Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 69 of 87
Feb 17, 2023A vulnerability was found in phjounin TFTPD64-SE 4.64 and classified as critical.CVE-2023-0887 · Other software · phjounin · reported by VulDBHigh 7
A vulnerability was found in phjounin TFTPD64-SE 4.64 and classified as critical. This issue affects some unknown processing of the file tftpd64_svc.exe. The manipulation leads to unquoted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The associated identifier of this vulnerability is VDB-221351.
- Product
- TFTPD64-SE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023A vulnerability was found in Netgear WNDR3700v2 1.0.1.14 and classified as problematic.CVE-2023-0850 · Network & remote access · Netgear · reported by VulDBLow 2.7
A vulnerability was found in Netgear WNDR3700v2 1.0.1.14 and classified as problematic. This issue affects some unknown processing of the component Web Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221153 was assigned to this vulnerability.
- Product
- WNDR3700v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023A vulnerability has been found in Netgear WNDR3700v2 1.0.1.14 and classified as critical.CVE-2023-0849 · Network & remote access · Netgear · reported by VulDBMedium 4.7
A vulnerability has been found in Netgear WNDR3700v2 1.0.1.14 and classified as critical. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221152.
- Product
- WNDR3700v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded.CVE-2023-0841 · Other software · gpac · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded. This issue affects the function mp3_dmx_process of the file filters/reframe_mp3.c. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221087.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023A vulnerability classified as problematic was found in PHPCrazy 1.1.1.CVE-2023-0840 · Websites & servers · Phpcrazy Project · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in PHPCrazy 1.1.1. This vulnerability affects unknown code of the file admin/admin.php?action=users&mode=info&user=2. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221086 is the identifier assigned to this vulnerability.
- Product
- Phpcrazy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2023A vulnerability classified as critical has been found in EasyNAS 1.1.0.CVE-2023-0830 · Other software · Easynas · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in EasyNAS 1.1.0. Affected is the function system of the file /backup.pl. The manipulation leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
- Product
- Easynas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023A vulnerability has been found in simple-markdown 0.5.1 and classified as problematic.CVE-2019-25103 · Other software · Khanacademy · reported by VulDBMedium 4.3
A vulnerability has been found in simple-markdown 0.5.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file simple-markdown.js. The manipulation leads to inefficient regular expression complexity. The attack can be launched remotely. Upgrading to version 0.5.2 is able to address this issue. The patch is named 89797fef9abb4cab2fb76a335968266a92588816. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220639.
- Product
- Simple-markdown
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023A vulnerability, which was classified as problematic, was found in simple-markdown 0.6.0.CVE-2019-25102 · Other software · Khanacademy · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in simple-markdown 0.6.0. Affected is an unknown function of the file simple-markdown.js. The manipulation with the input <<<<<<<<<<:/:/:/:/:/:/:/:/:/:/ leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.6.1 is able to address this issue. The patch is identified as 015a719bf5cdc561feea05500ecb3274ef609cd2. It is recommended to upgrade the affected component. VDB-220638 is the identifier assigned to this vulnerability.
- Product
- Simple-markdown
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023A vulnerability, which was classified as problematic, has been found in atwellpub Resend Welcome Email Plugin 1.0.1 on WordPress.CVE-2015-10078 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in atwellpub Resend Welcome Email Plugin 1.0.1 on WordPress. This issue affects the function send_welcome_email_url of the file resend-welcome-email.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is b14c1f66d307783f0ae74f88088a85999107695c. It is recommended to upgrade the affected component. The identifier VDB-220637 was assigned to this vulnerability.
- Affected
- 1.0.1 to 1.0.1
- What to do
- Affects 1.0.1 to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 11, 2023A vulnerability was found in Tenda AC23 16.03.07.45 and classified as critical.CVE-2023-0782 · Network & remote access · Tenda · reported by VulDBHigh 7.2
A vulnerability was found in Tenda AC23 16.03.07.45 and classified as critical. Affected by this issue is the function formSetSysToolDDNS/formGetSysToolDDNS of the file /bin/httpd. The manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220640.
- Product
- AC23
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2023A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical.CVE-2023-0758 · Other software · glorylion · reported by VulDBMedium 6.3
A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220469 was assigned to this vulnerability.
