Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,762 results · page 70 of 96
Jun 28, 2022A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files.CVE-2022-0987 · Other software · Packagekit Project · reported by Red HatLow 3.3
A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists.
- Product
- Packagekit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Jun 27, 2022Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users to access credentialsCVE-2022-2221 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users to access credentials of other users. This issue affects: Devolutions Remote Desktop Manager versions prior to 2022.1.8.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Jun 27, 2022Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0.CVE-2022-0722 · Other software · ionicabizau · reported by security@huntr.devHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0.
- Product
- ionicabizau/parse-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Import Export All WordPress Images, Users & Post Types: Does not fully validate the file to be imported via an URL before making an HTTP request to itCVE-2022-1977 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks
- Product
- Import Export All WordPress Images, Users & Post Types
- Fixed in
- 6.5.3
- What to do
- Update Import Export All WordPress Images, Users & Post Types to 6.5.3 or newer.
Jun 24, 2022The authentication mechanism used by poll workers to administer voting using the tested version of Dominion Voting Systems ImageCast X can expose cryptographic CVE-2022-1746 · Other software · Dominion Voting Systems · reported by ics-cert@hq.dhs.govHigh 7.6
The authentication mechanism used by poll workers to administer voting using the tested version of Dominion Voting Systems ImageCast X can expose cryptographic secrets used to protect election information. An attacker could leverage this vulnerability to gain access to sensitive information and perform privileged actions, potentially affecting other election equipment.
- Product
- ImageCast X application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality rCVE-2022-1740 · Other software · Dominion Voting Systems · reported by ics-cert@hq.dhs.govMedium 4.6
The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality rely on self-attestation mechanisms. An attacker could leverage this vulnerability to disguise malicious applications on a device.
- Product
- ImageCast X application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022A CWE-668 Exposure of Resource to Wrong Sphere vulnerability exists that could cause users to be misled, hiding alarms, showing the wrong server connection optiCVE-2022-32530 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 4.8
A CWE-668 Exposure of Resource to Wrong Sphere vulnerability exists that could cause users to be misled, hiding alarms, showing the wrong server connection option or the wrong control request when a mobile device has been compromised by a malicious application. Affected Product: Geo SCADA Mobile (Build 222 and prior)
- Product
- Geo SCADA Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jun 23, 2022Improper Authentication vulnerability in S&D smarthome(smartcare) application can cause authentication bypass and information exposure.CVE-2021-26638 · Other software · Xi S&D Inc. · reported by vuln@krcert.or.krHigh 7.3
Improper Authentication vulnerability in S&D smarthome(smartcare) application can cause authentication bypass and information exposure. Remote attackers can use this vulerability to take control of the home environment including indoor control.
- Product
- S&D smarthome (smartcare)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Jun 23, 2022Stored XSS and SQL injection vulnerability in MaxBoard could lead to occur Remote Code Execution, which could lead to information exposure and privilege escalatCVE-2021-26636 · Other software · MaxBoard · reported by vuln@krcert.or.krHigh 8.8
Stored XSS and SQL injection vulnerability in MaxBoard could lead to occur Remote Code Execution, which could lead to information exposure and privilege escalation.
- Product
- MaxBoard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Jun 20, 2022Very Simple Contact Form: Exposes the solution to the captcha in the rendered contact formCVE-2022-1801 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots.
- Product
- Very Simple Contact Form
- Fixed in
- 11.6
- What to do
- Update Very Simple Contact Form to 11.6 or newer.
Jun 17, 2022All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by usersCVE-2022-25871 · Other software · Querymen Project · reported by report@snyk.ioMedium 5.9
All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of [CVE-2020-7600](https://security.snyk.io/vuln/SNYK-JS-QUERYMEN-559867).
- Product
- Querymen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022Authenticated (editor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Export All URLs plugin <= 4.1 at WordPress.CVE-2022-29452 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (editor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Export All URLs plugin <= 4.1 at WordPress.
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 14, 2022A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN579 X3 M79X3.V5030.180719 allows attackers to obtain sensitive router information via a crafted POCVE-2022-31847 · Other software · Wavlink · reported by MITREHigh 7.5
A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN579 X3 M79X3.V5030.180719 allows attackers to obtain sensitive router information via a crafted POST request.
- Product
- Wn579x3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Improper handling between export and release functions on the same handle from client can lead to use after free in Snapdragon Compute, Snapdragon Connectivity,CVE-2021-35120 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Improper handling between export and release functions on the same handle from client can lead to use after free in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
- Product
- Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 13, 2022Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.CVE-2022-32192 · Other software · Couchbase · reported by MITREHigh 7.5
Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
- Product
- Couchbase Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.couchbase.comcouchbase.com
Jun 13, 2022Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.CVE-2022-32193 · Other software · Couchbase · reported by MITREMedium 6.5
Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
- Product
- Couchbase Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.couchbase.comcouchbase.com
Jun 13, 2022Export any WordPress data to XML/CSV: Does not sanitize the cpt POST parameterCVE-2022-1800 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability.
- Product
- Export any WordPress data to XML/CSV
- Fixed in
- 1.3.5
- What to do
- Update Export any WordPress data to XML/CSV to 1.3.5 or newer.
Jun 13, 2022A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances.CVE-2022-32740 · Other software · OTRS AG · reported by security@otrs.comLow 3.5
A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances.
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/webservices/export-v2.php.CVE-2022-31402 · Other software · Combodo · reported by MITREMedium 6.1
ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/webservices/export-v2.php.
