Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 73 of 87
Jan 2, 2023A vulnerability, which was classified as problematic, has been found in enigmaX up to 2.2.CVE-2016-15006 · Other software · Enigmax Project · reported by VulDBLow 3.7
A vulnerability, which was classified as problematic, has been found in enigmaX up to 2.2. This issue affects the function getSeed of the file main.c of the component Scrambling Table Handler. The manipulation leads to predictable seed in pseudo-random number generator (prng). The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 2.3 is able to address this issue. The identifier of the patch is 922bf90ca14a681629ba0b807a997a81d70225b5. It is recommended to upgrade the affected component. The identifier VDB-217181 was assigned to this vulnerability.
- Product
- Enigmax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2023A vulnerability has been found in trampgeek jobe up to 1.6.4 and classified as problematic.CVE-2021-4297 · Other software · trampgeek · reported by VulDBMedium 5.5
A vulnerability has been found in trampgeek jobe up to 1.6.4 and classified as problematic. This vulnerability affects the function runs_post of the file application/controllers/Restapi.php. The manipulation of the argument sourcefilename leads to an unknown weakness. Upgrading to version 1.6.5 is able to address this issue. The patch is identified as 694da5013dbecc8d30dd83e2a83e78faadf93771. It is recommended to upgrade the affected component. VDB-217174 is the identifier assigned to this vulnerability.
- Product
- jobe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2023A vulnerability, which was classified as problematic, has been found in admont28 Ingnovarq.CVE-2015-10006 · Other software · admont28 · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in admont28 Ingnovarq. Affected by this issue is some unknown functionality of the file app/controller/insertarSliderAjax.php. The manipulation of the argument imagetitle leads to cross site scripting. The attack may be launched remotely. The name of the patch is 9d18a39944d79dfedacd754a742df38f99d3c0e2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217172.
- Product
- Ingnovarq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2023A vulnerability classified as problematic was found in Ziftr primecoin up to 0.8.4rc1.CVE-2013-10006 · Other software · Ziftr · reported by VulDBLow 2.6
A vulnerability classified as problematic was found in Ziftr primecoin up to 0.8.4rc1. Affected by this vulnerability is the function HTTPAuthorized of the file src/bitcoinrpc.cpp. The manipulation of the argument strUserPass/strRPCUserColonPass leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.8.4rc2 is able to address this issue. The patch is named cdb3441b5cd2c1bae49fae671dc4a496f7c96322. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217171.
- Product
- primecoin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in SimpleSAMLphp simplesamlphp-module-openid.CVE-2010-10002 · Other software · SimpleSAMLphp · reported by VulDBLow 3.1
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in SimpleSAMLphp simplesamlphp-module-openid. Affected is an unknown function of the file templates/consumer.php of the component OpenID Handler. The manipulation of the argument AuthState leads to cross site scripting. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.0 is able to address this issue. The patch is identified as d652d41ccaf8c45d5707e741c0c5d82a2365a9a3. It is recommended to upgrade the affected component. VDB-217170 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- simplesamlphp-module-openid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2023A vulnerability classified as problematic was found in Zenoss Dashboard up to 1.3.4.CVE-2018-25063 · Other software · Zenoss · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Zenoss Dashboard up to 1.3.4. Affected by this vulnerability is an unknown functionality of the file ZenPacks/zenoss/Dashboard/browser/resources/js/defaultportlets.js. The manipulation of the argument HTMLString leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.3.5 is able to address this issue. The identifier of the patch is f462285a0a2d7e1a9255b0820240b94a43b00a44. It is recommended to upgrade the affected component. The identifier VDB-217153 was assigned to this vulnerability.
- Product
- Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2023A vulnerability classified as problematic has been found in flar2 ElementalX up to 6.x on Nexus 9.CVE-2018-25062 · Other software · flar2 · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in flar2 ElementalX up to 6.x on Nexus 9. Affected is the function xfrm_dump_policy_done of the file net/xfrm/xfrm_user.c of the component ipsec. The manipulation leads to denial of service. Upgrading to version 7.00 is able to address this issue. The name of the patch is 1df72c9f0f61304437f4f1037df03b5fb36d5a79. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217152.
