Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,397 results · page 43 of 68
Mar 9, 2022A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a disruption of communication between tCVE-2022-24322 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 5.3
A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software when an attacker is able to intercept and manipulate specific Modbus response data. Affected Product: EcoStruxure Control Expert (V15.0 SP1 and prior)
- Product
- EcoStruxure Control Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Mar 4, 2022" Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to another control sphereCVE-2021-27757 · Other software · Hcltech · reported by psirt@hcl.comHigh 7.5
" Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.Since the information is stored in cleartext, attackers could potentially read it and gain access to sensitive information."
- Product
- Bigfix Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Feb 24, 2022Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.CVE-2022-25838 · Other software · Laravel · reported by MITREHigh 8.1
Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.
- Product
- Fortify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since tCVE-2021-25636 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 7.5
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to contain both "X509Data" and "KeyValue" children of the "KeyInfo" tag, which when opened caused LibreOffice to verify using the "KeyValue" but to report verification with the unrelated "X509Data" value. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.5.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Feb 21, 2022A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the restricted shell enviroCVE-2021-27796 · Other software · Broadcom · reported by sirt@brocade.comMedium 6.5
A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the restricted shell environment (rbash) as either the “user” or “factory” account, to read the contents of any file on the filesystem utilizing one of a few available binaries.
- Product
- Fabric Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Feb 21, 2022Buffer Button: Was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text fieldCVE-2021-25058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field.
- Product
- Buffer Button
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Buffer Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022Translation Exchange: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settingsCVE-2021-25057 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settings.
- Product
- Translation Exchange
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Translation Exchange to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.CVE-2021-25055 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.
- Product
- FeedWordPress
- Fixed in
- 2022.0123
- What to do
- Update FeedWordPress to 2022.0123 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 18, 2022A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or "Window list" GNOMECVE-2021-20315 · Other software · Gnome · reported by Red HatMedium 6.1
A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or "Window list" GNOME extensions are enabled. This flaw allows a physical attacker who has access to a locked system to kill existing applications and start new ones as the locked user, even if the session is still locked.
- Product
- Gnome-shell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Feb 17, 2022IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue within the channel process.CVE-2021-39034 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue within the channel process. IBM X-Force ID: 213964.
- Product
- MQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 11, 2022Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to DCVE-2022-0562 · Other software · libtiff · reported by cve@gitlab.comMedium 5.5
Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.
- Product
- libtiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead CVE-2022-0561 · Other software · libtiff · reported by cve@gitlab.comMedium 5.5
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
- Product
- libtiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2022A persistent cross-site scripting (XSS) vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore applicatCVE-2022-23321 · Other software · Xerox · reported by MITREMedium 4.8
A persistent cross-site scripting (XSS) vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore application on version 12.3.7244.0.
- Product
- Xmpie Ustore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtriaxiomsecurity.comxmpie.com
Feb 10, 2022An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enaCVE-2022-0016 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comHigh 7.4
An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Before Logon under certain circumstances. This issue impacts GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.9 on Windows and MacOS. This issue does not affect the GlobalProtect app on other platforms.
- Product
- GlobalProtect App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comsecurity.paloaltonetworks.com
Feb 10, 2022A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control pCVE-2021-44892 · Other software · Thinkphp · reported by MITREHigh 8.8
A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control privileges.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022A flaw was found in Python, specifically within the urllib.parse module.CVE-2022-0391 · Other software · Siemens · reported by Red HatHigh 7.5
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.python.orglists.debian.org
Feb 9, 2022Improper Validation of Consistency within input in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthentiCVE-2021-0177 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper Validation of Consistency within input in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Validation of Consistency within input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in WCVE-2021-0173 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper Validation of Consistency within input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Validation of Consistency within input in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthentiCVE-2021-0163 · Other software · Intel · reported by secure@intel.comHigh 8.8
Improper Validation of Consistency within input in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmdCVE-2021-46354 · Other software · Cybelesoft · reported by MITREHigh 7.5
Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increase the attack surface.
- Product
- Thinfinity Virtualui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 9, 2022A Cross-Site Scripting (XSS) vulnerability exists within the 3.2.2 version of TastyIgniter.CVE-2022-23378 · Other software · Tastyigniter · reported by MITREMedium 5.4
A Cross-Site Scripting (XSS) vulnerability exists within the 3.2.2 version of TastyIgniter. The "items%5B0%5D%5Bpath%5D" parameter of a request made to /admin/allergens/edit/1 is vulnerable.
