Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
416 results · page 6 of 9
Mar 24, 2023In getConfirmationMessage of DefaultAutofillPicker.java, there is a possible way to mislead the user to select default autofill application due to improper inpuCVE-2023-20976 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In getConfirmationMessage of DefaultAutofillPicker.java, there is a possible way to mislead the user to select default autofill application due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-216117246
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 9, 2023NextAuth.js is an open source authentication solution for Next.js applications.CVE-2023-27490 · Other software · nextauthjs · reported by GitHubHigh 8.1
NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to **log in as the victim**, bypassing the CSRF protection. This is due to a partial failure during a compromised OAuth session where a session code is erroneously generated. This issue has been addressed in version 4.20.1. Users are advised to upgrade. Users unable to upgrade may using Advanced Initialization, manually check the callback request for state, pkce, and nonce against the provider configuration to prevent this issue. See the linked GHSA for details.
- Product
- next-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordauthjs.devdanielfett.de
Mar 6, 2023PMB v7.4.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /sauvegarde/restaure_act.php.CVE-2023-24736 · Other software · Sigb · reported by MITRECritical 9.8
PMB v7.4.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /sauvegarde/restaure_act.php.
- Product
- PMB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2023Restaurant Menu: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4657 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Restaurant Menu WordPress plugin before 2.3.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Restaurant Menu
- Fixed in
- 2.3.6
- What to do
- Update Restaurant Menu to 2.3.6 or newer.
Jan 27, 2023Quick Restaurant Menu: Authorization bypassCVE-2023-0555 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those actions intended for administrator use. Actions include menu item creation, update and deletion and other menu management functions. Since the plugin does not verify that a post ID passed to one of its AJAX actions belongs to a menu item, this can lead to arbitrary post deletion/alteration.
- Product
- Quick Restaurant Menu
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Quick Restaurant Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 27, 2023Quick Restaurant Menu: Cross-Site Request ForgeryCVE-2023-0554 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to update menu items, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Quick Restaurant Menu
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Quick Restaurant Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 27, 2023Quick Restaurant Menu: Stored Cross-Site ScriptingCVE-2023-0553 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Quick Restaurant Menu
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Quick Restaurant Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 27, 2023Quick Restaurant Menu: Insecure Direct Object ReferenceCVE-2023-0550 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the fact that during menu item deletion/modification, the plugin does not verify that the post ID provided to the AJAX action is indeed a menu item. This makes it possible for authenticated attackers, with subscriber-level access or higher, to modify or delete arbitrary posts.
- Product
- Quick Restaurant Menu
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Quick Restaurant Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2023FluentAuth: Prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-4746 · WordPress plugins & themes · reported by WPScanHigh 7.5
The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin.
- Product
- FluentAuth
- Fixed in
- 1.0.2
- What to do
- Update FluentAuth to 1.0.2 or newer.
Jan 11, 2023A vulnerability was found in Prestaul skeemas and classified as problematic.CVE-2018-25074 · Other software · Prestaul · reported by VulDBLow 3.5
A vulnerability was found in Prestaul skeemas and classified as problematic. This issue affects some unknown processing of the file validators/base.js. The manipulation of the argument uri leads to inefficient regular expression complexity. The patch is named 65e94eda62dc8dc148ab3e59aa2ccc086ac448fd. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218003.
- Product
- skeemas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability was found in stakira OpenUtau.CVE-2022-4880 · Other software · stakira · reported by VulDBMedium 5.5
A vulnerability was found in stakira OpenUtau. It has been classified as critical. This affects the function VoicebankInstaller of the file OpenUtau.Core/Classic/VoicebankInstaller.cs of the component ZIP Archive Handler. The manipulation leads to path traversal. Upgrading to version 0.0.991 is able to address this issue. The identifier of the patch is 849a0a6912aac8b1c28cc32aa1132a3140caff4a. It is recommended to upgrade the affected component. The identifier VDB-217617 was assigned to this vulnerability.
- Product
- OpenUtau
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2022D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parameter in the SetAutoUpgradeInfo function.CVE-2022-46642 · Other software · Dlink · reported by MITRECritical 9.9
D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parameter in the SetAutoUpgradeInfo function.
- Product
- Dir-846 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2022Tauri is a framework for building binaries for all major desktop platforms.CVE-2022-46171 · Other software · tauri-apps · reported by GitHubMedium 6.8
Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication.
- Product
- tauri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2022Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the linkEn parameter at /goform/setAutoPing.CVE-2022-45503 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the linkEn parameter at /goform/setAutoPing.
- Product
- W6-s Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function.CVE-2022-45670 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function.
