Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 65 of 87
May 24, 2023A vulnerability, which was classified as problematic, was found in SiteServer CMS up to 7.2.1.CVE-2023-2862 · Other software · SiteServer · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in SiteServer CMS up to 7.2.1. Affected is an unknown function of the file /api/stl/actions/search. The manipulation of the argument ajaxDivId leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-229818 is the identifier assigned to this vulnerability.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2023A vulnerability classified as problematic was found in Weaver e-cology up to 9.0.CVE-2023-2806 · Other software · Weaver · reported by VulDBMedium 5.5
A vulnerability classified as problematic was found in Weaver e-cology up to 9.0. Affected by this vulnerability is the function RequestInfoByXml of the component API. The manipulation leads to xml external entity reference. The associated identifier of this vulnerability is VDB-229411. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- e-cology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2023A vulnerability, which was classified as problematic, has been found in cnoa OA up to 5.1.1.5.CVE-2023-2799 · Other software · cnoa · reported by VulDBMedium 6.3
A vulnerability, which was classified as problematic, has been found in cnoa OA up to 5.1.1.5. Affected by this issue is some unknown functionality of the file /index.php?app=main&func=passport&action=login. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229376. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2023A vulnerability classified as problematic has been found in TOTOLINK N200RE 9.3.5u.6255_B20211224.CVE-2023-2790 · Other software · TOTOLINK · reported by VulDBLow 2.3
A vulnerability classified as problematic has been found in TOTOLINK N200RE 9.3.5u.6255_B20211224. Affected is an unknown function of the file /squashfs-root/etc_ro/custom.conf of the component Telnet Service. The manipulation leads to password in configuration file. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-229374 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- N200RE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
May 17, 2023A vulnerability was found in Weaver OA 9.5 and classified as problematic.CVE-2023-2766 · Other software · Weaver · reported by VulDBMedium 5.3
A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini. The manipulation leads to files or directories accessible. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229271. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2023A vulnerability has been found in Weaver OA up to 9.5 and classified as problematic.CVE-2023-2765 · Other software · Weaver · reported by VulDBMedium 4.3
A vulnerability has been found in Weaver OA up to 9.5 and classified as problematic. This vulnerability affects unknown code of the file /E-mobile/App/System/File/downfile.php. The manipulation of the argument url leads to absolute path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-229270 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023A vulnerability classified as problematic was found in Gira HomeServer up to 4.12.0.220829 beta.CVE-2023-2739 · Other software · Gira · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Gira HomeServer up to 4.12.0.220829 beta. This vulnerability affects unknown code of the file /hslist. The manipulation of the argument lst with the input debug%27"><img%20src=x%20onerror=alert(document.cookie)> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-229150 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- HomeServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023A vulnerability classified as critical has been found in Tongda OA 11.10.CVE-2023-2738 · Other software · Tongda · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Tongda OA 11.10. This affects the function actionGetdata of the file GatewayController.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229149 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023A vulnerability was found in Caton Live up to 2023-04-26 and classified as critical.CVE-2023-2682 · Other software · Caton · reported by VulDBMedium 6.3
A vulnerability was found in Caton Live up to 2023-04-26 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/ping.cgi of the component Mini_HTTPD. The manipulation of the argument address with the input ;id;uname${IFS}-a leads to command injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-228911. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Live
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023A vulnerability, which was classified as critical, has been found in H3C R160 V1004004.CVE-2023-2676 · Other software · H3C · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in H3C R160 V1004004. Affected by this issue is some unknown functionality of the file /goForm/aspForm. The manipulation of the argument go leads to stack-based buffer overflow. The exploit has been disclosed to the public and may be used. VDB-228890 is the identifier assigned to this vulnerability.