- Product
- ElementalX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2023A vulnerability, which was classified as critical, has been found in taoeffect Empress.CVE-2014-125030 · Other software · taoeffect · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in taoeffect Empress. Affected by this issue is some unknown functionality. The manipulation leads to use of hard-coded password. The patch is identified as 557e177d8a309d6f0f26de46efb38d43e000852d. It is recommended to apply a patch to fix this issue. VDB-217154 is the identifier assigned to this vulnerability.
- Product
- Empress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2022A vulnerability was found in valtech IDP Test Client and classified as problematic.CVE-2014-125028 · Other software · valtech · reported by VulDBMedium 4.3
A vulnerability was found in valtech IDP Test Client and classified as problematic. Affected by this issue is some unknown functionality of the file python-flask/main.py. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The name of the patch is f1e7b3d431c8681ec46445557125890c14fa295f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217148.
- Product
- IDP Test Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2022A vulnerability has been found in Yuna Scatari TBDev up to 2.1.17 and classified as problematic.CVE-2014-125027 · Other software · Yuna Scatari · reported by VulDBLow 3.5
A vulnerability has been found in Yuna Scatari TBDev up to 2.1.17 and classified as problematic. Affected by this vulnerability is the function get_user_icons of the file usersearch.php. The manipulation of the argument n/r/r2/em/ip/co/ma/d/d2/ul/ul2/ls/ls2/dl/dl2 leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.1.18 is able to address this issue. The patch is named 0ba3fd4be29dd48fa4455c236a9403b3149a4fd4. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217147.
- Product
- TBDev
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2022A vulnerability was found in Exciting Printer and classified as critical.CVE-2017-20156 · Other software · Exciting · reported by VulDBMedium 5.5
A vulnerability was found in Exciting Printer and classified as critical. This issue affects some unknown processing of the file lib/printer/jobs/prepare_page.rb of the component Argument Handler. The manipulation of the argument URL leads to command injection. The patch is named 5f8c715d6e2cc000f621a6833f0a86a673462136. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217139.
- Product
- Printer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022A vulnerability, which was classified as problematic, has been found in Joget up to 7.0.33.CVE-2022-4859 · Other software · Joget · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Joget up to 7.0.33. This issue affects the function submitForm of the file wflow-core/src/main/java/org/joget/plugin/enterprise/UserProfileMenu.java of the component User Profile Menu. The manipulation of the argument firstName/lastName leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 7.0.34 is able to address this issue. The patch is named 9a77f508a2bf8cf661d588f37a4cc29ecaea4fc8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217055.
- Product
- Joget DX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022A vulnerability was found in Macaron csrf and classified as problematic.CVE-2018-25060 · Other software · Macaron · reported by VulDBLow 3.7
A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file csrf.go. The manipulation of the argument Generate leads to sensitive cookie without secure attribute. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as dadd1711a617000b70e5e408a76531b73187031c. It is recommended to apply a patch to fix this issue. VDB-217058 is the identifier assigned to this vulnerability.
- Product
- csrf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022A vulnerability has been found in aerouk imageserve and classified as problematic.CVE-2017-20153 · Other software · aerouk · reported by VulDBLow 2.6
A vulnerability has been found in aerouk imageserve and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument REQUEST_URI leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2ac3cd4f90b4df66874fab171376ca26868604c4. It is recommended to apply a patch to fix this issue. The identifier VDB-217057 was assigned to this vulnerability.
- Product
- imageserve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022A vulnerability, which was classified as problematic, was found in aerouk imageserve.CVE-2017-20152 · Other software · aerouk · reported by VulDBLow 3.1
A vulnerability, which was classified as problematic, was found in aerouk imageserve. Affected is an unknown function of the file public/viewer.php of the component File Handler. The manipulation of the argument filelocation leads to path traversal. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is bd23c784f0e5cb12f66d15c100248449f87d72e2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217056.