- Product
- I22 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022Five Star Restaurant Reservations: Does not have authorisationCVE-2022-0421 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments
- Product
- Five Star Restaurant Reservations
- Fixed in
- 2.4.12
- What to do
- Update Five Star Restaurant Reservations to 2.4.12 or newer.
Nov 10, 2022Tauri is a framework for building binaries for all major desktop platforms.CVE-2022-41874 · Other software · tauri-apps · reported by GitHubLow 2.6
Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it is possible to partially bypass the `fs` scope definition. It is not possible to traverse into arbitrary paths, as the issue is limited to neighboring files and sub folders of already allowed paths. The impact differs on Windows, MacOS and Linux due to different specifications of valid path characters. This bypass depends on the file picker dialog or dragged files, as user selected paths are automatically added to the allow list at runtime. A successful bypass requires the user to select a pre-existing malicious file or directory during the file picker dialog and an adversary controlled logic to access these files. The issue has been patched in versions 1.0.7, 1.1.2 and 1.2.0. As a workaround, disable the dialog and fileDropEnabled component inside the tauri.conf.json.
- Product
- tauri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2022Restaurant Menu – Food Ordering System – Table Reservation: Cross-Site Request ForgeryCVE-2022-3776 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on several functions called via AJAX actions such as forms_action, set_option, & chosen_options to name a few . This makes it possible for unauthenticated attackers to perform a variety of administrative actions like modifying forms, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Restaurant Menu – Food Ordering System – Table Reservation
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Restaurant Menu – Food Ordering System – Table Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 3, 2022Restaurant Menu – Food Ordering System – Table Reservation: Authorization bypassCVE-2022-2696 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX actions in versions up to, and including 2.3.0 due to missing capability checks and missing nonce validation. This makes it possible for authenticated attackers with minimal permissions to perform a wide variety of actions such as modifying the plugin's settings and modifying the ordering system preferences.
- Product
- Restaurant Menu – Food Ordering System – Table Reservation
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Restaurant Menu – Food Ordering System – Table Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 1, 2022Restaurant POS System v1.0 was discovered to contain a SQL injection vulnerability via update_customer.php.CVE-2022-43086 · Other software · Codeastro · reported by MITREMedium 4.9
Restaurant POS System v1.0 was discovered to contain a SQL injection vulnerability via update_customer.php.
- Product
- Restaurant POS System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022An arbitrary file upload vulnerability in add_product.php of Restaurant POS System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.CVE-2022-43085 · Other software · Codeastro · reported by MITREHigh 7.2
An arbitrary file upload vulnerability in add_product.php of Restaurant POS System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Restaurant POS System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js.CVE-2022-39263 · Other software · nextauthjs · reported by GitHubMedium 6.8
`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` Email Provider and `@next-auth/upstash-redis-adapter` before v3.0.2 are affected by this vulnerability. The Upstash Redis adapter implementation did not check for both the identifier (email) and the token, but only checking for the identifier when verifying the token in the email callback flow. An attacker who knows about the victim's email could easily sign in as the victim, given the attacker also knows about the verification token's expired duration. The vulnerability is patched in v3.0.2. A workaround is available. Using Advanced Initialization, developers can check the requests and compare the query's token and identifier before proceeding.
- Product
- next-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formSetAutoPing function.CVE-2022-40103 · Network & remote access · Tenda · reported by MITREMedium 5.5
Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formSetAutoPing function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
- Product
- I9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022SWFTools commit 772e55a2 was discovered to contain a global buffer overflow via DCTStream::transformDataUnit at /xpdf/Stream.cc.CVE-2022-35093 · Other software · Swftools · reported by MITREMedium 5.5
SWFTools commit 772e55a2 was discovered to contain a global buffer overflow via DCTStream::transformDataUnit at /xpdf/Stream.cc.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedataupload.CVE-2022-38340 · Other software · Safe · reported by MITRECritical 9.1
Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedataupload.
- Product
- FME Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.safe.comcommunity.safe.com
Sep 19, 2022Ketchup Restaurant Reservations: Does not validate and escape some reservation parameters before using them in SQL statementsCVE-2022-2754 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not validate and escape some reservation parameters before using them in SQL statements, which could allow unauthenticated attackers to perform SQL Injection attacks
- Product
- Ketchup Restaurant Reservations
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Ketchup Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2022Ketchup Restaurant Reservations: Does not sanitise and escape some of the reservation user inputsCVE-2022-2753 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation made
- Product
- Ketchup Restaurant Reservations
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Ketchup Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 15, 2022Tauri is a framework for building binaries for all major desktop platforms.CVE-2022-39215 · Other software · tauri-apps · reported by GitHubHigh 8.3
Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Users are advised to upgrade. Users unable to upgrade should disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`.