- Product
- JFinalOA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2023A vulnerability classified as critical has been found in weblabyrinth 0.3.1.CVE-2011-10002 · Other software · Weblabyrinth Project · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in weblabyrinth 0.3.1. This affects the function Labyrinth of the file labyrinth.inc.php. The manipulation leads to sql injection. Upgrading to version 0.3.2 is able to address this issue. The identifier of the patch is 60793fd8c8c4759596d3510641e96ea40e7f60e9. It is recommended to upgrade the affected component. The identifier VDB-220221 was assigned to this vulnerability.
- Product
- Weblabyrinth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.google.comgithub.com
Feb 6, 2023A vulnerability, which was classified as problematic, has been found in WangGuard Plugin 1.8.0 on WordPress.CVE-2017-20177 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in WangGuard Plugin 1.8.0 on WordPress. Affected by this issue is the function wangguard_users_info of the file wangguard-user-info.php of the component WGG User List Handler. The manipulation of the argument userIP leads to cross site scripting. The attack may be launched remotely. The patch is identified as 88414951e30773c8d2ec13b99642688284bf3189. It is recommended to apply a patch to fix this issue. VDB-220214 is the identifier assigned to this vulnerability.
- Affected
- 1.8.0 to 1.8.0
- What to do
- Affects 1.8.0 to 1.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023A vulnerability, which was classified as problematic, was found in tinymighty WikiSEO 1.2.1 on MediaWiki.CVE-2015-10073 · Other software · tinymighty · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in tinymighty WikiSEO 1.2.1 on MediaWiki. This affects the function modifyHTML of the file WikiSEO.body.php of the component Meta Property Tag Handler. The manipulation of the argument content leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.2 is able to address this issue. The patch is named 089a5797be612b18a820f9f1e6593ad9a91b1dba. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220215.
- Product
- WikiSEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2023A vulnerability classified as problematic has been found in eXo Chat Application.CVE-2022-4902 · Other software · eXo · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in eXo Chat Application. Affected is an unknown function of the file application/src/main/webapp/vue-app/components/ExoChatMessageComposer.vue of the component Mention Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.3.0-20220417 is able to address this issue. The name of the patch is 26bf307d3658d1403cfd5c3ad423ce4c4d1cb2dc. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-220212.
- Product
- Chat Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.exoplatform.comgithub.com
Feb 5, 2023A vulnerability classified as problematic was found in ciubotaru share-on-diaspora 0.7.9.CVE-2017-20176 · Other software · ciubotaru · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in ciubotaru share-on-diaspora 0.7.9. This vulnerability affects unknown code of the file new_window.php. The manipulation of the argument title/url leads to cross site scripting. The attack can be initiated remotely. The name of the patch is fb6fae2f8a9b146471450b5b0281046a17d1ac8d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-220204.
- Product
- share-on-diaspora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2023A vulnerability has been found in Gimmie Plugin 1.2.2 on vBulletin and classified as critical.CVE-2014-125086 · Other software · Gimmie Project · reported by VulDBMedium 5.5
A vulnerability has been found in Gimmie Plugin 1.2.2 on vBulletin and classified as critical. Affected by this vulnerability is an unknown functionality of the file trigger_login.php. The manipulation of the argument userid leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The patch is named fe851002d20a8d6196a5abb68bafec4102964d5b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220207.
- Product
- Gimmie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2023A vulnerability, which was classified as critical, was found in Gimmie Plugin 1.2.2 on vBulletin.CVE-2014-125085 · Other software · Gimmie Project · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Gimmie Plugin 1.2.2 on vBulletin. Affected is an unknown function of the file trigger_ratethread.php. The manipulation of the argument t/postusername leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The patch is identified as f11a136e9cbd24997354965178728dc22a2aa2ed. It is recommended to upgrade the affected component. VDB-220206 is the identifier assigned to this vulnerability.
- Product
- Gimmie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2023A vulnerability, which was classified as critical, has been found in Gimmie Plugin 1.2.2 on vBulletin.CVE-2014-125084 · Other software · Gimmie Project · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in Gimmie Plugin 1.2.2 on vBulletin. This issue affects some unknown processing of the file trigger_referral.php. The manipulation of the argument referrername leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The identifier of the patch is 7194a09353dd24a274678383a4418f2fd3fce6f7. It is recommended to upgrade the affected component. The identifier VDB-220205 was assigned to this vulnerability.