- Product
- Itop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Jun 9, 2022Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an exposed dangerous method vulnerability that could allow an attacker to obtain access to leakedCVE-2022-30703 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.8
Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an exposed dangerous method vulnerability that could allow an attacker to obtain access to leaked kernel addresses and disclose sensitive information. This vulnerability could also potentially be chained for privilege escalation.
- Product
- Trend Micro Security (Consumer)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.trendmicro.comzerodayinitiative.com
Jun 8, 2022The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context.CVE-2022-21122 · Other software · Metarhia · reported by report@snyk.ioCritical 9
The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.
- Product
- Metacalc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2022Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permissio to get sCVE-2022-30742 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permissio to get sim card information through device log.
- Product
- Find My Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 7, 2022Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permission to gCVE-2022-30741 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permission to get sim card information through device log.
- Product
- Find My Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 7, 2022Sensitive information exposure in Sign-out log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permiCVE-2022-30734 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Sensitive information exposure in Sign-out log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permission.
- Product
- Samsung Account
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 7, 2022Sensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permisCVE-2022-30733 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Sensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permission.
- Product
- Samsung Account
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 7, 2022Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access sensitive information via onActivityResuCVE-2022-30732 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access sensitive information via onActivityResult.
- Product
- Samsung Account
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 7, 2022Information exposure vulnerability in ScanPool prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.CVE-2022-30728 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 1.9
Information exposure vulnerability in ScanPool prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 7, 2022Information exposure vulnerability in SemIWCMonitor prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.CVE-2022-30714 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 1.9
Information exposure vulnerability in SemIWCMonitor prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 7, 2022Sensitive information exposure in low-battery dumpstate log prior to SMR Jun-2022 Release 1 allows local attackers to get SIM card information.CVE-2022-28794 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 2.2
Sensitive information exposure in low-battery dumpstate log prior to SMR Jun-2022 Release 1 allows local attackers to get SIM card information.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 2, 2022PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file.CVE-2022-26867 · Other software · Dell · reported by security_alert@emc.comMedium 5.9
PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. The data is taken as is, without any validation or sanitization. It allows a malicious, authenticated user to inject payloads that might get interpreted as formulas by the corresponding spreadsheet application that is being used to open the CSV/XLSX file.
- Product
- PowerStore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /checklogin.jsp endpoint.CVE-2022-26978 · Other software · Barco · reported by MITREMedium 6.1
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /checklogin.jsp endpoint. The os_username parameters is not correctly sanitized, leading to reflected XSS.
- Product
- Control Room Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism.CVE-2022-26977 · Other software · Barco · reported by MITREMedium 6.1
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. Lack of input sanitization of the upload mechanism is leads to stored XSS.
- Product
- Control Room Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism.CVE-2022-26976 · Other software · Barco · reported by MITREMedium 5.4
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. Lack of input sanitization in the upload mechanism is leads to reflected XSS.
- Product
- Control Room Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing log files without authentication.CVE-2022-26975 · Other software · Barco · reported by MITREHigh 7.5
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing log files without authentication.
- Product
- Control Room Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a file upload mechanism.CVE-2022-26974 · Other software · Barco · reported by MITREMedium 6.1
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a file upload mechanism. Lack of input sanitization in the upload mechanism leads to reflected XSS.
- Product
- Control Room Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism.CVE-2022-26973 · Other software · Barco · reported by MITREMedium 5.3
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. By tweaking the license file name, the returned error message exposes internal directory path details.
- Product
- Control Room Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /cgi-bin endpoint.CVE-2022-26972 · Other software · Barco · reported by MITREMedium 6.1
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /cgi-bin endpoint. The URL parameters are not correctly sanitized, leading to reflected XSS.
- Product
- Control Room Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism.CVE-2022-26971 · Other software · Barco · reported by MITREMedium 5.3
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. This upload can be executed without authentication.
- Product
- Control Room Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to tCVE-2022-1929 · Other software · devcert · reported by reefs@jfrog.comMedium 5.9
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method
- Product
- devcert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
Jun 2, 2022An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbiCVE-2021-43308 · Other software · markdown-link-extractor · reported by reefs@jfrog.comMedium 5.9
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function
- Product
- markdown-link-extractor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
Jun 2, 2022An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary inputCVE-2021-43307 · Other software · semver-regex · reported by reefs@jfrog.comMedium 5.9
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
- Product
- semver-regex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
Jun 2, 2022An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary CVE-2021-43306 · Other software · jquery-validation · reported by reefs@jfrog.comMedium 5.9
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method
- Product
- jquery-validation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
May 26, 2022Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests.CVE-2022-24414 · Other software · Dell · reported by security_alert@emc.comHigh 7.6
Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attacks.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2022User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.CVE-2021-27783 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.8
User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.
- Product
- HCL BigFix Mobile / Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 25, 2022VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server.CVE-2021-27779 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.1
VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server.
- Product
- HCL VersionVault Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 25, 2022Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.CVE-2022-1815 · Other software · jgraph · reported by security@huntr.devHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2022Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.CVE-2022-1774 · Other software · jgraph · reported by security@huntr.devMedium 6.1
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2022Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.2CVE-2022-1726 · Other software · wenzhixin · reported by security@huntr.devMedium 5.4
Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties.
- Product
- wenzhixin/bootstrap-table
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022An information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4.CVE-2022-26020 · Other software · InHand Networks · reported by talos-cna@cisco.comMedium 6.5
An information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.
- Product
- InRouter302
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.cominhandnetworks.com
May 12, 2022Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TMCVE-2021-33080 · Other software · Intel · reported by secure@intel.comMedium 6.8
Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC Products may allow an unauthenticated user to potentially enable information disclosure or escalation of privilege via physical access.
- Product
- Optane SSD DC P4800x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.