- Product
- tauri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::transformDataUnit at /xpdf/Stream.cc.CVE-2022-38228 · Other software · Xpdf Project · reported by MITREHigh 7.8
XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::transformDataUnit at /xpdf/Stream.cc.
- Product
- Xpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2022A stack overflow vulnerability exists in /goform/setAutoPing in Tenda W6 V1.0.0.9(4122), which allows an attacker to construct ping1 parameters and ping2 parameCVE-2022-35559 · Network & remote access · Tenda · reported by MITRECritical 9.8
A stack overflow vulnerability exists in /goform/setAutoPing in Tenda W6 V1.0.0.9(4122), which allows an attacker to construct ping1 parameters and ping2 parameters for a stack overflow attack. An attacker can use this vulnerability to execute arbitrary code execution.
- Product
- W6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2022NextAuth.js is a complete open source authentication solution for Next.js applications.CVE-2022-35924 · Other software · nextauthjs · reported by GitHubCritical 9.1
NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` either in versions before `4.10.3` or `3.29.10` are affected. If an attacker could forge a request that sent a comma-separated list of emails (eg.: `attacker@attacker.com,victim@victim.com`) to the sign-in endpoint, NextAuth.js would send emails to both the attacker and the victim's e-mail addresses. The attacker could then login as a newly created user with the email being `attacker@attacker.com,victim@victim.com`. This means that basic authorization like `email.endsWith("@victim.com")` in the `signIn` callback would fail to communicate a threat to the developer and would let the attacker bypass authorization, even with an `@attacker.com` address. This vulnerability has been patched in `v4.10.3` and `v3.29.10` by normalizing the email value that is sent to the sign-in endpoint before accessing it anywhere else. We also added a `normalizeIdentifier` callback on the `EmailProvider` configuration, where you can further tweak your requirements for what your system considers a valid e-mail address. (E.g.: strict RFC2821 compliance). Users are advis
- Product
- next-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.wikipedia.orggithub.com
Aug 1, 2022NextAuth.js is a complete open source authentication solution for Next.js applications.CVE-2022-31186 · Other software · nextauthjs · reported by GitHubLow 3.3
NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions. This issue has been patched in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production. If for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs.
- Product
- next-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnext-auth.js.org
Jul 20, 2022Quick Restaurant Reservations (WordPress plugin): Cross-site Scripting (XSS)CVE-2022-29923 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Cross-site Scripting (XSS) vulnerability in ThingsForRestaurants Quick Restaurant Reservations (WordPress plugin) allows Reflected XSS.This issue affects Quick Restaurant Reservations (WordPress plugin): from n/a through 1.4.1.
- Product
- Quick Restaurant Reservations (WordPress plugin)
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Quick Restaurant Reservations (WordPress plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 11, 2022Free Booking Plugin for Hotels, Restaurant and Car Rental: Suffers from insufficient input validationCVE-2022-1952 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validation steps.
- Product
- Free Booking Plugin for Hotels, Restaurant and Car Rental
- Fixed in
- 1.1.16
- What to do
- Update Free Booking Plugin for Hotels, Restaurant and Car Rental to 1.1.16 or newer.
Jul 6, 2022NextAuth.js is a complete open source authentication solution for Next.js applications.CVE-2022-31127 · Other software · nextauthjs · reported by GitHubHigh 7.1
NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail [signin endpoint](https://next-auth.js.org/getting-started/rest-api#post-apiauthsigninprovider) that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.: `balazs@email.com, <a href="http://attacker.com">Before signing in, claim your money!</a>`. This was previously sent to `balazs@email.com`, and the content of the email containing a link to the attacker's site was rendered in the HTML. This has been remedied in the following releases, by simply not rendering that e-mail in the HTML, since it should be obvious to the receiver what e-mail they used: next-auth v3 users before version 3.29.8 are impacted. (We recommend upgrading to v4, as v3 is considered unmaintained. next-auth v4 users before version 4.9.0 are impacted. If for some reason you cannot upgrade, the workaround requires you to sanitize the `email` parameter that is passed to `sendVerificationRequest` and rendered in the HTML. If you haven't created a custom `sendVerificationRequest`, you only need to upgrade.
- Product
- next-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022NextAuth.js is a complete open source authentication solution for Next.js applications.CVE-2022-31093 · Other software · nextauthjs · reported by GitHubHigh 7.5
NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally is converted to a `URL` object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led to the **API route handler timing out and logging in to fail**. This has been remedied in versions 3.29.5 and 4.5.0. If for some reason you cannot upgrade, the workaround requires you to rely on Advanced Initialization. Please see the documentation for more.