- Product
- Gimmie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2023A vulnerability classified as problematic has been found in DaSchTour matomo-mediawiki-extension up to 2.4.2 on MediaWiki.CVE-2017-20175 · Other software · DaSchTour · reported by VulDBLow 2.6
A vulnerability classified as problematic has been found in DaSchTour matomo-mediawiki-extension up to 2.4.2 on MediaWiki. This affects an unknown part of the file Piwik.hooks.php of the component Username Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.4.3 is able to address this issue. The patch is named 681324e4f518a8af4bd1f93867074c728eb9923d. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220203.
- Product
- matomo-mediawiki-extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023A vulnerability, which was classified as critical, was found in Calendar Event Management System 2.3.0.CVE-2023-0675 · Other software · Calendar Event Management System Project · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Calendar Event Management System 2.3.0. This affects an unknown part. The manipulation of the argument start/end leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220197 was assigned to this vulnerability.
- Product
- Calendar Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1.CVE-2023-0674 · Other software · Xuxueli · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality of the file /user/updatePwd of the component New Password Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220196.
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023A vulnerability classified as critical has been found in OnShift TurboGears 1.0.11.10.CVE-2019-25101 · Other software · OnShift · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in OnShift TurboGears 1.0.11.10. This affects an unknown part of the file turbogears/controllers.py of the component HTTP Header Handler. The manipulation leads to http response splitting. It is possible to initiate the attack remotely. Upgrading to version 1.0.11.11 is able to address this issue. The patch is named f68bbaba47f4474e1da553aa51564a73e1d92a84. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220059.
- Product
- TurboGears
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023A vulnerability, which was classified as problematic, has been found in MobileDetect 2.8.31.CVE-2018-25080 · Other software · Mobiledetect · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in MobileDetect 2.8.31. This issue affects the function initLayoutType of the file examples/session_example.php of the component Example. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.8.32 is able to address this issue. The identifier of the patch is 31818a441b095bdc4838602dbb17b8377d1e5cce. It is recommended to upgrade the affected component. The identifier VDB-220061 was assigned to this vulnerability.
- Product
- Mobiledetect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023A vulnerability classified as problematic was found in NREL api-umbrella-web 0.7.1.CVE-2015-10072 · Other software · NREL · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in NREL api-umbrella-web 0.7.1. This vulnerability affects unknown code of the component Flash Message Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.8.0 is able to address this issue. The name of the patch is bcc0e922c61d30367678c8f17a435950969315cd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-220060.
- Product
- api-umbrella-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023A vulnerability was found in fanzila WebFinance 0.5 and classified as critical.CVE-2013-10016 · Other software · fanzila · reported by VulDBMedium 5.5
A vulnerability was found in fanzila WebFinance 0.5 and classified as critical. This issue affects some unknown processing of the file htdocs/admin/save_taxes.php. The manipulation of the argument id leads to sql injection. The patch is named 306f170ca2a8203ae3d8f51fb219ba9e05b945e1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-220055.
- Product
- WebFinance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023A vulnerability has been found in fanzila WebFinance 0.5 and classified as critical.CVE-2013-10015 · Other software · fanzila · reported by VulDBMedium 5.5
A vulnerability has been found in fanzila WebFinance 0.5 and classified as critical. This vulnerability affects unknown code of the file htdocs/admin/save_Contract_Signer_Role.php. The manipulation of the argument n/v leads to sql injection. The patch is identified as abad81af614a9ceef3f29ab22ca6bae517619e06. It is recommended to apply a patch to fix this issue. VDB-220054 is the identifier assigned to this vulnerability.
- Product
- WebFinance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A vulnerability, which was classified as critical, was found in Multilaser RE057 and RE170 2.1/2.2.CVE-2023-0658 · Other software · Multilaser · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Multilaser RE057 and RE170 2.1/2.2. This affects an unknown part of the file /param.file.tgz of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The identifier VDB-220053 was assigned to this vulnerability.