- Product
- imageserve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022A vulnerability classified as problematic was found in iText RUPS.CVE-2017-20151 · Other software · iText · reported by VulDBMedium 5.5
A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The patch is identified as ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.
- Product
- RUPS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022A vulnerability was found in pastebinit up to 0.2.2 and classified as problematic.CVE-2018-25059 · Other software · Pastebinit Project · reported by VulDBLow 3.5
A vulnerability was found in pastebinit up to 0.2.2 and classified as problematic. Affected by this issue is the function pasteHandler of the file server.go. The manipulation of the argument r.URL.Path leads to path traversal. Upgrading to version 0.2.3 is able to address this issue. The name of the patch is 1af2facb6d95976c532b7f8f82747d454a092272. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217040.
- Product
- Pastebinit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022A vulnerability was found in Modbus Tools Modbus Poll up to 9.10.0 and classified as critical.CVE-2022-4857 · Other software · Modbus Tools · reported by VulDBMedium 6.3
A vulnerability was found in Modbus Tools Modbus Poll up to 9.10.0 and classified as critical. Affected by this issue is some unknown functionality of the file mbpoll.exe of the component mbp File Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-217022 is the identifier assigned to this vulnerability.
- Product
- Modbus Poll
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022A vulnerability has been found in Modbus Tools Modbus Slave up to 7.5.1 and classified as critical.CVE-2022-4856 · Other software · Modbus Tools · reported by VulDBMedium 6.3
A vulnerability has been found in Modbus Tools Modbus Slave up to 7.5.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file mbslave.exe of the component mbs File Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-217021 was assigned to this vulnerability.
- Product
- Modbus Slave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022A vulnerability, which was classified as problematic, has been found in w3c Unicorn.CVE-2021-4296 · Other software · w3c · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in w3c Unicorn. This issue affects the function ValidatorNuMessage of the file src/org/w3c/unicorn/response/impl/ValidatorNuMessage.java. The manipulation of the argument message leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 51f75c31f7fc33859a9a571311c67ae4e95d9c68. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217019.
- Product
- Unicorn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30.CVE-2021-4295 · Other software · ONC · reported by VulDBMedium 5.5
A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigurations of the file src/main/java/org/sitenv/vocabularies/configuration/CodeValidatorApiConfiguration.java of the component XML Handler. The manipulation leads to xml external entity reference. Upgrading to version 1.0.31 is able to address this issue. The name of the patch is fbd8ea121755a2d3d116b13f235bc8b61d8449af. It is recommended to upgrade the affected component. VDB-217018 is the identifier assigned to this vulnerability.
- Product
- code-validator-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x.CVE-2018-25058 · Other software · Twitter-post-fetcher Project · reported by VulDBMedium 4.2
A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with window.opener access. It is possible to initiate the attack remotely. Upgrading to version 18.0.0 is able to address this issue. The name of the patch is 7d281c6fb5acbc29a2cad295262c1f0c19ca56f3. It is recommended to upgrade the affected component. The identifier VDB-217017 was assigned to this vulnerability.
- Product
- Twitter-post-fetcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022A vulnerability, which was classified as problematic, was found in InSTEDD Nuntium.CVE-2022-4823 · Other software · InSTEDD · reported by VulDBLow 3.1
A vulnerability, which was classified as problematic, was found in InSTEDD Nuntium. Affected is an unknown function of the file app/controllers/geopoll_controller.rb. The manipulation of the argument signature leads to observable timing discrepancy. It is possible to launch the attack remotely. The name of the patch is 77236f7fd71a0e2eefeea07f9866b069d612cf0d. It is recommended to apply a patch to fix this issue. VDB-217002 is the identifier assigned to this vulnerability.
- Product
- Nuntium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022A vulnerability, which was classified as problematic, has been found in FlatPress.CVE-2022-4822 · Other software · Flatpress · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, has been found in FlatPress. This issue affects some unknown processing of the file setup/lib/main.lib.php of the component Setup. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 5f23b4c2eac294cc0ba5e541f83a6f8a26f9fed1. It is recommended to apply a patch to fix this issue. The identifier VDB-217001 was assigned to this vulnerability.
