Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
497 results · page 5 of 10
Jul 1, 2024In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in SplunCVE-2024-36991 · Other software · Splunk · reported by prodsec@splunk.comHigh 7.5
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.splunk.comresearch.splunk.com
Jun 19, 2024In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection.CVE-2024-36679 · Websites & servers · prestashop · reported by MITRECritical 10
In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection. Due to a predictable token, the method `Lcp::saveTranslations()` suffer of a white writer that can inject PHP code into a PHP file.
- Product
- livechatpro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Apr 12, 2024matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol.CVE-2024-32000 · Other software · matrix-org · reported by GitHubMedium 4.3
matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. matrix-appservice-irc before version 2.0.0 can be exploited to leak the truncated body of a message if a malicious user sends a Matrix reply to an event ID they don't have access to. As a precondition to the attack, the malicious user needs to know the event ID of the message they want to leak, as well as to be joined to both the Matrix room and the IRC channel it is bridged to. The message reply containing the leaked message content is visible to IRC channel members when this happens. matrix-appservice-irc 2.0.0 checks whether the user has permission to view an event before constructing a reply. Administrators should upgrade to this version. It's possible to limit the amount of information leaked by setting a reply template that doesn't contain the original message. See these lines `601-604` in the configuration file linked.
- Product
- matrix-appservice-irc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24881 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc allows Reflected XSS.This issue affects WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: from n/a through 6.5.2.
- Product
- WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc
- Affected
- up to 6.5.2
- What to do
- Affects up to 6.5.2. Update WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 1, 2024 MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users.CVE-2023-49115 · Other software · MachineSense · reported by ics-cert@hq.dhs.govHigh 7.5
MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users.
- Product
- FeverWarn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmachinesense.comcisa.gov
Jan 25, 2024A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 10.5 and before.CVE-2024-23615 · Other software · Symantec · reported by disclosures@exodusintel.comCritical 10
A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 10.5 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as root.
- Product
- Messaging Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 25, 2024A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 9.5 and before.CVE-2024-23614 · Other software · Symantec · reported by disclosures@exodusintel.comCritical 10
A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 9.5 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as root.
- Product
- Messaging Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 9, 2024Windows CoreMessaging Information Disclosure VulnerabilityCVE-2024-20694 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows CoreMessaging Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 3, 2024WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: SQL InjectionCVE-2023-6981 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to SQL Injection via the 'group_id' parameter in all versions up to, and including, 6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can leveraged to achieve Reflected Cross-site Scripting.
- Product
- WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc
- Affected
- up to 6.5
- What to do
- Affects up to 6.5. Update WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jan 3, 2024WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: Cross-Site Request ForgeryCVE-2023-6980 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5. This is due to missing or incorrect nonce validation on the 'delete' action of the wp-sms-subscribers page. This makes it possible for unauthenticated attackers to delete subscribers via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc
- Affected
- up to 6.5
- What to do
- Affects up to 6.5. Update WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Dec 28, 2023WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-27447 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc.This issue affects WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: from n/a through 6.0.4.
- Product
- WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc
- Affected
- up to 6.0.4
- What to do
- Affects up to 6.0.4. Update WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 13, 2023The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter.CVE-2023-47323 · Other software · Silverpeas · reported by MITREHigh 7.5
The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.
- Product
- Silverpeas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire.CVE-2023-48221 · Other software · wireapp · reported by GitHubHigh 7.3
wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3.5, a remote format string vulnerability could potentially allow an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 9.2.22 & 9.3.5 and is already included on all Wire products. No known workarounds are available.
- Product
- wire-avs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023In Messaging, there is a possible way to disable the messaging application due to improper input validation.CVE-2023-21391 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In Messaging, there is a possible way to disable the messaging application due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 25, 2023RabbitMQ is a multi-protocol messaging and streaming broker.CVE-2023-46118 · Other software · rabbitmq · reported by GitHubMedium 4.9
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
- Product
- rabbitmq-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Oct 16, 2023dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic.CVE-2023-43658 · Other software · discourse · reported by GitHubHigh 8
dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Improper escaping of event titles could lead to Cross-site Scripting (XSS) within the 'email preview' UI when a site has CSP disabled. Having CSP disabled is a non-default configuration, so the vast majority of sites are unaffected. This problem is resolved in the latest version of the discourse-calendar plugin. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.