- Product
- Tastyigniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtastyigniter.com
Feb 4, 2022VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC ManagCVE-2022-22939 · Other software · VMware · reported by security@vmware.comMedium 4.9
VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager. A malicious actor with root access on VMware Cloud Foundation SDDC Manager may be able to view credentials in plaintext within one or more log files.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radio range during pairinCVE-2018-25029 · Other software · Silicon Labs · reported by cret@cert.orgHigh 8.1
The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radio range during pairing to downgrade and then exploit a different vulnerability (CVE-2013-20003) to intercept and spoof traffic.
- Product
- Z-Wave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.silabs.compentestpartners.com
Jan 28, 2022VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPrinCVE-2022-22938 · Other software · VMware · reported by security@vmware.comMedium 6.5
VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in TrueType font parser. A malicious actor with access to a virtual machine or remote desktop may exploit this issue to trigger a denial-of-service condition in the Thinprint service running on the host machine where VMware Workstation or Horizon Client for Windows is installed.
- Product
- Workstation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022Online Motorcycle (Bike) Rental System 1.0 is vulnerable to a Blind Time-Based SQL Injection attack within the login portal.CVE-2021-44249 · Other software · Online Motorcycle (bike) Rental System Project · reported by MITRECritical 9.8
Online Motorcycle (Bike) Rental System 1.0 is vulnerable to a Blind Time-Based SQL Injection attack within the login portal. This can lead attackers to remotely dump MySQL database credentials.
- Product
- Online Motorcycle (bike) Rental System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoctorzorka.github.ioexploit-db.com
Jan 24, 2022There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads.CVE-2022-23437 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
- Product
- Apache Xerces
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Jan 18, 2022The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL.CVE-2022-22691 · Other software · Umbraco · reported by info@appcheck-ng.comMedium 6.8
The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server thereby disclosing the password reset token if/when the link is followed. A related vulnerability (CVE-2022-22690) could allow this flaw to become persistent so that all password reset URLs are affected persistently following a successful attack. See the AppCheck advisory for further information and associated caveats.
- Product
- Umbraco CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordappcheck-ng.comappcheck-ng.com
Jan 18, 2022Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL CVE-2022-22690 · Other software · Umbraco · reported by info@appcheck-ng.comHigh 8.6
Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL pointing back to the site. For example, when a user resets their password and the application builds a password reset URL or when the administrator invites users to the site. For Umbraco versions less than 9.2.0, if the Application URL is not specifically configured, the attacker can manipulate this value and store it persistently affecting all users for components where the "UmbracoApplicationUrl" is used. For example, the attacker is able to change the URL users receive when resetting their password so that it points to the attackers server, when the user follows this link the reset token can be intercepted by the attacker resulting in account takeover.
- Product
- Umbraco CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordappcheck-ng.comappcheck-ng.com
Jan 18, 2022An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unprivileged context.CVE-2021-22566 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 5.1
An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unprivileged context. This can be leveraged by an attacker to bypass executability restrictions of kernel-mode pages from user-mode. An incorrect setting of PXN bits within mmu_flags_to_s1_pte_attr lead to unprivileged executable pages being mapped as executable from a privileged context. This can be leveraged by an attacker to bypass executability restrictions of user-mode pages from kernel-mode. Typically this allows a potential attacker to circumvent a mitigation, making exploitation of potential kernel-mode vulnerabilities easier. We recommend updating kernel beyond commit 7d731b4e9599088ac3073956933559da7bca6a00 and rebuilding.
- Product
- Fuchsia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfuchsia.googlesource.comfuchsia.googlesource.com
Jan 10, 2022WP Coder: Within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as wellCVE-2021-25053 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
- Product
- WP Coder
- Fixed in
- 2.5.2
- What to do
- Update WP Coder to 2.5.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 10, 2022Button Generator: Within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as wellCVE-2021-25052 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
- Product
- Button Generator
- Fixed in
- 2.3.3
- What to do
- Update Button Generator to 2.3.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 10, 2022Modal Window: Within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as wellCVE-2021-25051 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
- Product
- Modal Window
- Fixed in
- 5.2.2
- What to do
- Update Modal Window to 5.2.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 10, 2022Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker within radio range to take control of or CVE-2020-9057 · Other software · Linear · reported by cret@cert.orgHigh 8.8
Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker within radio range to take control of or cause a denial of service to a vulnerable device. An attacker can also capture and replay Z-Wave traffic. Firmware upgrades cannot directly address this vulnerability as it is an issue with the Z-Wave specification for these legacy chipsets. One way to protect against this vulnerability is to use 500 or 700 series chipsets that support Security 2 (S2) encryption. As examples, the Linear WADWAZ-1 version 3.43 and WAPIRZ-1 version 3.43 (with 300 series chipsets) are vulnerable.