- Product
- Flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022A vulnerability classified as problematic was found in FlatPress.CVE-2022-4821 · Other software · Flatpress · reported by VulDBLow 2.4
A vulnerability classified as problematic was found in FlatPress. This vulnerability affects the function onupload of the file admin/panels/uploader/admin.uploader.php of the component XML File Handler/MD File Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 3cc223dec5260e533a84b5cf5780d3a4fbf21241. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217000.
- Product
- Flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022A vulnerability classified as problematic has been found in FlatPress.CVE-2022-4820 · Other software · Flatpress · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in FlatPress. This affects an unknown part of the file admin/panels/entry/admin.entry.list.php of the component Admin Area. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is 229752b51025e678370298284d42f8ebb231f67f. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216999.
- Product
- Flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022A vulnerability, which was classified as problematic, was found in yolapi.CVE-2018-25056 · Other software · Yola · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in yolapi. Affected is the function render_description of the file yolapi/pypi/metadata.py. The manipulation of the argument text leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is a0fe129055a99f429133a5c40cb13b44611ff796. It is recommended to apply a patch to fix this issue. VDB-216966 is the identifier assigned to this vulnerability.
- Product
- Yolapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022A vulnerability was found in moappi Json2html up to 1.1.x and classified as problematic.CVE-2018-25053 · Other software · moappi · reported by VulDBMedium 4.3
A vulnerability was found in moappi Json2html up to 1.1.x and classified as problematic. This issue affects some unknown processing of the file json2html.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.2.0 is able to address this issue. The name of the patch is 2d3d24d971b19a8ed1fb823596300b9835d55801. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216959.
- Product
- Json2html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022A vulnerability has been found in Catalyst-Plugin-Session up to 0.40 and classified as problematic.CVE-2018-25052 · Other software · Catalyst-plugin-session Project · reported by VulDBLow 3.5
A vulnerability has been found in Catalyst-Plugin-Session up to 0.40 and classified as problematic. This vulnerability affects the function _load_sessionid of the file lib/Catalyst/Plugin/Session.pm of the component Session ID Handler. The manipulation of the argument sid leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.41 is able to address this issue. The name of the patch is 88d1b599e1163761c9bd53bec53ba078f13e09d4. It is recommended to upgrade the affected component. VDB-216958 is the identifier assigned to this vulnerability.
- Product
- Catalyst-plugin-session
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022A vulnerability, which was classified as problematic, was found in JmPotato Pomash.CVE-2018-25051 · Other software · JmPotato · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, was found in JmPotato Pomash. This affects an unknown part of the file Pomash/theme/clean/templates/editor.html. The manipulation of the argument article.title/content.title/article.tag leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is be1914ef0a6808e00f51618b2de92496a3604415. It is recommended to apply a patch to fix this issue. The identifier VDB-216957 was assigned to this vulnerability.
- Product
- Pomash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6.CVE-2018-25050 · Other software · Harvest · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6. Affected by this issue is the function AbstractChosen of the file coffee/lib/abstract-chosen.coffee. The manipulation of the argument group_label leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.8.7 is able to address this issue. The name of the patch is 77fd031d541e77510268d1041ed37798fdd1017e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216956.
- Product
- Chosen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in gnuboard youngcart5 up to 5.4.5.1.CVE-2021-4293 · Other software · gnuboard · reported by VulDBLow 3.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in gnuboard youngcart5 up to 5.4.5.1. Affected is an unknown function of the file adm/menu_list_update.php. The manipulation of the argument me_link leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 5.4.5.2 is able to address this issue. The name of the patch is 70daa537adfa47b87af12d85f1e698fff01785ff. It is recommended to upgrade the affected component. VDB-216954 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- youngcart5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022A vulnerability classified as problematic was found in Nakiami Mellivora up to 2.1.x.CVE-2019-25092 · Other software · Nakiami · reported by VulDBLow 2.4
A vulnerability classified as problematic was found in Nakiami Mellivora up to 2.1.x. Affected by this vulnerability is the function print_user_ip_log of the file include/layout/user.inc.php of the component Admin Panel. The manipulation of the argument $entry['ip'] leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.2.0 is able to address this issue. The name of the patch is e0b6965f8dde608a3d2621617c05695eb406cbb9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216955.