- Product
- discourse-calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.mozilla.orggithub.com
Oct 8, 2023In Messaging, there is a possible missing permission check.CVE-2023-40649 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
- Product
- SC9863A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2023In Messaging, there is a possible missing permission check.CVE-2023-40648 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
- Product
- SC9863A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2023In Messaging, there is a possible missing permission check.CVE-2023-40647 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
- Product
- SC9863A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2023In Messaging, there is a possible missing permission check.CVE-2023-40646 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
- Product
- SC9863A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2023In Messaging, there is a possible missing permission check.CVE-2023-40645 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
- Product
- SC9863A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2023In Messaging, there is a possible missing permission check.CVE-2023-40644 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
- Product
- SC9863A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2023In Messaging, there is a possible missing permission check.CVE-2023-40643 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
- Product
- SC9863A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2023In Messaging, there is a possible missing permission check.CVE-2023-40642 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
- Product
- SC9863A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2023In Messaging, there is a possible missing permission check.CVE-2023-40641 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
- Product
- SC9863A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.andCVE-2023-44129 · Other software · LG Electronics · reported by product.security@lge.comLow 3.6
The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.android.mms.ui.QClipIntentReceiverActivity" activity. The attacker can abuse this functionality by launching this activity and then sending a broadcast with the "com.lge.message.action.QCLIP" action. The attacker can send, e.g., their own data/clipdata and set Intent.FLAG_GRANT_* flags. After the attacker received that intent in the "onActivityResult()" method, they would have access to arbitrary content providers that have the `android:grantUriPermissions="true"` flag set.
- Product
- LG V60 Thin Q 5G(LMV600VM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlgsecurity.lge.comlgsecurity.lge.com
Sep 14, 2023A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) message processing feature of Cisco Jabber could allow an authenticated, remote attackeCVE-2022-20917 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) message processing feature of Cisco Jabber could allow an authenticated, remote attacker to manipulate the content of XMPP messages that are used by the affected application. This vulnerability is due to the improper handling of nested XMPP messages within requests that are sent to the Cisco Jabber client software. An attacker could exploit this vulnerability by connecting to an XMPP messaging server and sending crafted XMPP messages to an affected Jabber client. A successful exploit could allow the attacker to manipulate the content of XMPP messages, possibly allowing the attacker to cause the Jabber client application to perform unsafe actions.
- Product
- Cisco Jabber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Sep 6, 2023Improper authentication in Phone and Messaging Storage SMR SEP-2023 Release 1 allows attacker to insert arbitrary data to the provider.CVE-2023-30711 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper authentication in Phone and Messaging Storage SMR SEP-2023 Release 1 allows attacker to insert arbitrary data to the provider.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 1, 2023An issue in O-RAN Software Community E2 G-Release allows attackers to cause a Denial of Service (DoS) by incorrectly initiating the messaging procedure between CVE-2023-41628 · Other software · O-ran-sc · reported by MITREHigh 7.5
An issue in O-RAN Software Community E2 G-Release allows attackers to cause a Denial of Service (DoS) by incorrectly initiating the messaging procedure between the E2Node and E2Term components.
- Product
- E2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.o-ran-sc.orgjira.o-ran-sc.org
Jul 12, 2023In messaging service, there is a missing permission check.CVE-2023-30924 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023In messaging service, there is a missing permission check.CVE-2023-30923 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023In messaging service, there is a missing permission check.CVE-2023-30922 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023In messaging service, there is a missing permission check.CVE-2023-30921 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023In messaging service, there is a missing permission check.CVE-2023-30920 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023In messaging service, there is a missing permission check.CVE-2023-30919 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2023Deserialization of untrusted data in Microsoft Messaging Queuing Service in Medtronic's Paceart Optima versions 1.11 and earlier on Windows allows an unauthorizCVE-2023-31222 · Other software · Medtronic · reported by security@medtronic.comCritical 9.8
Deserialization of untrusted data in Microsoft Messaging Queuing Service in Medtronic's Paceart Optima versions 1.11 and earlier on Windows allows an unauthorized user to impact a healthcare delivery organization’s Paceart Optima system cardiac device causing data to be deleted, stolen, or modified, or the Paceart Optima system being used for further network penetration via network connectivity.
