Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 74 of 87
Dec 26, 2022A vulnerability was found in Brave UX for-the-badge and classified as critical.CVE-2021-4281 · Other software · Brave UX · reported by VulDBMedium 4.6
A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the file .github/workflows/combine-prs.yml. The manipulation leads to os command injection. The name of the patch is 55b5a234c0fab935df5fb08365bc8fe9c37cf46b. It is recommended to apply a patch to fix this issue. VDB-216842 is the identifier assigned to this vulnerability.
- Product
- for-the-badge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2022A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1.CVE-2022-4742 · Other software · Json-pointer Project · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. Upgrading to version 0.6.2 is able to address this issue. The patch is identified as 859c9984b6c407fc2d5a0a7e47c7274daa681941. It is recommended to upgrade the affected component. VDB-216794 is the identifier assigned to this vulnerability.
- Product
- Json-pointer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022A vulnerability was found in docconv up to 1.2.0 and classified as problematic.CVE-2022-4741 · Other software · Search · reported by VulDBMedium 4.3
A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText. The manipulation leads to uncontrolled memory allocation. The attack may be initiated remotely. Upgrading to version 1.2.1 is able to address this issue. The name of the patch is 42bcff666855ab978e67a9041d0cdea552f20301. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216779.
- Product
- Docconv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022A vulnerability, which was classified as problematic, has been found in kkFileView.CVE-2022-4740 · Other software · Keking · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in kkFileView. Affected by this issue is the function setWatermarkAttribute of the file /picturesPreview. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216776.
- Product
- Kkfileview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022A vulnerability was found in Venganzas del Pasado and classified as problematic.CVE-2022-4736 · Other software · Venganzasdelpasado · reported by VulDBLow 3.5
A vulnerability was found in Venganzas del Pasado and classified as problematic. Affected by this issue is some unknown functionality. The manipulation of the argument the_title leads to cross site scripting. The attack may be launched remotely. The name of the patch is 62339b2ec445692c710b804bdf07aef4bd247ff7. It is recommended to apply a patch to fix this issue. VDB-216770 is the identifier assigned to this vulnerability.
- Product
- Venganzas DEL Pasado
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic.CVE-2021-4279 · Other software · Starcounter-Jack · reported by VulDBMedium 6.3
A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.
- Product
- JSON-Patch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0.CVE-2020-36632 · Other software · hughsk · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to initiate the attack remotely. Upgrading to version 5.0.1 is able to address this issue. The name of the patch is 20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is recommended to upgrade the affected component. The identifier VDB-216777 was assigned to this vulnerability.
- Product
- flat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022A vulnerability, which was classified as problematic, has been found in Hide Files on GitHub up to 2.x.CVE-2019-25084 · Other software · Hide Files ON Github Project · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Hide Files on GitHub up to 2.x. This issue affects the function addEventListener of the file extension/options.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 9de0c57df81db1178e0e79431d462f6d9842742e. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216767.
- Product
- Hide Files ON Github
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022A vulnerability classified as problematic was found in asrashley dash-live.CVE-2022-4735 · Other software · asrashley · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in asrashley dash-live. This vulnerability affects the function ready of the file static/js/media.js of the component DOM Node Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 24d01757a5319cc14c4aa1d8b53d1ab24d48e451. It is recommended to apply a patch to fix this issue. VDB-216766 is the identifier assigned to this vulnerability.
- Product
- dash-live
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x.CVE-2021-4278 · Other software · cronvel · reported by VulDBMedium 5.5
A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). Upgrading to version 0.7.0 is able to address this issue. The name of the patch is a63f559c50d70e8cb2eaae670dec25d1dbc4afcd. It is recommended to upgrade the affected component. The identifier VDB-216765 was assigned to this vulnerability.
- Product
- tree-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022A vulnerability, which was classified as problematic, was found in myapnea up to 29.0.x.CVE-2022-4731 · Other software · Myapnea · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, was found in myapnea up to 29.0.x. Affected is an unknown function of the component Title Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 29.1.0 is able to address this issue. The name of the patch is 99934258530d761bd5d09809bfa6c14b598f8d18. It is recommended to upgrade the affected component. VDB-216750 is the identifier assigned to this vulnerability.
- Product
- Myapnea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022A vulnerability, which was classified as problematic, has been found in fredsmith utils.CVE-2021-4277 · Other software · fredsmith · reported by VulDBLow 2.6
A vulnerability, which was classified as problematic, has been found in fredsmith utils. This issue affects some unknown processing of the file screenshot_sync of the component Filename Handler. The manipulation leads to predictable from observable state. The name of the patch is dbab1b66955eeb3d76b34612b358307f5c4e3944. It is recommended to apply a patch to fix this issue. The identifier VDB-216749 was assigned to this vulnerability.