- Product
- Mellivora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in cloudsync.CVE-2022-4773 · Other software · Cloudsync Project · reported by VulDBLow 2.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in cloudsync. Affected by this vulnerability is the function getItem of the file src/main/java/cloudsync/connector/LocalFilesystemConnector.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is 3ad796833398af257c28e0ebeade68518e0e612a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216919. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Cloudsync
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability was found in Widoco and classified as critical.CVE-2022-4772 · Other software · Widoco Project · reported by VulDBMedium 4.5
A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is f2279b76827f32190adfa9bd5229b7d5a147fa92. It is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability.
- Product
- Widoco
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability classified as problematic has been found in OpenMRS Admin UI Module up to 1.4.x.CVE-2020-36636 · Other software · OpenMRS · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in OpenMRS Admin UI Module up to 1.4.x. Affected is the function sendErrorMessage of the file omod/src/main/java/org/openmrs/module/adminui/page/controller/systemadmin/accounts/AccountPageController.java of the component Account Setup Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 702fbfdac7c4418f23bb5f6452482b4a88020061. It is recommended to upgrade the affected component. VDB-216918 is the identifier assigned to this vulnerability.
- Product
- Admin UI Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability classified as problematic has been found in nsupdate.info.CVE-2019-25091 · Other software · Nsupdate · reported by VulDBLow 3.7
A vulnerability classified as problematic has been found in nsupdate.info. This affects an unknown part of the file src/nsupdate/settings/base.py of the component CSRF Cookie Handler. The manipulation of the argument CSRF_COOKIE_HTTPONLY leads to cookie without 'httponly' flag. It is possible to initiate the attack remotely. The name of the patch is 60a3fe559c453bc36b0ec3e5dd39c1303640a59a. It is recommended to apply a patch to fix this issue. The identifier VDB-216909 was assigned to this vulnerability.
- Product
- Nsupdate.info
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability was found in Graphite Web and classified as problematic.CVE-2022-4729 · Other software · Graphite · reported by VulDBLow 3.5
A vulnerability was found in Graphite Web and classified as problematic. This issue affects some unknown processing of the component Template Name Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216743.
- Product
- Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability has been found in Graphite Web and classified as problematic.CVE-2022-4728 · Other software · Graphite · reported by VulDBLow 3.5
A vulnerability has been found in Graphite Web and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. VDB-216742 is the identifier assigned to this vulnerability.
- Product
- Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x.CVE-2022-4727 · Other software · OpenMRS · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x. This affects the function getNotes of the file api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java of the component Notes Handler. The manipulation of the argument notes leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.17.0 is able to address this issue. The name of the patch is 2ccbe39c020809765de41eeb8ee4c70b5ec49cc8. It is recommended to upgrade the affected component. The identifier VDB-216741 was assigned to this vulnerability.
- Product
- Appointment Scheduling Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability classified as critical has been found in Modern Tribe Panel Builder Plugin.CVE-2020-36626 · Other software · Modern Tribe · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in Modern Tribe Panel Builder Plugin. Affected is the function add_post_content_filtered_to_search_sql of the file ModularContent/SearchFilter.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 4528d4f855dbbf24e9fc12a162fda84ce3bedc2f. It is recommended to apply a patch to fix this issue. VDB-216738 is the identifier assigned to this vulnerability.
- Product
- Panel Builder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability classified as problematic was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x.CVE-2021-4289 · Other software · OpenMRS · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. Affected by this vulnerability is the function post of the file omod/src/main/java/org/openmrs/module/referenceapplication/page/controller/UserAppPageController.java of the component User App Page. The manipulation of the argument AppId leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.12.0 is able to address this issue. The name of the patch is 0410c091d46eed3c132fe0fcafe5964182659f74. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216883.
