Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 76 of 87
Dec 5, 2022A vulnerability has been found in Facepay 1.0 and classified as critical.CVE-2022-4281 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability has been found in Facepay 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /face-recognition-php/facepay-master/camera.php. The manipulation of the argument userId leads to authorization bypass. The attack can be launched remotely. The identifier VDB-214789 was assigned to this vulnerability.
- Product
- Facepay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2022A vulnerability, which was classified as problematic, has been found in Dot Tech Smart Campus System.CVE-2022-4280 · Other software · Dot Tech · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Dot Tech Smart Campus System. Affected by this issue is some unknown functionality of the file /services/Card/findUser. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-214778 is the identifier assigned to this vulnerability.
- Product
- Smart Campus System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2022A vulnerability was found in House Rental System and classified as critical.CVE-2022-4276 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability was found in House Rental System and classified as critical. Affected by this issue is some unknown functionality of the file tenant-engine.php of the component POST Request Handler. The manipulation of the argument id_photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214772.
- Product
- House Rental System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2022A vulnerability has been found in House Rental System and classified as critical.CVE-2022-4275 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability has been found in House Rental System and classified as critical. Affected by this vulnerability is an unknown functionality of the file search-property.php of the component POST Request Handler. The manipulation of the argument search_property leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214771.
- Product
- House Rental System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2022A vulnerability, which was classified as critical, was found in House Rental System.CVE-2022-4274 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in House Rental System. Affected is an unknown function of the file /view-property.php. The manipulation of the argument property_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-214770 is the identifier assigned to this vulnerability.
- Product
- House Rental System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2022A vulnerability, which was classified as critical, has been found in FeMiner wms.CVE-2022-4272 · Other software · FeMiner · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in FeMiner wms. Affected by this issue is some unknown functionality of the file /product/savenewproduct.php?flag=1. The manipulation of the argument upfile leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214760.
- Product
- wms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Dec 1, 2022A vulnerability was found in Movie Ticket Booking System and classified as problematic.CVE-2022-4251 · Other software · unspecified · reported by VulDBLow 2.4
A vulnerability was found in Movie Ticket Booking System and classified as problematic. Affected by this issue is some unknown functionality of the file editBooking.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214628.
- Product
- Movie Ticket Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2022A vulnerability has been found in Movie Ticket Booking System and classified as problematic.CVE-2022-4250 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability has been found in Movie Ticket Booking System and classified as problematic. Affected by this vulnerability is an unknown functionality of the file booking.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214627.
- Product
- Movie Ticket Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2022A vulnerability, which was classified as problematic, was found in Movie Ticket Booking System.CVE-2022-4249 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Movie Ticket Booking System. Affected is an unknown function of the component POST Request Handler. The manipulation of the argument ORDER_ID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-214626 is the identifier assigned to this vulnerability.
- Product
- Movie Ticket Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2022A vulnerability, which was classified as critical, has been found in Movie Ticket Booking System.CVE-2022-4248 · Other software · unspecified · reported by VulDBMedium 5
A vulnerability, which was classified as critical, has been found in Movie Ticket Booking System. This issue affects some unknown processing of the file editBooking.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214625 was assigned to this vulnerability.
- Product
- Movie Ticket Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2022A vulnerability classified as critical was found in Movie Ticket Booking System.CVE-2022-4247 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Movie Ticket Booking System. This vulnerability affects unknown code of the file booking.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214624.
- Product
- Movie Ticket Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2022A vulnerability classified as problematic has been found in Kakao PotPlayer.CVE-2022-4246 · Other software · Kakao · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in Kakao PotPlayer. This affects an unknown part of the component MID File Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214623.
- Product
- PotPlayer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Nov 30, 2022A vulnerability was found in Sapido BR270n, BRC76n, GR297 and RB1732 and classified as critical.CVE-2021-4242 · Network & remote access · Sapido · reported by VulDBMedium 6.3
A vulnerability was found in Sapido BR270n, BRC76n, GR297 and RB1732 and classified as critical. Affected by this issue is some unknown functionality of the file ip/syscmd.htm. The manipulation leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214592.