- Product
- R160
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023A vulnerability was found in Weaver E-Office 9.5 and classified as critical.CVE-2023-2647 · Other software · Weaver · reported by VulDBMedium 6.3
A vulnerability was found in Weaver E-Office 9.5 and classified as critical. Affected by this issue is some unknown functionality of the file /webroot/inc/utility_all.php of the component File Upload Handler. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228776. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- E-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023A vulnerability has been found in TP-Link Archer C7v2 v2_en_us_180114 and classified as problematic.CVE-2023-2646 · Network & remote access · TP-Link · reported by VulDBMedium 4.5
A vulnerability has been found in TP-Link Archer C7v2 v2_en_us_180114 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component GET Request Parameter Handler. The manipulation leads to denial of service. The attack can only be done within the local network. The associated identifier of this vulnerability is VDB-228775. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Archer C7v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41.CVE-2023-2645 · Other software · USR · reported by VulDBCritical 9.8
A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41. Affected is an unknown function of the component Web Management Page. The manipulation of the argument username/password with the input root leads to use of hard-coded password. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-228774 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- USR-G806
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023A vulnerability, which was classified as problematic, has been found in DigitalPersona FPSensor 1.0.0.1.CVE-2023-2644 · Other software · DigitalPersona · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in DigitalPersona FPSensor 1.0.0.1. This issue affects some unknown processing of the file C:\Program Files (x86)\FPSensor\bin\DpHost.exe. The manipulation leads to unquoted search path. Attacking locally is a requirement. The identifier VDB-228773 was assigned to this vulnerability.
- Product
- FPSensor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4.7.0.CVE-2023-2618 · Other software · OpenCV · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this issue is the function DecodedBitStreamParser::decodeHanziSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to memory leak. The attack may be launched remotely. The name of the patch is 2b62ff6181163eea029ed1cab11363b4996e9cd6. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-228548.
- Product
- wechat_qrcode Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4.7.0.CVE-2023-2617 · Other software · OpenCV · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this vulnerability is the function DecodedBitStreamParser::decodeByteSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-228547.
- Product
- wechat_qrcode Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 4, 2023A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0.CVE-2023-2524 · Other software · Control iD · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2/#/. The manipulation leads to direct request. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-228015. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RHiD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2023A vulnerability was found in Caton Prime 2.1.2.51.e8d7225049(202303031001) and classified as critical.CVE-2023-2520 · Other software · Caton · reported by VulDBHigh 8.8
A vulnerability was found in Caton Prime 2.1.2.51.e8d7225049(202303031001) and classified as critical. This issue affects some unknown processing of the file cgi-bin/tools_ping.cgi?action=Command of the component Ping Handler. The manipulation of the argument Destination leads to command injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-228011. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Prime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2023A vulnerability has been found in Caton CTP Relay Server 1.2.9 and classified as critical.CVE-2023-2519 · Other software · Caton · reported by VulDBHigh 7.3
A vulnerability has been found in Caton CTP Relay Server 1.2.9 and classified as critical. This vulnerability affects unknown code of the file /server/api/v1/login of the component API. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. VDB-228010 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CTP Relay Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2023A vulnerability was found in Dromara J2eeFAST up to 2.6.0 and classified as problematic.CVE-2023-2475 · Other software · Dromara · reported by VulDBLow 3.5
A vulnerability was found in Dromara J2eeFAST up to 2.6.0 and classified as problematic. This issue affects some unknown processing of the component System Message Handler. The manipulation of the argument 主题 leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 7a9e1a00e3329fdc0ae05f7a8257cce77037134d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-227867.
- Product
- J2eeFAST
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2023A vulnerability has been found in Rebuild 3.2 and classified as problematic.CVE-2023-2474 · Other software · Getrebuild · reported by VulDBMedium 4.3
A vulnerability has been found in Rebuild 3.2 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-227866 is the identifier assigned to this vulnerability.
- Product
- Rebuild
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2023A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress.CVE-2014-125100 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is dbb71deee071422ce3e663fbcdce3ad24886f940. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227764.
