Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 66 of 87
Apr 15, 2023A vulnerability, which was classified as critical, was found in IBOS 4.5.5.CVE-2023-2107 · Other software · Ibos · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in IBOS 4.5.5. Affected is an unknown function of the file file/personal/del&op=recycle. The manipulation of the argument fids leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226110 is the identifier assigned to this vulnerability.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2.CVE-2023-2101 · Other software · moxi624 · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2. This issue affects the function uploadPictureByUrl of the file /mogu-picture/file/uploadPicsByUrl. The manipulation of the argument urlList leads to absolute path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226109 was assigned to this vulnerability.
- Product
- Mogu Blog v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS.CVE-2023-2091 · Other software · KylinSoft · reported by VulDBHigh 7.8
A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function adjust_cpufreq_scaling_governer. The manipulation leads to os command injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.4.13 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-226099.
- Product
- youker-assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023A vulnerability was found in DedeCMS up to 5.7.87 and classified as critical.CVE-2023-2056 · Other software · Dedecms · reported by VulDBMedium 6.3
A vulnerability was found in DedeCMS up to 5.7.87 and classified as critical. This issue affects the function GetSystemFile of the file module_main.php. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225941 was assigned to this vulnerability.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023A vulnerability has been found in Control iD iDSecure 4.7.29.1 and classified as problematic.CVE-2023-2044 · Other software · Control iD · reported by VulDBLow 3.5
A vulnerability has been found in Control iD iDSecure 4.7.29.1 and classified as problematic. This vulnerability affects unknown code of the component Dispositivos Page. The manipulation of the argument IP-DNS leads to cross site scripting. The attack can be initiated remotely. VDB-225922 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- iDSecure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023A vulnerability, which was classified as problematic, was found in Control iD RHiD 23.3.19.0.CVE-2023-2043 · Other software · Control iD · reported by VulDBMedium 6.3
A vulnerability, which was classified as problematic, was found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2/customerdb/operator.svc/a of the component Edit Handler. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-225921 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RHiD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023A vulnerability, which was classified as problematic, has been found in DataGear up to 4.7.0/5.1.0.CVE-2023-2042 · Other software · Datagear · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in DataGear up to 4.7.0/5.1.0. Affected by this issue is some unknown functionality of the component JDBC Server Handler. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Datagear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023A vulnerability classified as critical was found in novel-plus 3.6.2.CVE-2023-2041 · Other software · Xxyopen · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in novel-plus 3.6.2. Affected by this vulnerability is an unknown functionality of the file /category/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225919. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023A vulnerability classified as critical has been found in novel-plus 3.6.2.CVE-2023-2040 · Other software · Xxyopen · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in novel-plus 3.6.2. Affected is an unknown function of the file /news/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225918 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2023A vulnerability, which was classified as problematic, has been found in Ping Identity Self-Service Account Manager 1.1.2.CVE-2018-25084 · Other software · Ping Identity · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Ping Identity Self-Service Account Manager 1.1.2. Affected by this issue is some unknown functionality of the file src/main/java/com/unboundid/webapp/ssam/SSAMController.java. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.1.3 is able to address this issue. The patch is identified as f64b10d63bb19ca2228b0c2d561a1a6e5a3bf251. It is recommended to upgrade the affected component. VDB-225362 is the identifier assigned to this vulnerability.
- Product
- Self-Service Account Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2023A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress.CVE-2015-10100 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress. This issue affects some unknown processing of the file classes/dynwid_class.php. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.5.11 is able to address this issue. The identifier of the patch is d0a19c6efcdc86d7093b369bc9e29a0629e57795. It is recommended to upgrade the affected component. The identifier VDB-225353 was assigned to this vulnerability.
- Product
- Dynamic Widgets
- Affected
- up to 1.5.10
- What to do
- Affects up to 1.5.10. Update Dynamic Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in yuan1994 tpAdmin 1.3.12.CVE-2023-1971 · Other software · yuan1994 · reported by VulDBMedium 6.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in yuan1994 tpAdmin 1.3.12. Affected is the function remote of the file application\admin\controller\Upload.php. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225408. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- tpAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtib36.github.iovuldb.com
Apr 10, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, has been found in yuan1994 tpAdmin 1.3.12.CVE-2023-1970 · Other software · yuan1994 · reported by VulDBMedium 6.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, has been found in yuan1994 tpAdmin 1.3.12. This issue affects the function Upload of the file application\admin\controller\Upload.php. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225407. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- tpAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtib36.github.iovuldb.com
Apr 10, 2023A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress.CVE-2015-10099 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress. This affects the function dex_process_ready_to_go_appointment of the file dex_appointments.php. The manipulation of the argument itemnumber leads to sql injection. It is possible to initiate the attack remotely. The patch is named e29a9cdbcb0f37d887dd302a05b9e8bf213da01d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-225351.