- Product
- BR270n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netgithub.com
Nov 30, 2022A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595.CVE-2022-4231 · Other software · Tribal Systems · reported by VulDBMedium 4.2
A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the component Remember Me Handler. The manipulation leads to session fixiation. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214589 was assigned to this vulnerability.
- Product
- Zenario CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2022A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master.CVE-2022-4202 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Affected is the function lsr_translate_coords of the file laser/lsr_dec.c. The manipulation leads to integer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is b3d821c4ae9ba62b3a194d9dcb5e99f17bd56908. It is recommended to apply a patch to fix this issue. VDB-214518 is the identifier assigned to this vulnerability.
- Product
- GPAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Nov 24, 2022A vulnerability was found in rickxy Stock Management System and classified as problematic.CVE-2022-4090 · Other software · rickxy · reported by VulDBMedium 4.3
A vulnerability was found in rickxy Stock Management System and classified as problematic. This issue affects some unknown processing of the file us_transac.php?action=add. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214331.
- Product
- Stock Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2022A vulnerability was found in rickxy Stock Management System and classified as critical.CVE-2022-4088 · Other software · rickxy · reported by VulDBHigh 7.3
A vulnerability was found in rickxy Stock Management System and classified as critical. Affected by this issue is some unknown functionality of the file /pages/processlogin.php. The manipulation of the argument user/password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-214322 is the identifier assigned to this vulnerability.
- Product
- Stock Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2022A vulnerability was found in Student Attendance Management System and classified as critical.CVE-2022-4052 · Other software · unspecified · reported by VulDBMedium 4.7
A vulnerability was found in Student Attendance Management System and classified as critical. This issue affects some unknown processing of the file /Admin/createClass.php. The manipulation of the argument Id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213845 was assigned to this vulnerability.
- Product
- Student Attendance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2022A vulnerability has been found in Hostel Searching Project and classified as critical.CVE-2022-4051 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability has been found in Hostel Searching Project and classified as critical. This vulnerability affects unknown code of the file view-property.php. The manipulation of the argument property_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213844.
- Product
- Hostel Searching Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022A vulnerability, which was classified as critical, was found in Sports Club Management System 119.CVE-2022-4015 · Other software · unspecified · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, was found in Sports Club Management System 119. This affects an unknown part of the file admin/make_payments.php. The manipulation of the argument m_id/plan leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213789 was assigned to this vulnerability.
- Product
- Sports Club Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022A vulnerability, which was classified as problematic, has been found in FeehiCMS.CVE-2022-4014 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in FeehiCMS. Affected by this issue is some unknown functionality of the component Post My Comment Tab. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The identifier of this vulnerability is VDB-213788.
- Product
- FeehiCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022A vulnerability classified as problematic was found in Hospital Management Center.CVE-2022-4013 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Hospital Management Center. Affected by this vulnerability is an unknown functionality of the file appointment.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-213787.
- Product
- Hospital Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022A vulnerability classified as critical has been found in Hospital Management Center.CVE-2022-4012 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Hospital Management Center. Affected is an unknown function of the file patient-info.php. The manipulation of the argument pt_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-213786 is the identifier assigned to this vulnerability.
- Product
- Hospital Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022A vulnerability, which was classified as problematic, was found in phpservermon.CVE-2021-4241 · Other software · unspecified · reported by VulDBLow 2.6
A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may be used. The name of the patch is bb10a5f3c68527c58073258cb12446782d223bc3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213744.
- Product
- phpservermon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022A vulnerability, which was classified as problematic, was found in phpservermon.CVE-2021-4240 · Other software · unspecified · reported by VulDBLow 2.6
A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function generatePasswordResetToken of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may be used. The name of the patch is 3daa804d5f56c55b3ae13bfac368bb84ec632193. It is recommended to apply a patch to fix this issue. The identifier VDB-213717 was assigned to this vulnerability.