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 1, 2023A vulnerability, which was classified as problematic, has been found in Mail Subscribe List Plugin up to 2.0.10 on WordPress.CVE-2013-10026 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Mail Subscribe List Plugin up to 2.0.10 on WordPress. This issue affects some unknown processing of the file index.php. The manipulation of the argument sml_name/sml_email leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.1 is able to address this issue. The identifier of the patch is 484970ef8285cae51d2de3bd4e4684d33c956c28. It is recommended to upgrade the affected component. The identifier VDB-227765 was assigned to this vulnerability.
- Product
- Mail Subscribe List
- Affected
- up to 2.0.10
- What to do
- Affects up to 2.0.10. Update Mail Subscribe List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 1, 2023A vulnerability classified as problematic was found in Responsive Menus 7.x-1.x-dev on Drupal.CVE-2018-25085 · Websites & servers · Drupal · reported by VulDBLow 2.4
A vulnerability classified as problematic was found in Responsive Menus 7.x-1.x-dev on Drupal. Affected by this vulnerability is the function responsive_menus_admin_form_submit of the file responsive_menus.module of the component Configuration Setting Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 7.x-1.7 is able to address this issue. The patch is named 3c554b31d32a367188f44d44857b061eac949fb8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-227755.
- Product
- Responsive Menus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.drupalcode.orgvuldb.com
Apr 30, 2023A vulnerability, which was classified as critical, was found in IP Blacklist Cloud Plugin up to 3.42 on WordPress.CVE-2015-10105 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in IP Blacklist Cloud Plugin up to 3.42 on WordPress. This affects the function valid_js_identifier of the file ip_blacklist_cloud.php of the component CSV File Import. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. Upgrading to version 3.43 is able to address this issue. The identifier of the patch is 6e6fe8c6fda7cbc252eef083105e08d759c07312. It is recommended to upgrade the affected component. The identifier VDB-227757 was assigned to this vulnerability.
- Product
- IP Blacklist Cloud
- Affected
- up to 3.42
- What to do
- Affects up to 3.42. Update IP Blacklist Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 30, 2023A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress.CVE-2015-10104 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress. Affected by this issue is some unknown functionality of the file classes/class-icons-for-features-admin.php. The manipulation of the argument redirect_url leads to open redirect. The attack may be launched remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 63124c021ae24b68e56872530df26eb4268ad633. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227756.
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 29, 2023A vulnerability was found in DedeCMS 5.7.106 and classified as critical.CVE-2023-2424 · Other software · Dedecms · reported by VulDBMedium 6.3
A vulnerability was found in DedeCMS 5.7.106 and classified as critical. Affected by this issue is the function UpDateMemberModCache of the file uploads/dede/config.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227750 is the identifier assigned to this vulnerability.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023A vulnerability classified as problematic has been found in Control iD RHiD 23.3.19.0.CVE-2023-2421 · Other software · Control iD · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Control iD RHiD 23.3.19.0. Affected is an unknown function of the file /v2/#/add/department. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. VDB-227718 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RHiD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023A vulnerability was found in ks-soft Advanced Host Monitor up to 12.56 and classified as problematic.CVE-2023-2417 · Other software · ks-soft · reported by VulDBMedium 5.3
A vulnerability was found in ks-soft Advanced Host Monitor up to 12.56 and classified as problematic. Affected by this issue is some unknown functionality of the file C:\Program Files (x86)\HostMonitor\RMA-Win\rma_active.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local host. Upgrading to version 12.60 is able to address this issue. It is recommended to upgrade the affected component. VDB-227714 is the identifier assigned to this vulnerability.