- Product
- next-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022NextAuth.js (next-auth) is am open source authentication solution for Next.js applications.CVE-2022-29214 · Other software · nextauthjs · reported by GitHubMedium 6.1
NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Prior to versions 3.29.3 and 4.3.3, an open redirect vulnerability is present when the developer is implementing an OAuth 1 provider. Versions 3.29.3 and 4.3.3 contain a patch for this issue. The maintainers recommend adding a certain configuration to one's `callbacks` option as a workaround for those unable to upgrade.
- Product
- next-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2022next-auth v3 users before version 3.29.2 are impacted.CVE-2022-24858 · Other software · nextauthjs · reported by GitHubMedium 6.1
next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`.
- Product
- next-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnext-auth.js.org
Mar 3, 2022CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'.CVE-2022-22700 · Other software · Cyberark · reported by help@fluidattacks.comMedium 5.3
CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'. In certain configurations, that response header contains different, predictable value ranges which can be used to determine whether a user exists in the tenant.
- Product
- Identity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cyberark.comfluidattacks.com
Feb 11, 2022PendingIntent hijacking vulnerability in DataUsageReminderReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permissiCVE-2022-24000 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.9
PendingIntent hijacking vulnerability in DataUsageReminderReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permission in KnoxPrivacyNoticeReceiver via implicit Intent.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jan 24, 2022Five Star Restaurant Reservations: Does not have capability and CSRF checks in the rtb_welcome_set_schedule AJAX actionCVE-2021-24965 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Five Star Restaurant Reservations WordPress plugin before 2.4.8 does not have capability and CSRF checks in the rtb_welcome_set_schedule AJAX action, allowing any authenticated users to call it. Due to the lack of sanitisation and escaping, users with a role as low as subscriber could perform Cross-Site Scripting attacks against logged in admins
- Product
- Five Star Restaurant Reservations
- Fixed in
- 2.4.8
- What to do
- Update Five Star Restaurant Reservations to 2.4.8 or newer.
Jan 20, 2022A Cross-Site Scripting (XSS) vulnerability exists in Courcecodester Multi Restaurant Table Reservation System 1.0 in register.php via the (1) fullname, (2) phonCVE-2021-44091 · Other software · Multi Restaurant Table Reservation System Project · reported by MITREMedium 5.4
A Cross-Site Scripting (XSS) vulnerability exists in Courcecodester Multi Restaurant Table Reservation System 1.0 in register.php via the (1) fullname, (2) phone, and (3) address parameters.
- Product
- Multi Restaurant Table Reservation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnu11secur1ty.com
Dec 15, 2021In phNxpNHal_DtaUpdate of phNxpNciHal_dta.cc, there is a possible out of bounds write due to an incorrect bounds check.CVE-2021-0977 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In phNxpNHal_DtaUpdate of phNxpNciHal_dta.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-183487770
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Nov 2, 2021An issue was discovered in Nsasoft US LLC SpotAuditor 5.3.5.CVE-2021-27722 · Other software · Nsasoft · reported by MITREMedium 5.5
An issue was discovered in Nsasoft US LLC SpotAuditor 5.3.5. The program can be crashed by entering 300 bytes char data into the "Key" or "Name" field while registering.
- Product
- Spotauditor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Nov 1, 2021Restaurant Menu by MotoPress: Does not properly sanitize or escape inputsCVE-2021-24722 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Restaurant Menu by MotoPress
- Fixed in
- 2.4.2
- What to do
- Update Restaurant Menu by MotoPress to 2.4.2 or newer.
Jul 21, 2021An issue has been found in function DCTStream::transformDataUnit in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an Illegal Use AfterCVE-2020-19467 · Other software · Flowpaper · reported by MITREMedium 5.5
An issue has been found in function DCTStream::transformDataUnit in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an Illegal Use After Free .
- Product
- Pdf2json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021An issue has been found in function DCTStream::transformDataUnit in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid read of sCVE-2020-19466 · Other software · Flowpaper · reported by MITREMedium 5.5
An issue has been found in function DCTStream::transformDataUnit in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid read of size 1 .
- Product
- Pdf2json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl.CVE-2020-18982 · Other software · Halo · reported by MITREMedium 5.4
Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2021A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boundCVE-2021-3637 · Other software · Redhat · reported by Red HatHigh 7.5
A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly which could lead to a DoS attack.
- Product
- Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
May 17, 2021ReDi Restaurant Reservation: Provides the functionality to let users make restaurant reservationsCVE-2021-24299 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page, which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe, and the stored reservation with XSS payload is loaded.
- Product
- ReDi Restaurant Reservation
- Fixed in
- 21.0426
- What to do
- Update ReDi Restaurant Reservation to 21.0426 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.