- Product
- RE057
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A vulnerability was found in YAFNET up to 3.1.11 and classified as problematic.CVE-2023-0650 · Other software · Yetanotherforum · reported by VulDBLow 3.5
A vulnerability was found in YAFNET up to 3.1.11 and classified as problematic. This issue affects some unknown processing of the component Signature Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.12 is able to address this issue. The identifier of the patch is a1442a2bacc3335461b44c250e81f8d99c60735f. It is recommended to upgrade the affected component. The identifier VDB-220037 was assigned to this vulnerability.
- Product
- Yaf.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Feb 2, 2023A vulnerability has been found in dst-admin 1.5.0 and classified as critical.CVE-2023-0649 · Other software · Dst-admin Project · reported by VulDBMedium 6.3
A vulnerability has been found in dst-admin 1.5.0 and classified as critical. This vulnerability affects unknown code of the file /home/sendBroadcast. The manipulation of the argument message leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220036.
- Product
- Dst-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A vulnerability, which was classified as critical, was found in dst-admin 1.5.0.CVE-2023-0648 · Other software · Dst-admin Project · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in dst-admin 1.5.0. This affects an unknown part of the file /home/masterConsole. The manipulation of the argument command leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-220035.
- Product
- Dst-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A vulnerability, which was classified as critical, has been found in dst-admin 1.5.0.CVE-2023-0647 · Other software · Dst-admin Project · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in dst-admin 1.5.0. Affected by this issue is some unknown functionality of the file /home/kickPlayer. The manipulation of the argument userId leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-220034 is the identifier assigned to this vulnerability.
- Product
- Dst-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A vulnerability classified as critical was found in dst-admin 1.5.0.CVE-2023-0646 · Other software · Dst-admin Project · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in dst-admin 1.5.0. Affected by this vulnerability is an unknown functionality of the file /home/cavesConsole. The manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220033 was assigned to this vulnerability.
- Product
- Dst-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A vulnerability was found in TRENDnet TEW-652BRP 3.04b01 and classified as problematic.CVE-2023-0639 · Other software · TRENDnet · reported by VulDBLow 2.4
A vulnerability was found in TRENDnet TEW-652BRP 3.04b01 and classified as problematic. This issue affects some unknown processing of the file get_set.ccp of the component Web Management Interface. The manipulation of the argument nextPage leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-220019.
- Product
- TEW-652BRP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical.CVE-2023-0638 · Other software · TRENDnet · reported by VulDBHigh 7.2
A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-220018 is the identifier assigned to this vulnerability.
- Product
- TEW-811DRU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0.CVE-2023-0637 · Other software · TRENDnet · reported by VulDBMedium 6.5
A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. This affects an unknown part of the file wan.asp of the component Web Management Interface. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220017 was assigned to this vulnerability.
- Product
- TEW-811DRU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical.CVE-2023-0613 · Other software · TRENDnet · reported by VulDBHigh 7.5
A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /wireless/security.asp of the component httpd. The manipulation leads to memory corruption. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219937 was assigned to this vulnerability.
- Product
- TEW-811DRU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0.CVE-2023-0612 · Other software · TRENDnet · reported by VulDBHigh 7.5
A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. Affected is an unknown function of the file /wireless/basic.asp of the component httpd. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219936.
- Product
- TEW-811DRU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023A vulnerability, which was classified as critical, has been found in TRENDnet TEW-652BRP 3.04B01.CVE-2023-0611 · Other software · TRENDnet · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in TRENDnet TEW-652BRP 3.04B01. This issue affects some unknown processing of the file get_set.ccp of the component Web Management Interface. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219935.
- Product
- TEW-652BRP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023A vulnerability, which was classified as problematic, was found in SiteFusion Application Server up to 6.6.6.CVE-2016-15023 · Other software · SiteFusion · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in SiteFusion Application Server up to 6.6.6. This affects an unknown part of the file getextension.php of the component Extension Handler. The manipulation leads to path traversal. Upgrading to version 6.6.7 is able to address this issue. The identifier of the patch is 49fff155c303d6cd06ce8f97bba56c9084bf08ac. It is recommended to upgrade the affected component. The identifier VDB-219765 was assigned to this vulnerability.
- Product
- Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2023A vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical.CVE-2021-4315 · Other software · NYUCCL · reported by VulDBMedium 5.5
A vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical. This vulnerability affects unknown code of the file psiturk/experiment.py. The manipulation of the argument mode leads to improper neutralization of special elements used in a template engine. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.1 is able to address this issue. The name of the patch is 47787e15cecd66f2aa87687bf852ae0194a4335f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-219676.