- Product
- utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022A vulnerability classified as critical was found in SimbCo httpster.CVE-2020-36629 · Other software · SimbCo · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in SimbCo httpster. This vulnerability affects the function fs.realpathSync of the file src/server.coffee. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. The name of the patch is d3055b3e30b40b65d30c5a06d6e053dffa7f35d0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216748.
- Product
- httpster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022A vulnerability classified as critical has been found in Calsign APDE.CVE-2020-36628 · Other software · Calsign · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in Calsign APDE. This affects the function handleExtract of the file APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java of the component ZIP File Handler. The manipulation leads to path traversal. Upgrading to version 0.5.2-pre2-alpha is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216747.
- Product
- APDE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability was found in pig-vector and classified as problematic.CVE-2022-4641 · Other software · unspecified · reported by VulDBLow 2.5
A vulnerability was found in pig-vector and classified as problematic. Affected by this issue is the function LogisticRegression of the file src/main/java/org/apache/mahout/pig/LogisticRegression.java. The manipulation leads to insecure temporary file. The attack needs to be approached locally. The name of the patch is 1e7bd9fab5401a2df18d2eabd802adcf0dcf1f15. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216500.
- Product
- pig-vector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability has been found in Mingsoft MCMS 5.2.9 and classified as problematic.CVE-2022-4640 · Other software · Mingsoft · reported by VulDBLow 3.5
A vulnerability has been found in Mingsoft MCMS 5.2.9 and classified as problematic. Affected by this vulnerability is the function save of the component Article Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216499.
- Product
- MCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability, which was classified as critical, has been found in sslh.CVE-2022-4639 · Other software · unspecified · reported by VulDBMedium 5.6
A vulnerability, which was classified as critical, has been found in sslh. This issue affects the function hexdump of the file probe.c of the component Packet Dumping Handler. The manipulation of the argument msg_info leads to format string. The attack may be initiated remotely. The name of the patch is b19f8a6046b080e4c2e28354a58556bb26040c6f. It is recommended to apply a patch to fix this issue. The identifier VDB-216497 was assigned to this vulnerability.
- Product
- sslh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability classified as problematic was found in collective.contact.widget up to 1.12.CVE-2022-4638 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in collective.contact.widget up to 1.12. This vulnerability affects the function title of the file src/collective/contact/widget/widgets.py. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 5da36305ca7ed433782be8901c47387406fcda12. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216496.
- Product
- collective.contact.widget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability classified as problematic has been found in ep3-bs up to 1.7.x.CVE-2022-4637 · Other software · Ep-3bookingsystem · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in ep3-bs up to 1.7.x. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.8.0 is able to address this issue. The name of the patch is ef49e709c8adecc3a83cdc6164a67162991d2213. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216495.
- Product
- Ep-3 Bookingsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability, which was classified as problematic, was found in katlings pyambic-pentameter.CVE-2021-4275 · Other software · katlings · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in katlings pyambic-pentameter. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The name of the patch is 974f21aa1b2527ef39c8afe1a5060548217deca8. It is recommended to apply a patch to fix this issue. VDB-216498 is the identifier assigned to this vulnerability.
- Product
- pyambic-pentameter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability was found in Auto Upload Images up to 3.3.0 and classified as problematic.CVE-2022-4633 · Other software · Auto Upload Images Project · reported by VulDBMedium 4.3
A vulnerability was found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file src/setting-page.php of the component Settings Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 3.3.1 is able to address this issue. The name of the patch is 895770ee93887ec78429c78ffdfb865bee6f9436. It is recommended to upgrade the affected component. VDB-216482 is the identifier assigned to this vulnerability.
- Product
- Auto Upload Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability has been found in Auto Upload Images up to 3.3.0 and classified as problematic.CVE-2022-4632 · Other software · Auto Upload Images Project · reported by VulDBLow 3.5
A vulnerability has been found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.3.1 is able to address this issue. The name of the patch is 895770ee93887ec78429c78ffdfb865bee6f9436. It is recommended to upgrade the affected component. The identifier VDB-216481 was assigned to this vulnerability.
- Product
- Auto Upload Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability, which was classified as problematic, was found in WP-Ban.CVE-2022-4631 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in WP-Ban. Affected is an unknown function of the file ban-options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 22b925449c84faa9b7496abe4f8f5661cb5eb3bf. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216480.
- Product
- WP-Ban
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability, which was classified as problematic, has been found in sileht bird-lg.CVE-2021-4274 · Other software · sileht · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in sileht bird-lg. This issue affects some unknown processing of the file templates/layout.html. The manipulation of the argument request_args leads to cross site scripting. The attack may be initiated remotely. The name of the patch is ef6b32c527478fefe7a4436e10b96ee28ed5b308. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216479.