- Product
- CP Appointment Calendar
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update CP Appointment Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2023A vulnerability was found in Dart http_server up to 0.9.5 and classified as problematic.CVE-2014-125098 · Other software · Dart · reported by VulDBMedium 4.3
A vulnerability was found in Dart http_server up to 0.9.5 and classified as problematic. Affected by this issue is the function VirtualDirectory of the file lib/src/virtual_directory.dart of the component Directory Listing Handler. The manipulation of the argument request.uri.path leads to cross site scripting. The attack may be launched remotely. Upgrading to version 0.9.6 is able to address this issue. The name of the patch is 27c1cbd8125bb0369e675eb72e48218496e48ffb. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225356.
- Product
- http_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodereview.chromium.orggithub.com
Apr 10, 2023A vulnerability, which was classified as problematic, was found in BestWebSoft Facebook Like Button up to 2.33.CVE-2014-125097 · Other software · BestWebSoft · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in BestWebSoft Facebook Like Button up to 2.33. Affected is the function fcbkbttn_settings_page of the file facebook-button-plugin.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.34 is able to address this issue. The patch is identified as b766da8fa100779409a953f0e46c2a2448cbe99c. It is recommended to upgrade the affected component. VDB-225354 is the identifier assigned to this vulnerability.
- Product
- Facebook Like Button
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2023A vulnerability has been found in BestWebSoft Facebook Like Button up to 2.13 and classified as problematic.CVE-2012-10012 · Other software · BestWebSoft · reported by VulDBMedium 4.3
A vulnerability has been found in BestWebSoft Facebook Like Button up to 2.13 and classified as problematic. Affected by this vulnerability is the function fcbk_bttn_plgn_settings_page of the file facebook-button-plugin.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The patch is named 33144ae5a45ed07efe7fceca901d91365fdbf7cb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-225355.
- Product
- Facebook Like Button
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2023A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic.CVE-2014-125095 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320.
- Affected
- 1.3.4 to 1.3.4
- What to do
- Affects 1.3.4 to 1.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2023A vulnerability was found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic.CVE-2013-10025 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability was found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this issue is the function exitpageadmin of the file exitpage.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 1.59 is able to address this issue. The patch is identified as d964b8e961b2634158719f3328f16eda16ce93ac. It is recommended to upgrade the affected component. VDB-225266 is the identifier assigned to this vulnerability.
- Affected
- 1.55 to 1.55
- What to do
- Affects 1.55 to 1.55. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2023A vulnerability has been found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic.CVE-2013-10024 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability has been found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality of the file exitpage.php. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 1.59 is able to address this issue. The identifier of the patch is d964b8e961b2634158719f3328f16eda16ce93ac. It is recommended to upgrade the affected component. The identifier VDB-225265 was assigned to this vulnerability.
- Affected
- 1.55 to 1.55
- What to do
- Affects 1.55 to 1.55. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 7, 2023A vulnerability, which was classified as problematic, was found in zhenfeng13 My-Blog.CVE-2023-1937 · Other software · zhenfeng13 · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in zhenfeng13 My-Blog. Affected is an unknown function of the file /admin/configurations/userInfo. The manipulation of the argument yourAvatar/yourName/yourEmail leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of this vulnerability is VDB-225264.
- Product
- My-Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2023A vulnerability classified as problematic was found in phpMiniAdmin up to 1.8.120510.CVE-2014-125094 · Websites & servers · Phpminiadmin Project · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in phpMiniAdmin up to 1.8.120510. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.9.140405 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-225001 was assigned to this vulnerability.
- Product
- Phpminiadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress.CVE-2013-10022 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.52 is able to address this issue. The patch is identified as 642ef1dc1751ab6642ce981fe126325bb574f898. It is recommended to upgrade the affected component. VDB-225002 is the identifier assigned to this vulnerability.
- Affected
- 3.51 to 3.51
- What to do
- Affects 3.51 to 3.51. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 2, 2023A vulnerability, which was classified as critical, has been found in sjqzhang go-fastdfs up to 1.4.3.CVE-2023-1800 · Other software · sjqzhang · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in sjqzhang go-fastdfs up to 1.4.3. Affected by this issue is the function upload of the file /group1/uploa of the component File Upload Handler. The manipulation leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224768.