- Product
- openmrs-module-referenceapplication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability classified as problematic has been found in Indeed Engineering util up to 1.0.33.CVE-2020-36634 · Other software · Indeed Engineering · reported by VulDBLow 2.6
A vulnerability classified as problematic has been found in Indeed Engineering util up to 1.0.33. Affected is the function visit/appendTo of the file varexport/src/main/java/com/indeed/util/varexport/servlet/ViewExportedVariablesServlet.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.34 is able to address this issue. The name of the patch is c0952a9db51a880e9544d9fac2a2218a6bfc9c63. It is recommended to upgrade the affected component. VDB-216882 is the identifier assigned to this vulnerability.
- Product
- util
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic.CVE-2019-25090 · Other software · FreePBX · reported by VulDBLow 3.5
A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic. Affected by this issue is some unknown functionality of the component Views Handler. The manipulation of the argument dataurl leads to cross site scripting. The attack may be launched remotely. Upgrading to version 13.0.5.4 is able to address this issue. The name of the patch is 199dea7cc7020d3c469a86a39fbd80f5edd3c5ab. It is recommended to upgrade the affected component. VDB-216878 is the identifier assigned to this vulnerability.
- Product
- arimanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability has been found in Morgawr Muon 0.1.1 and classified as problematic.CVE-2019-25089 · Other software · Morgawr · reported by VulDBLow 3.1
A vulnerability has been found in Morgawr Muon 0.1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file src/muon/handler.clj. The manipulation leads to insufficiently random values. The attack can be launched remotely. Upgrading to version 0.2.0-indev is able to address this issue. The name of the patch is c09ed972c020f759110c707b06ca2644f0bacd7f. It is recommended to upgrade the affected component. The identifier VDB-216877 was assigned to this vulnerability.
- Product
- Muon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2.CVE-2021-4287 · Other software · ReFirm Labs · reported by VulDBMedium 5
A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/modules/extractor.py of the component Archive Extraction Handler. The manipulation leads to symlink following. It is possible to launch the attack remotely. Upgrading to version 2.3.3 is able to address this issue. The name of the patch is fa0c0bd59b8588814756942fe4cb5452e76c1dcd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216876.
- Product
- binwalk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16.CVE-2021-4286 · Other software · cocagne · reported by VulDBLow 2.6
A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculate_x of the file srp/_ctsrp.py. The manipulation leads to information exposure through discrepancy. Upgrading to version 1.0.17 is able to address this issue. The name of the patch is dba52642f5e95d3da7af1780561213ee6053195f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216875.
- Product
- pysrp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability classified as problematic was found in Nagios NCPA.CVE-2021-4285 · Other software · Nagios · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Nagios NCPA. This vulnerability affects unknown code of the file agent/listener/templates/tail.html. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 2.4.0 is able to address this issue. The name of the patch is 5abbcd7aa26e0fc815e6b2b0ffe1c15ef3e8fab5. It is recommended to upgrade the affected component. VDB-216874 is the identifier assigned to this vulnerability.
- Product
- NCPA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability was found in FlatPress and classified as problematic.CVE-2022-4755 · Other software · Flatpress · reported by VulDBLow 3.5
A vulnerability was found in FlatPress and classified as problematic. This issue affects the function main of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component Media Manager Plugin. The manipulation of the argument mm-newgallery-name leads to cross site scripting. The attack may be initiated remotely. The name of the patch is d3f329496536dc99f9707f2f295d571d65a496f5. It is recommended to apply a patch to fix this issue. The identifier VDB-216869 was assigned to this vulnerability.
- Product
- Flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability classified as problematic has been found in OpenMRS HTML Form Entry UI Framework Integration Module up to 1.x.CVE-2021-4284 · Other software · OpenMRS · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in OpenMRS HTML Form Entry UI Framework Integration Module up to 1.x. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is 811990972ea07649ae33c4b56c61c3b520895f07. It is recommended to upgrade the affected component. The identifier VDB-216873 was assigned to this vulnerability.
- Product
- HTML Form Entry UI Framework Integration Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.