- Product
- phpservermon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022A vulnerability, which was classified as problematic, has been found in WBCE CMS.CVE-2022-4006 · Other software · WBCE · reported by VulDBLow 3.7
A vulnerability, which was classified as problematic, has been found in WBCE CMS. Affected by this issue is the function increase_attempts of the file wbce/framework/class.login.php of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to improper restriction of excessive authentication attempts. The attack may be launched remotely. The name of the patch is d394ba39a7bfeb31eda797b6195fd90ef74b2e75. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213716.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022A vulnerability, which was classified as critical, was found in MonikaBrzica scm.CVE-2022-3998 · Other software · MonikaBrzica · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in MonikaBrzica scm. This affects an unknown part of the file uredi_korisnika.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-213699.
- Product
- scm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022A vulnerability, which was classified as critical, has been found in MonikaBrzica scm.CVE-2022-3997 · Other software · MonikaBrzica · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in MonikaBrzica scm. Affected by this issue is some unknown functionality of the file upis_u_bazu.php. The manipulation of the argument email/lozinka/ime/id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-213698 is the identifier assigned to this vulnerability.
- Product
- scm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability was found in NagVis up to 1.9.33 and classified as problematic.CVE-2022-3979 · Other software · Nagvis · reported by VulDBMedium 5.6
A vulnerability was found in NagVis up to 1.9.33 and classified as problematic. This issue affects the function checkAuthCookie of the file share/server/core/classes/CoreLogonMultisite.php. The manipulation of the argument hash leads to incorrect type conversion. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 1.9.34 is able to address this issue. The identifier of the patch is 7574fd8a2903282c2e0d1feef5c4876763db21d5. It is recommended to upgrade the affected component. The identifier VDB-213557 was assigned to this vulnerability.
- Product
- Nagvis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7.CVE-2022-3978 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 2.5.8 is able to address this issue. The name of the patch is 2f9d8c350e54543f608d3d4c8e1a49bbb6cdea38. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-213555.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical.CVE-2022-3976 · Other software · MZ Automation · reported by VulDBMedium 5.5
A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. This vulnerability affects unknown code of the file src/mms/iso_mms/client/mms_client_files.c of the component MMS File Services. The manipulation of the argument filename leads to path traversal. Upgrading to version 1.5 is able to address this issue. The name of the patch is 10622ba36bb3910c151348f1569f039ecdd8786f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213556.
- Product
- libiec61850
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability, which was classified as problematic, has been found in NukeViet CMS.CVE-2022-3975 · Other software · NukeViet · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in NukeViet CMS. Affected by this issue is the function filterAttr of the file vendor/vinades/nukeviet/Core/Request.php of the component Data URL Handler. The manipulation of the argument attrSubSet leads to cross site scripting. The attack may be launched remotely. Upgrading to version 4.5 is able to address this issue. The name of the patch is 0b3197fad950bb3383e83039a8ee4c9509b3ce02. It is recommended to upgrade the affected component. VDB-213554 is the identifier assigned to this vulnerability.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability classified as critical was found in Axiomatic Bento4.CVE-2022-3974 · Other software · Axiomatic · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is the function AP4_StdcFileByteStream::ReadPartial of the file Ap4StdCFileByteStream.cpp of the component mp4info. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213553 was assigned to this vulnerability.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability classified as critical has been found in Pingkon HMS-PHP.CVE-2022-3973 · Other software · Pingkon · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Pingkon HMS-PHP. Affected is an unknown function of the file /admin/admin.php of the component Data Pump Metadata. The manipulation of the argument uname/pass leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213552.
- Product
- HMS-PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic.CVE-2022-3969 · Other software · unspecified · reported by VulDBLow 2.6
A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/java/com/openkm/util/FileUtils.java. The manipulation leads to insecure temporary file. Upgrading to version 6.3.12 is able to address this issue. The name of the patch is c069e4d73ab8864345c25119d8459495f45453e1. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213548.