- Product
- go-fastdfs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2023A vulnerability, which was classified as problematic, was found in EyouCMS up to 1.5.4.CVE-2023-1799 · Other software · Eyoucms · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in EyouCMS up to 1.5.4. This affects an unknown part of the file login.php. The manipulation of the argument tag_tag leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224751.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2023A vulnerability, which was classified as problematic, has been found in EyouCMS up to 1.5.4.CVE-2023-1798 · Other software · Eyoucms · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in EyouCMS up to 1.5.4. Affected by this issue is some unknown functionality of the file login.php. The manipulation of the argument typename leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-224750 is the identifier assigned to this vulnerability.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2023A vulnerability classified as critical was found in OTCMS 6.0.1.CVE-2023-1797 · Other software · Otcms · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224749 was assigned to this vulnerability.
- Product
- Otcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2023A vulnerability was found in jeecg-boot 3.5.0 and classified as critical.CVE-2023-1784 · Other software · Jeecg · reported by VulDBMedium 5.3
A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Documentation. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224699.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.youdao.comvuldb.com
Mar 30, 2023A vulnerability has been found in IBOS up to 4.5.4 and classified as critical.CVE-2023-1747 · Other software · Ibos · reported by VulDBMedium 6.3
A vulnerability has been found in IBOS up to 4.5.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /?r=email/api/mark&op=delFromSend. The manipulation of the argument emailids leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.5.5 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-224635.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023A vulnerability, which was classified as problematic, was found in Dreamer CMS up to 3.5.0.CVE-2023-1746 · Other software · Iteachyou · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Dreamer CMS up to 3.5.0. Affected is an unknown function of the component File Upload Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-224634 is the identifier assigned to this vulnerability.
- Product
- Dreamer CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023A vulnerability, which was classified as problematic, has been found in KMPlayer 4.2.2.73.CVE-2023-1745 · Other software · Pandora · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in KMPlayer 4.2.2.73. This issue affects some unknown processing in the library SHFOLDER.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-224633 was assigned to this vulnerability.
- Product
- Kmplayer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 30, 2023A vulnerability classified as critical was found in IBOS 4.5.5.CVE-2023-1744 · Other software · Ibos · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in IBOS 4.5.5. This vulnerability affects unknown code of the component htaccess Handler. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224632.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023A vulnerability, which was classified as problematic, has been found in Xunrui CMS 4.61.CVE-2023-1680 · Other software · Xunrui · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Xunrui CMS 4.61. This issue affects some unknown processing of the file /dayrui/My/View/main.html. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224237 was assigned to this vulnerability.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023A vulnerability was found in Xunrui CMS 4.61 and classified as problematic.CVE-2023-1683 · Other software · Xunrui · reported by VulDBMedium 4.3
A vulnerability was found in Xunrui CMS 4.61 and classified as problematic. Affected by this issue is some unknown functionality of the file /dayrui/Fcms/View/system_log.html. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224240.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023A vulnerability has been found in Xunrui CMS 4.61 and classified as problematic.CVE-2023-1682 · Other software · Xunrui · reported by VulDBMedium 4.3
A vulnerability has been found in Xunrui CMS 4.61 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dayrui/My/Config/Install.txt. The manipulation leads to direct request. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224239.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023A vulnerability, which was classified as problematic, was found in Xunrui CMS 4.61.CVE-2023-1681 · Other software · Xunrui · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in Xunrui CMS 4.61. Affected is an unknown function of the file /config/myfield/test.php. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-224238 is the identifier assigned to this vulnerability.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023A vulnerability classified as critical was found in DriverGenius 9.70.0.346.CVE-2023-1679 · Other software · Drivergenius · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in DriverGenius 9.70.0.346. This vulnerability affects the function 0x9C406104/0x9C40A108 in the library mydrivers64.sys of the component IOCTL Handler. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224236.
- Product
- Drivergenius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 28, 2023A vulnerability classified as critical has been found in DriverGenius 9.70.0.346.CVE-2023-1678 · Other software · Drivergenius · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in DriverGenius 9.70.0.346. This affects the function 0x9C40A0D8/0x9C40A0DC/0x9C40A0E0 in the library mydrivers64.sys of the component IOCTL Handler. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224235.
- Product
- Drivergenius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 26, 2023A vulnerability was found in IObit Malware Fighter 9.4.0.776 and classified as problematic.CVE-2023-1644 · Other software · IObit · reported by VulDBMedium 5.5
A vulnerability was found in IObit Malware Fighter 9.4.0.776 and classified as problematic. Affected by this issue is the function 0x8018E010 in the library IMFCameraProtect.sys of the component IOCTL Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224024.