- Product
- Advanced Host Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Apr 28, 2023A vulnerability classified as problematic was found in Netgear SRX5308 up to 4.3.5-3.CVE-2023-2396 · Network & remote access · Netgear · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Netgear SRX5308 up to 4.3.5-3. This vulnerability affects unknown code of the component Web Management Interface. The manipulation of the argument USERDBUsers.Password leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227674 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SRX5308
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023A vulnerability classified as problematic has been found in Netgear SRX5308 up to 4.3.5-3.CVE-2023-2395 · Network & remote access · Netgear · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in Netgear SRX5308 up to 4.3.5-3. This affects an unknown part of the component Web Management Interface. The manipulation of the argument Login.userAgent leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227673 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SRX5308
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic.CVE-2023-2391 · Network & remote access · Netgear · reported by VulDBLow 2.4
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. This issue affects some unknown processing of the file scgi-bin/platform.cgi?page=time_zone.htm of the component Web Management Interface. The manipulation of the argument ntp.server2 leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227669 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SRX5308
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023A vulnerability has been found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic.CVE-2023-2390 · Network & remote access · Netgear · reported by VulDBLow 2.4
A vulnerability has been found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. This vulnerability affects unknown code of the file scgi-bin/platform.cgi?page=time_zone.htm of the component Web Management Interface. The manipulation of the argument ntp.server1 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227668. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SRX5308
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023A vulnerability, which was classified as problematic, was found in Netgear SRX5308 up to 4.3.5-3.CVE-2023-2389 · Network & remote access · Netgear · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, was found in Netgear SRX5308 up to 4.3.5-3. This affects an unknown part of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument smtpServer.emailServer leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227667. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SRX5308
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023A vulnerability, which was classified as problematic, has been found in Netgear SRX5308 up to 4.3.5-3.CVE-2023-2388 · Network & remote access · Netgear · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, has been found in Netgear SRX5308 up to 4.3.5-3. Affected by this issue is some unknown functionality of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument smtpServer.fromAddr leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227666 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SRX5308
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023A vulnerability classified as problematic was found in Netgear SRX5308 up to 4.3.5-3.CVE-2023-2387 · Network & remote access · Netgear · reported by VulDBLow 2.4
A vulnerability classified as problematic was found in Netgear SRX5308 up to 4.3.5-3. Affected by this vulnerability is an unknown functionality of the file scgi-bin/platform.cgi?page=dmz_setup.htm of the component Web Management Interface. The manipulation of the argument winsServer1 leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227665 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SRX5308
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023A vulnerability classified as problematic has been found in Netgear SRX5308 up to 4.3.5-3.CVE-2023-2386 · Network & remote access · Netgear · reported by VulDBLow 2.4
A vulnerability classified as problematic has been found in Netgear SRX5308 up to 4.3.5-3. Affected is an unknown function of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument smtpServer.toAddr leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227664. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SRX5308
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic.CVE-2023-2382 · Network & remote access · Netgear · reported by VulDBLow 2.4
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this issue is some unknown functionality of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument sysLogInfo.serverName leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227660. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SRX5308
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023A vulnerability has been found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic.CVE-2023-2381 · Network & remote access · Netgear · reported by VulDBLow 2.4
A vulnerability has been found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file scgi-bin/platform.cgi?page=bandwidth_profile.htm of the component Web Management Interface. The manipulation of the argument BandWidthProfile.ProfileName leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227659. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SRX5308
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023A vulnerability, which was classified as problematic, was found in Netgear SRX5308 up to 4.3.5-3.CVE-2023-2380 · Network & remote access · Netgear · reported by VulDBMedium 6.5
A vulnerability, which was classified as problematic, was found in Netgear SRX5308 up to 4.3.5-3. Affected is an unknown function. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-227658 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SRX5308
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023A vulnerability classified as critical has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6.CVE-2023-2379 · Network & remote access · Ubiquiti · reported by VulDBHigh 7.5
A vulnerability classified as critical has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown part of the component Web Service. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227655.
- Product
- EdgeRouter X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023A vulnerability classified as problematic has been found in Kau-Boy Backend Localization Plugin 2.0 on WordPress.CVE-2012-10014 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Kau-Boy Backend Localization Plugin 2.0 on WordPress. Affected is the function backend_localization_admin_settings/backend_localization_save_setting/backend_localization_login_form/localize_backend of the file backend_localization.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.1 is able to address this issue. The name of the patch is 36f457ee16dd114e510fd91a3ea9fbb3c1f87184. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227232.
- Fixed in
- 2.0.1
- What to do
- Update the plugin to 2.0.1 or newer.