- Product
- WADWAZ-1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2021An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.CVE-2020-20601 · Other software · Thinkcmf · reported by MITRECritical 9.8
An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.
- Product
- Thinkcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.riskivy.comblog.riskivy.com
Dec 20, 2021The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file.CVE-2021-35244 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 6.8
The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.
- Product
- Orion Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsupport.solarwinds.com
Dec 20, 2021Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation.CVE-2021-35234 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8
Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker with low-user privileges may steal password hashes and password salt information.
- Product
- Orion Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsupport.solarwinds.com
Dec 20, 2021Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI.CVE-2021-44554 · Other software · Cybelesoft · reported by MITREMedium 5.3
Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI. By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to the configuration of VirtualUI. Common users are administrator, admin, guest and krgtbt.
- Product
- Thinfinity Virtualui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter.CVE-2021-45092 · Other software · Cybelesoft · reported by MITRECritical 9.8
Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter.
- Product
- Thinfinity Virtualui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 15, 2021SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.CVE-2021-44350 · Other software · Thinkphp · reported by MITRECritical 9.8
SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2021Auto Featured Image (Auto Post Thumbnail): Does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS blockCVE-2021-24932 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.3 does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS block, leading to a Reflected Cross-Site Scripting issue.
- Product
- Auto Featured Image (Auto Post Thumbnail)
- Fixed in
- 3.9.3
- What to do
- Update Auto Featured Image (Auto Post Thumbnail) to 3.9.3 or newer.
Dec 12, 2021In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exiCVE-2021-44848 · Other software · Cybelesoft · reported by MITREMedium 5.3
In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists.
- Product
- Thinfinity Virtualui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 8, 2021Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers.CVE-2021-43539 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
Dec 6, 2021ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.CVE-2021-36567 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2021ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php.CVE-2021-36564 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2021The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's eCVE-2021-43936 · Other software · Distributed Data Systems · reported by ics-cert@hq.dhs.govCritical 10
The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead to arbitrary code execution.
- Product
- WebHMI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comus-cert.cisa.gov
Dec 3, 2021ThinkUp 2.0-beta.10 is affected by a path manipulation vulnerability in Smarty.class.php.CVE-2021-43674 · Other software · Thinkupapp · reported by MITRECritical 9.8
ThinkUp 2.0-beta.10 is affected by a path manipulation vulnerability in Smarty.class.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- Thinkup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2021thinkphp-bjyblog (last update Jun 4 2021) is affected by a Cross Site Scripting (XSS) vulnerability in AdminBaseController.class.php.CVE-2021-43682 · Other software · Thinkphp-bjyblog Project · reported by MITREMedium 6.1
thinkphp-bjyblog (last update Jun 4 2021) is affected by a Cross Site Scripting (XSS) vulnerability in AdminBaseController.class.php. The exit function terminates the script and prints a message to the user that contains $_SERVER['HTTP_HOST'].
- Product
- Thinkphp-bjyblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2021IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics.CVE-2021-39000 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics. IBM X-Force ID: 213215.
- Product
- MQ Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Nov 30, 2021IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace.CVE-2021-38999 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace.
- Product
- MQ Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Nov 29, 2021Workerman-ThinkPHP-Redis (last update Mar 16, 2018) is affected by a Cross Site Scripting (XSS) vulnerability.CVE-2021-43697 · Other software · Workerman-thinkphp-redis Project · reported by MITREMedium 6.1
Workerman-ThinkPHP-Redis (last update Mar 16, 2018) is affected by a Cross Site Scripting (XSS) vulnerability. In file Controller.class.php, the exit function will terminate the script and print the message to the user. The message will contain $_GET{C('VAR_JSONP_HANDLER')] then there is a XSS vulnerability.
- Product
- Workerman-thinkphp-redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.