- Product
- bird-lg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability classified as problematic was found in studygolang.CVE-2021-4273 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in studygolang. This vulnerability affects the function Search of the file http/controller/search.go. The manipulation of the argument q leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 97ba556d42fa89dfaa7737e9cd3a8ddaf670bb23. It is recommended to apply a patch to fix this issue. VDB-216478 is the identifier assigned to this vulnerability.
- Product
- studygolang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability classified as problematic has been found in studygolang.CVE-2021-4272 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in studygolang. This affects an unknown part of the file static/js/topics.js. The manipulation of the argument contentHtml leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is 0fb30f9640bd5fa0cae58922eac6c00bb1a94391. It is recommended to apply a patch to fix this issue. The identifier VDB-216477 was assigned to this vulnerability.
- Product
- studygolang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability has been found in SimpleRisk and classified as problematic.CVE-2021-4269 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability has been found in SimpleRisk and classified as problematic. This vulnerability affects the function checkAndSetValidation of the file simplerisk/js/common.js. The manipulation of the argument title leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 20220306-001 is able to address this issue. The name of the patch is 591405b4ed160fbefc1dca1e55c5745079a7bb48. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216472.
- Product
- SimpleRisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability, which was classified as problematic, was found in phpRedisAdmin up to 1.17.3.CVE-2021-4268 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in phpRedisAdmin up to 1.17.3. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.18.0 is able to address this issue. The name of the patch is b9039adbb264c81333328faa9575ecf8e0d2be94. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216471.
- Product
- phpRedisAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability classified as problematic was found in tad_discuss.CVE-2021-4267 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in tad_discuss. Affected by this vulnerability is an unknown functionality. The manipulation of the argument DiscussTitle leads to cross site scripting. The attack can be launched remotely. The name of the patch is af94d034ff8db642d05fd8788179eab05f433958. It is recommended to apply a patch to fix this issue. The identifier VDB-216469 was assigned to this vulnerability.
- Product
- tad_discuss
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability classified as problematic has been found in Webdetails cpf up to 9.5.0.0-80.CVE-2021-4266 · Other software · Webdetails · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Webdetails cpf up to 9.5.0.0-80. Affected is an unknown function of the file core/src/main/java/pt/webdetails/cpf/packager/DependenciesPackage.java. The manipulation of the argument baseUrl leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 9.5.0.0-81 is able to address this issue. The name of the patch is 3bff900d228e8cae3af256b447c5d15bdb03c174. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216468.
- Product
- cpf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability was found in LinkedIn dustjs up to 2.x and classified as problematic.CVE-2021-4264 · Other software · LinkedIn · reported by VulDBMedium 6.3
A vulnerability was found in LinkedIn dustjs up to 2.x and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is ddb6523832465d38c9d80189e9de60519ac307c3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216464.
- Product
- dustjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability, which was classified as problematic, has been found in leanote 2.6.1.CVE-2021-4263 · Other software · Leanote · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in leanote 2.6.1. This issue affects the function define of the file public/js/plugins/history.js. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is 0f9733c890077942150696dcc6d2b1482b7a0a19. It is recommended to apply a patch to fix this issue. The identifier VDB-216461 was assigned to this vulnerability.
- Product
- Leanote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability was found in sah-comp bienlein and classified as problematic.CVE-2020-36622 · Other software · sah-comp · reported by VulDBMedium 4.3
A vulnerability was found in sah-comp bienlein and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is d7836a4f2b241e4745ede194f0f6fb47199cab6b. It is recommended to apply a patch to fix this issue. The identifier VDB-216473 was assigned to this vulnerability.
- Product
- bienlein
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability, which was classified as problematic, has been found in chedabob whatismyudid.CVE-2020-36621 · Other software · chedabob · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in chedabob whatismyudid. Affected by this issue is the function exports.enrollment of the file routes/mobileconfig.js. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is bb33d4325fba80e7ea68b79121dba025caf6f45f. It is recommended to apply a patch to fix this issue. VDB-216470 is the identifier assigned to this vulnerability.
- Product
- whatismyudid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical.CVE-2022-4613 · Other software · Click Studios · reported by VulDBMedium 5
A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical. This issue affects some unknown processing of the component Browser Extension Provisioning. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216275.
- Product
- Passwordstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as problematic.CVE-2022-4612 · Other software · Click Studios · reported by VulDBMedium 4.3
A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as problematic. This vulnerability affects unknown code. The manipulation leads to insufficiently protected credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. VDB-216274 is the identifier assigned to this vulnerability.
- Product
- Passwordstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome.CVE-2022-4611 · Other software · Click Studios · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-216273 was assigned to this vulnerability.