- Product
- psiTurk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2023A vulnerability, which was classified as problematic, has been found in YAFNET up to 3.1.10.CVE-2023-0549 · Other software · Yetanotherforum · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in YAFNET up to 3.1.10. This issue affects some unknown processing of the file /forum/PostPrivateMessage of the component Private Message Handler. The manipulation of the argument subject/message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.11 is able to address this issue. The identifier of the patch is 2237a9d552e258a43570bb478a92a5505e7c8797. It is recommended to upgrade the affected component. The identifier VDB-219665 was assigned to this vulnerability.
- Product
- Yaf.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jan 26, 2023A vulnerability has been found in isoftforce Dreamer CMS up to 4.0.1 and classified as problematic.CVE-2023-0513 · Other software · isoftforce · reported by VulDBLow 3.5
A vulnerability has been found in isoftforce Dreamer CMS up to 4.0.1 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.3 is able to address this issue. It is recommended to upgrade the affected component. VDB-219334 is the identifier assigned to this vulnerability.
- Product
- Dreamer CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2023A vulnerability has been found in Anant Labs google-enterprise-connector-dctm up to 3.2.3 and classified as critical.CVE-2014-125083 · Other software · Anant Labs · reported by VulDBMedium 5.5
A vulnerability has been found in Anant Labs google-enterprise-connector-dctm up to 3.2.3 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username/domain leads to sql injection. The patch is named 6fba04f18ab7764002a1da308e7cd9712b501cb7. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218911.
- Product
- google-enterprise-connector-dctm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2023A vulnerability classified as critical has been found in oktora24 2moons.CVE-2013-10014 · Other software · oktora24 · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in oktora24 2moons. Affected is an unknown function. The manipulation leads to sql injection. The patch is identified as 1b09cf7672eb85b5b0c8a4de321f7a4ad87b09a7. It is recommended to apply a patch to fix this issue. VDB-218898 is the identifier assigned to this vulnerability.
- Product
- 2moons
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2023A vulnerability was found in bastianallgeier Kirby Webmentions Plugin and classified as problematic.CVE-2017-20174 · Other software · bastianallgeier · reported by VulDBMedium 5.6
A vulnerability was found in bastianallgeier Kirby Webmentions Plugin and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as 55bedea78ae9af916a9a41497bd9996417851502. It is recommended to apply a patch to fix this issue. VDB-218894 is the identifier assigned to this vulnerability.
- Product
- Kirby Webmentions Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2023A vulnerability classified as critical has been found in ale7714 sigeprosi.CVE-2012-10006 · Other software · ale7714 · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in ale7714 sigeprosi. This affects an unknown part. The manipulation leads to sql injection. The identifier of the patch is 5291886f6c992316407c376145d331169c55f25b. It is recommended to apply a patch to fix this issue. The identifier VDB-218493 was assigned to this vulnerability.
- Product
- sigeprosi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2023A vulnerability classified as problematic has been found in GENI Portal.CVE-2020-36654 · Other software · GENI · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in GENI Portal. This affects the function no_invocation_id_error of the file portal/www/portal/sliceresource.php. The manipulation of the argument invocation_id/invocation_user leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named 39a96fb4b822bd3497442a96135de498d4a81337. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218475.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2023A vulnerability classified as critical was found in danynab movify-j.CVE-2015-10068 · Other software · danynab · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in danynab movify-j. This vulnerability affects the function getByMovieId of the file app/business/impl/ReviewServiceImpl.java. The manipulation of the argument movieId/username leads to sql injection. The name of the patch is c3085e01936a4d7eff1eda3093f25d56cc4d2ec5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218476.
- Product
- movify-j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability has been found in youngerheart nodeserver and classified as critical.CVE-2020-36651 · Other software · youngerheart · reported by VulDBMedium 5.5
A vulnerability has been found in youngerheart nodeserver and classified as critical. Affected by this vulnerability is an unknown functionality of the file nodeserver.js. The manipulation leads to path traversal. The identifier of the patch is c4c0f0138ab5afbac58e03915d446680421bde28. It is recommended to apply a patch to fix this issue. The identifier VDB-218461 was assigned to this vulnerability.
- Product
- nodeserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.