Apr 22, 2023A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49.CVE-2022-4944 · Other software · kalcaddle · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.50 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227000.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2023A vulnerability, which was classified as critical, was found in PoDoFo 0.10.0.CVE-2023-2241 · Other software · Podofo Project · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in PoDoFo 0.10.0. Affected is the function readXRefStreamEntry of the file PdfXRefStreamParserObject.cpp. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 535a786f124b739e3c857529cecc29e4eeb79778. It is recommended to apply a patch to fix this issue. VDB-227226 is the identifier assigned to this vulnerability.
- Product
- Podofo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2023A vulnerability, which was classified as critical, was found in MAXTECH MAX-G866ac 0.4.1_TBRO_20160314.CVE-2023-2231 · Other software · MAXTECH · reported by VulDBCritical 9.8
A vulnerability, which was classified as critical, was found in MAXTECH MAX-G866ac 0.4.1_TBRO_20160314. This affects an unknown part of the component Remote Management. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227001 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MAX-G866ac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2023A vulnerability was found in mportuga eslint-detailed-reporter up to 0.9.0 and classified as problematic.CVE-2022-4942 · Other software · mportuga · reported by VulDBLow 3.5
A vulnerability was found in mportuga eslint-detailed-reporter up to 0.9.0 and classified as problematic. Affected by this issue is the function renderIssue in the library lib/template-generator.js. The manipulation of the argument message leads to cross site scripting. The attack may be launched remotely. The patch is identified as 505c190efd4905990db6207863bdcbd9b1d7e1bd. It is recommended to apply a patch to fix this issue. VDB-226310 is the identifier assigned to this vulnerability.
- Product
- eslint-detailed-reporter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2023A vulnerability has been found in I Recommend This Plugin up to 3.7.2 on WordPress and classified as critical.CVE-2014-125099 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability has been found in I Recommend This Plugin up to 3.7.2 on WordPress and classified as critical. Affected by this vulnerability is an unknown functionality of the file dot-irecommendthis.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 058b3ef5c7577bf557557904a53ecc8599b13649. It is recommended to upgrade the affected component. The identifier VDB-226309 was assigned to this vulnerability.
- Product
- I Recommend This
- Affected
- up to 3.7.2
- What to do
- Affects up to 3.7.2. Update I Recommend This to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2023A vulnerability, which was classified as problematic, was found in InternalError503 Forget It up to 1.3.CVE-2015-10103 · Other software · InternalError503 · reported by VulDBLow 2.8
A vulnerability, which was classified as problematic, was found in InternalError503 Forget It up to 1.3. This affects an unknown part of the file js/settings.js. The manipulation of the argument setForgetTime with the input 0 leads to infinite loop. It is possible to launch the attack on the local host. Upgrading to version 1.4 is able to address this issue. The patch is named adf0c7fd59b9c935b4fd675c556265620124999c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-226119.
- Product
- Forget It
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2023A vulnerability, which was classified as critical, has been found in Freshdesk Plugin 1.7 on WordPress.CVE-2015-10102 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Freshdesk Plugin 1.7 on WordPress. Affected by this issue is some unknown functionality. The manipulation leads to open redirect. The attack may be launched remotely. Upgrading to version 1.8 is able to address this issue. The patch is identified as 2aaecd4e0c7c6c1dc4e6a593163d5f7aa0fa5d5b. It is recommended to upgrade the affected component. VDB-226118 is the identifier assigned to this vulnerability.
- Affected
- 1.7 to 1.7
- What to do
- Affects 1.7 to 1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2023A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress.CVE-2015-10101 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress. Affected by this vulnerability is an unknown functionality of the file class-tgm-plugin-activation.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.7 is able to address this issue. The identifier of the patch is 25bb1dea113716200a6f0f3135801d84a7a65540. It is recommended to upgrade the affected component. The identifier VDB-226117 was assigned to this vulnerability.
- Product
- Google Analytics Top Content Widget
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Google Analytics Top Content Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.