- Product
- Passwordstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome.CVE-2022-4610 · Other software · Click Studios · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptographic algorithm. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216272.
- Product
- Passwordstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability classified as critical was found in laravel-jqgrid.CVE-2021-4262 · Other software · unspecified · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in laravel-jqgrid. Affected by this vulnerability is the function getRows of the file src/Mgallegos/LaravelJqgrid/Repositories/EloquentRepositoryAbstract.php. The manipulation leads to sql injection. The name of the patch is fbc2d94f43d0dc772767a5bdb2681133036f935e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216271.
- Product
- laravel-jqgrid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability classified as critical has been found in pacman-canvas up to 1.0.5.CVE-2021-4261 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in pacman-canvas up to 1.0.5. Affected is the function addHighscore of the file data/db-handler.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 1.0.6 is able to address this issue. The name of the patch is 29522c90ca1cebfce6453a5af5a45281d99b0646. It is recommended to upgrade the affected component. VDB-216270 is the identifier assigned to this vulnerability.
- Product
- pacman-canvas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability classified as critical has been found in Furqan node-whois.CVE-2020-36618 · Other software · Furqan · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to launch the attack remotely. The name of the patch is 46ccc2aee8d063c7b6b4dee2c2834113b7286076. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216252.
- Product
- node-whois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome.CVE-2022-3877 · Other software · Click Studios · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected is an unknown function of the component URL Field Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. VDB-216246 is the identifier assigned to this vulnerability.
- Product
- Passwordstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome.CVE-2022-3876 · Other software · Click Studios · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This issue affects some unknown processing of the file /api/browserextension/UpdatePassword/ of the component API. The manipulation of the argument PasswordID leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-216245 was assigned to this vulnerability.
- Product
- Passwordstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome.CVE-2022-3875 · Other software · Click Studios · reported by VulDBHigh 7.3
A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown code of the component API. The manipulation leads to authentication bypass by assumed-immutable data. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216244.
- Product
- Passwordstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2022A vulnerability was found in ctrlo lenio and classified as problematic.CVE-2021-4255 · Other software · ctrlo · reported by VulDBLow 3.5
A vulnerability was found in ctrlo lenio and classified as problematic. Affected by this issue is some unknown functionality of the file views/contractor.tt. The manipulation of the argument contractor.name leads to cross site scripting. The attack may be launched remotely. The name of the patch is e1646d5cd0a2fbab9eb505196dd2ca1c9e4cdd97. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216212.
- Product
- lenio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2022A vulnerability has been found in ctrlo lenio and classified as problematic.CVE-2021-4254 · Other software · ctrlo · reported by VulDBLow 3.5
A vulnerability has been found in ctrlo lenio and classified as problematic. Affected by this vulnerability is an unknown functionality of the file views/layouts/main.tt of the component Notice Handler. The manipulation of the argument notice.notice.text leads to cross site scripting. The attack can be launched remotely. The name of the patch is aa300555343c1c081951fcb68bfb6852fbba7451. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216211.
- Product
- lenio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2022A vulnerability, which was classified as problematic, was found in ctrlo lenio.CVE-2021-4253 · Other software · ctrlo · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in ctrlo lenio. Affected is an unknown function in the library lib/Lenio.pm of the component Ticket Handler. The manipulation of the argument site_id leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 7a1f90bd2a0ce95b8338ec0926902da975ec64d9. It is recommended to apply a patch to fix this issue. VDB-216210 is the identifier assigned to this vulnerability.
- Product
- lenio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2022A vulnerability, which was classified as problematic, has been found in WP-Ban.CVE-2021-4252 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in WP-Ban. This issue affects the function toggle_checkbox of the file ban-options.php. The manipulation of the argument $_SERVER["HTTP_USER_AGENT"] leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 13e0b1e922f3aaa3f8fcb1dd6d50200dd693fd76. It is recommended to apply a patch to fix this issue. The identifier VDB-216209 was assigned to this vulnerability.
- Product
- WP-Ban
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2022A vulnerability classified as problematic was found in as.CVE-2021-4251 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in as. This vulnerability affects the function getFullURL of the file include.cdn.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 4acad1e3d2c34c017473ceea442fb3e3e078b2bd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216208.
- Product
- as
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2022A vulnerability classified as problematic has been found in cgriego active_attr up to 0.15.2.CVE-2021-4250 · Other software · cgriego · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in cgriego active_attr up to 0.15.2. This affects the function call of the file lib/active_attr/typecasting/boolean_typecaster.rb of the component Regex Handler. The manipulation of the argument value leads to denial of service. The exploit has been disclosed to the public and may be used. Upgrading to version 0.15.3 is able to address this issue. The name of the patch is dab95e5843b01525444b82bd7b336ef1d79377df. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216207.
- Product
- active_attr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.