arigato Autoresponder and Newsletter: Does not sanitize and escape some of its settingsCVE-2023-0543 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Arigato Autoresponder and Newsletter
- Fixed in
- 2.1.7.2
- What to do
- Update Arigato Autoresponder and Newsletter to 2.1.7.2 or newer.
Feb 27, 2023Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team CVE-2023-27266 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.7
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Feb 27, 2023Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team aCVE-2023-27265 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.7
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Feb 21, 2023WP Responsive Testimonials Slider And Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4750 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Responsive Testimonials Slider And Widget WordPress plugin through 1.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP Responsive Testimonials Slider And Widget
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update WP Responsive Testimonials Slider And Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2023JD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance.CVE-2023-26234 · Other software · Jd-gui Project · reported by MITREMedium 6.6
JD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance.
- Product
- Jd-gui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2023An issue was discovered in ESPCMS P8.21120101 after logging in to the background, there is a SQL injection vulnerability in the function node where members are CVE-2023-23007 · Other software · Ecisp · reported by MITREHigh 7.2
An issue was discovered in ESPCMS P8.21120101 after logging in to the background, there is a SQL injection vulnerability in the function node where members are added.
- Product
- Espcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023A improper neutralization of crlf sequences in http headers ('http response splitting') vulnerability in Fortinet FortiOS 7.2.0 through 7.2.2, FortiOS 7.0.0 thrCVE-2022-42472 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 4.2
A improper neutralization of crlf sequences in http headers ('http response splitting') vulnerability in Fortinet FortiOS 7.2.0 through 7.2.2, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.12, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7, FortiProxy 2.0.0 through 2.0.10, FortiProxy 1.2 all versions, FortiProxy 01.02 all versions, FortiProxy 1.1 all versions, FortiProxy 01.01 all versions may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response.
- Product
- FortiProxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Feb 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 versions.CVE-2023-25065 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 versions.
- Affected
- up to 2.1.14
- What to do
- Affects up to 2.1.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 13, 2023SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privilCVE-2023-24524 · Network & remote access · SAP · reported by cna@sap.comMedium 6.5
SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to delete the data with a high impact to availability.
- Product
- S/4 HANA (Map Treasury Correspondence Format Data)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Feb 13, 2023Responsive Gallery Grid: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0060 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Responsive Gallery Grid
- Fixed in
- 2.3.9
- What to do
- Update Responsive Gallery Grid to 2.3.9 or newer.
Feb 11, 2023Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.CVE-2022-40514 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Feb 11, 2023Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.CVE-2022-40512 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Feb 11, 2023Information disclosure in modem due to buffer over-read while processing response from DNS serverCVE-2022-25728 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.2
Information disclosure in modem due to buffer over-read while processing response from DNS server
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Feb 6, 2023ResponsiveVoice Text To Speech: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0070 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- ResponsiveVoice Text To Speech
- Fixed in
- 1.7.7
- What to do
- Update ResponsiveVoice Text To Speech to 1.7.7 or newer.
Feb 2, 2023An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leadingCVE-2022-46604 · Other software · Tecrail · reported by MITREHigh 8.8
An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leading to arbitrary code execution.
- Product
- Responsive Filemanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 26, 2023User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses.CVE-2023-23950 · Other software · Broadcom · reported by secure@symantec.comMedium 6.1
User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses.
- Product
- Symantec Identity Governance And Administration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comsupport.broadcom.com
Jan 26, 2023The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022.3.30 allows a user CVE-2023-0463 · Other software · Devolutions · reported by security@devolutions.netLow 3.3
The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022.3.30 allows a user to save sensitive data on disk.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Jan 26, 2023The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vuCVE-2023-0448 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 6.1
The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability.
- Fixed in
- 4.3
- What to do
- Update the plugin to 4.3 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 26, 2023Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND tCVE-2022-3488 · Other software · ISC · reported by security-officer@isc.orgHigh 7.5
Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND to exit with an assertion failure. 'Broken' in this context is anything that would cause the resolver to reject the query response, such as a mismatch between query and answer name. This issue affects BIND 9 versions 9.11.4-S1 through 9.11.37-S1 and 9.16.8-S1 through 9.16.36-S1.