- Product
- Malware Fighter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 26, 2023A vulnerability has been found in IObit Malware Fighter 9.4.0.776 and classified as problematic.CVE-2023-1643 · Other software · IObit · reported by VulDBMedium 5.5
A vulnerability has been found in IObit Malware Fighter 9.4.0.776 and classified as problematic. Affected by this vulnerability is the function 0x8001E000/0x8001E004/0x8001E018/0x8001E01C/0x8001E024/0x8001E040 in the library ImfHpRegFilter.sys of the component IOCTL Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224023.
- Product
- Malware Fighter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 26, 2023A vulnerability, which was classified as problematic, was found in IObit Malware Fighter 9.4.0.776.CVE-2023-1642 · Other software · IObit · reported by VulDBMedium 5.5
A vulnerability, which was classified as problematic, was found in IObit Malware Fighter 9.4.0.776. Affected is the function 0x222034/0x222038/0x22203C/0x222040 in the library ObCallbackProcess.sys of the component IOCTL Handler. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. VDB-224022 is the identifier assigned to this vulnerability.
- Product
- Malware Fighter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 26, 2023A vulnerability, which was classified as problematic, has been found in IObit Malware Fighter 9.4.0.776.CVE-2023-1641 · Other software · IObit · reported by VulDBMedium 5.5
A vulnerability, which was classified as problematic, has been found in IObit Malware Fighter 9.4.0.776. This issue affects the function 0x222018 in the library ObCallbackProcess.sys of the component IOCTL Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier VDB-224021 was assigned to this vulnerability.
- Product
- Malware Fighter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 26, 2023A vulnerability classified as problematic was found in IObit Malware Fighter 9.4.0.776.CVE-2023-1640 · Other software · IObit · reported by VulDBMedium 5.5
A vulnerability classified as problematic was found in IObit Malware Fighter 9.4.0.776. This vulnerability affects the function 0x222010 in the library ObCallbackProcess.sys of the component IOCTL Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224020.
- Product
- Malware Fighter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 26, 2023A vulnerability classified as problematic has been found in IObit Malware Fighter 9.4.0.776.CVE-2023-1639 · Other software · IObit · reported by VulDBMedium 5.5
A vulnerability classified as problematic has been found in IObit Malware Fighter 9.4.0.776. This affects the function 0x8001E04C in the library ImfRegistryFilter.sys of the component IOCTL Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224019.
- Product
- Malware Fighter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 25, 2023A vulnerability has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6 and classified as critical.CVE-2023-1458 · Network & remote access · Ubiquiti · reported by VulDBHigh 7.2
A vulnerability has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6 and classified as critical. Affected by this vulnerability is an unknown functionality of the component OSPF Handler. The manipulation of the argument area leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-223303. NOTE: The vendor position is that post-authentication issues are not accepted as vulnerabilities.
- Product
- EdgeRouter X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2023A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6.CVE-2023-1457 · Network & remote access · Ubiquiti · reported by VulDBHigh 7.2
A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. Affected is an unknown function of the component Static Routing Configuration Handler. The manipulation of the argument next-hop-interface leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. VDB-223302 is the identifier assigned to this vulnerability. NOTE: The vendor position is that post-authentication issues are not accepted as vulnerabilities.
- Product
- EdgeRouter X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2023A vulnerability, which was classified as critical, has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6.CVE-2023-1456 · Network & remote access · Ubiquiti · reported by VulDBHigh 7.2
A vulnerability, which was classified as critical, has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. This issue affects some unknown processing of the component NAT Configuration Handler. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier VDB-223301 was assigned to this vulnerability. NOTE: The vendor position is that post-authentication issues are not accepted as vulnerabilities.
- Product
- EdgeRouter X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2023A vulnerability classified as problematic has been found in Arno0x TwoFactorAuth.CVE-2016-15030 · Other software · Arno0x · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Arno0x TwoFactorAuth. This affects an unknown part of the file login/login.php. The manipulation of the argument from leads to open redirect. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 8549ad3cf197095f783643e41333586d6a4d0e54. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-223803.
- Product
- TwoFactorAuth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2023A vulnerability, which was classified as problematic, was found in JiangMin Antivirus 16.2.2022.418.CVE-2023-1631 · Other software · JiangMin · reported by VulDBMedium 5.5
A vulnerability, which was classified as problematic, was found in JiangMin Antivirus 16.2.2022.418. This affects the function 0x222010 in the library kvcore.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-224013 was assigned to this vulnerability.
- Product
- Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 25, 2023A vulnerability, which was classified as problematic, has been found in JiangMin Antivirus 16.2.2022.418.CVE-2023-1630 · Other software · JiangMin · reported by VulDBMedium 5.5
A vulnerability, which was classified as problematic, has been found in JiangMin Antivirus 16.2.2022.418. Affected by this issue is the function 0x222000 in the library kvcore.sys of the component IOCTL Handler. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224012.
- Product
- Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.