- Product
- Paceart Optima
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordglobal.medtronic.comglobal.medtronic.com
Apr 19, 2023Discourse-reactions is a plugin that allows user to add their reactions to the post in the Discourse messaging platform.CVE-2023-30611 · Other software · discourse · reported by GitHubMedium 4.3
Discourse-reactions is a plugin that allows user to add their reactions to the post in the Discourse messaging platform. In affected versions data about what reactions were performed on a post in a private topic could be leaked. This issue has been addressed in version 0.3. Users are advised to upgrade. Users unable to upgrade should disable the discourse-reactions plugin to fully mitigate the issue.
- Product
- discourse-reactions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript.CVE-2023-28427 · Other software · matrix-org · reported by GitHubHigh 8.2
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- matrix-js-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Mar 28, 2023matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript.CVE-2022-36059 · Other software · matrix-org · reported by GitHubHigh 8.2
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This issue has been fixed in matrix-js-sdk 19.4.0 and users are advised to upgrade. Users unable to upgrade may mitigate this issue by redacting applicable events, waiting for the sync processor to store data, and restarting the client. Alternatively, redacting the applicable events and clearing all storage will often fix most perceived issues. In some cases, no workarounds are possible.
- Product
- matrix-js-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023The HUAWEI Messaging app has a vulnerability of unauthorized file access.CVE-2022-48350 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The HUAWEI Messaging app has a vulnerability of unauthorized file access. Successful exploitation of this vulnerability may affect confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Mar 16, 2023Discourse is an open-source messaging platform.CVE-2023-23935 · Other software · discourse · reported by GitHubLow 3.5
Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the `stable` branch and versions 3.1.0.beta2 and prior on the `beta` and `tests-passed` branches, the count of personal messages displayed for a tag is a count of all personal messages regardless of whether the personal message is visible to a given user. As a result, any users can technically poll a sensitive tag to determine if a new personal message is created even if the user does not have access to the personal message. In the patched versions, the count of personal messages tagged with a given tag is hidden by default. To revert to the old behaviour of displaying the count of personal messages for a given tag, an admin may enable the `display_personal_messages_tag_counts` site setting.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023In messaging service, there is a missing permission check.CVE-2022-44439 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023In messaging service, there is a missing permission check.CVE-2022-44438 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023In messaging service, there is a missing permission check.CVE-2022-44437 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023In messaging service, there is a missing permission check.CVE-2022-44436 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023In messaging service, there is a missing permission check.CVE-2022-44435 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023In messaging service, there is a missing permission check.CVE-2022-44434 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50.CVE-2022-41271 · Network & remote access · SAP · reported by cna@sap.comCritical 9.4
An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50. This user can make use of an open naming and directory API to access services that could perform unauthorized operations. The vulnerability affects local users and data, leading to a considerable impact on confidentiality as well as availability and a limited impact on the integrity of the application. These operations can be used to: * Read any information * Modify sensitive information * Denial of Service attacks (DoS) * SQL Injection
- Product
- NetWeaver Process Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Dec 9, 2022An authenticated user can embed malicious content with XSS into the admin group policy page.CVE-2022-25630 · Other software · Symantec · reported by secure@symantec.comMedium 5.4
An authenticated user can embed malicious content with XSS into the admin group policy page.
- Product
- Messaging Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsupport.broadcom.com
Dec 9, 2022An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executed on the annotationsCVE-2022-25629 · Other software · Symantec · reported by secure@symantec.comMedium 5.4
An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executed on the annotations page (Annotation Text Column).
- Product
- Messaging Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comsupport.broadcom.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.