- Product
- BIND 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2023A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.CVE-2023-0396 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.8
A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023Cybereason EDR version 19.1.282 and above, 19.2.182 and above, 20.1.343 and above, and 20.2.X and above has a DLL hijacking vulnerability, which could allow a lCVE-2020-25502 · Other software · Cybereason · reported by MITREHigh 7.8
Cybereason EDR version 19.1.282 and above, 19.2.182 and above, 20.1.343 and above, and 20.2.X and above has a DLL hijacking vulnerability, which could allow a local attacker to execute code with elevated privileges.
- Product
- Endpoint Detection And Response
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybereason.comcybereason.com
Jan 17, 2023Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into CVE-2022-37436 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpd.apache.orgsecurity.gentoo.org
Jan 12, 2023A vulnerability, which was classified as problematic, was found in earclink ESPCMS P8.21120101.CVE-2023-0246 · Other software · earclink · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in earclink ESPCMS P8.21120101. Affected is an unknown function of the component Content Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-218154 is the identifier assigned to this vulnerability.
- Product
- ESPCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remoteCVE-2022-22088 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jan 3, 2023An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, FortiWCVE-2022-42471 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.4
An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.4.0 through 6.4.2, FortiWeb version 6.3.6 through 6.3.20 may allow an authenticated and remote attacker to inject arbitrary headers.
- Product
- FortiWeb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Jan 2, 2023Vitals ESP upload function has a path traversal vulnerability.CVE-2022-46309 · Other software · Galaxy Software Services Corporation. · reported by twcert@cert.org.twMedium 6.5
Vitals ESP upload function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to access arbitrary system files.
- Product
- Vitals ESP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 2, 2023ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter.CVE-2022-46304 · Other software · ChangingTec · reported by twcert@cert.org.twHigh 8.8
ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers command injection and allows the attacker to execute arbitrary system command to perform arbitrary system operation or disrupt service.
- Product
- ServiSign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 28, 2022Alpine is a scaffolding library in Java.CVE-2022-23554 · Other software · stevespringett · reported by GitHubMedium 6.5
Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows Authentication Filter bypass. The AuthenticationFilter relies on the request URI to evaluate if the user is accessing the swagger endpoint. By accessing a URL with a path such as /api/foo;%2fapi%2fswagger the contains condition will hold and will return from the authentication filter without aborting the request. Note that the principal object will not be assigned and therefore the issue wont allow user impersonation. This issue has been fixed in version 1.10.4. There are no known workarounds.
- Product
- alpine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Alpine is a scaffolding library in Java.CVE-2022-23553 · Other software · stevespringett · reported by GitHubHigh 7.5
Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows URL access filter bypass. This issue has been fixed in version 1.10.4. There are no known workarounds.
- Product
- alpine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a signCVE-2019-25072 · Other software · github.com/tendermint/tendermint · reported by security@golang.orgHigh 7.5
Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.
- Product
- github.com/tendermint/tendermint/rpc/lib/client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.CVE-2022-44381 · Other software · Snipeitapp · reported by MITREMedium 5.3
Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.
- Product
- Snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcensus-labs.comcensus-labs.com
Dec 22, 2022Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range rCVE-2022-45403 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to determine the presence or length of a media file. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 22, 2022Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer would have been freed despite never beinCVE-2022-34480 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer would have been freed despite never being allocated. This vulnerability affects Firefox < 102.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 22, 2022When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-scriptCVE-2022-22760 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-script responses. This could have been abused to learn information cross-origin. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgbugzilla.mozilla.org
Dec 20, 2022 IBM Security Guardium 11.4 could allow a privileged user to obtain sensitive information inside of an HTTP response.CVE-2022-39166 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.4
IBM Security Guardium 11.4 could allow a privileged user to obtain sensitive information inside of an HTTP response. IBM X-Force ID: 235405.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.