- Product
- OpenKM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability has been found in emlog and classified as problematic.CVE-2022-3968 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability has been found in emlog and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/article_save.php. The manipulation of the argument tag leads to cross site scripting. The attack can be launched remotely. The name of the patch is 5bf7a79826e0ea09bcc8a21f69a0c74107761a02. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213547.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability, which was classified as critical, was found in Vesta Control Panel.CVE-2022-3967 · Other software · unspecified · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of the file func/main.sh of the component sed Handler. The manipulation leads to argument injection. An attack has to be approached locally. The name of the patch is 39561c32c12cabe563de48cc96eccb9e2c655e25. It is recommended to apply a patch to fix this issue. VDB-213546 is the identifier assigned to this vulnerability.
- Product
- Vesta Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0.CVE-2022-3966 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0. This issue affects the function load_template of the file includes/core/class-shortcodes.php of the component Template Handler. The manipulation of the argument tpl leads to pathname traversal. The attack may be initiated remotely. Upgrading to version 2.5.1 is able to address this issue. The name of the patch is e1bc94c1100f02a129721ba4be5fbc44c3d78ec4. It is recommended to upgrade the affected component. The identifier VDB-213545 was assigned to this vulnerability.
- Product
- Ultimate Member Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability classified as problematic was found in ffmpeg.CVE-2022-3965 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213544.
- Product
- ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.ffmpeg.orgsecurity.gentoo.org
Nov 13, 2022A vulnerability classified as problematic has been found in ffmpeg.CVE-2022-3964 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file libavcodec/rpzaenc.c of the component QuickTime RPZA Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. It is possible to initiate the attack remotely. The name of the patch is 92f9b28ed84a77138105475beba16c146bdaf984. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213543.
- Product
- ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.ffmpeg.orgsecurity.gentoo.org
Nov 11, 2022A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1.CVE-2022-3959 · Other software · unspecified · reported by VulDBLow 3.1
A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1. Affected by this issue is some unknown functionality of the component Session Hash Handler. The manipulation leads to small space of random values. The attack may be launched remotely. Upgrading to version 1.8.2 is able to address this issue. The name of the patch is c0d48da99f66aaada17bcd28b07741cac8697647. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213464.
- Product
- drogon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022A vulnerability classified as problematic was found in GPAC.CVE-2022-3957 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in GPAC. Affected by this vulnerability is the function svg_parse_preserveaspectratio of the file scenegraph/svg_attributes.c of the component SVG Parser. The manipulation leads to memory leak. The attack can be launched remotely. The name of the patch is 2191e66aa7df750e8ef01781b1930bea87b713bb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213463.
- Product
- GPAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022A vulnerability classified as critical has been found in tsruban HHIMS 2.1.CVE-2022-3956 · Other software · tsruban · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in tsruban HHIMS 2.1. Affected is an unknown function of the component Patient Portrait Handler. The manipulation of the argument PID leads to sql injection. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. VDB-213462 is the identifier assigned to this vulnerability.
- Product
- HHIMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022A vulnerability has been found in ManyDesigns Portofino 5.3.2 and classified as problematic.CVE-2022-3952 · Other software · ManyDesigns · reported by VulDBLow 2.6
A vulnerability has been found in ManyDesigns Portofino 5.3.2 and classified as problematic. Affected by this vulnerability is the function createTempDir of the file WarFileLauncher.java. The manipulation leads to creation of temporary file in directory with insecure permissions. Upgrading to version 5.3.3 is able to address this issue. The name of the patch is 94653cb357806c9cf24d8d294e6afea33f8f0775. It is recommended to upgrade the affected component. The identifier VDB-213457 was assigned to this vulnerability.
- Product
- Portofino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022A vulnerability, which was classified as problematic, was found in sanluan PublicCMS.CVE-2022-3950 · Other software · sanluan · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in sanluan PublicCMS. Affected is the function initLink of the file dwz.min.js of the component Tab Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is a972dc9b1c94aea2d84478bf26283904c21e4ca2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213456.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022A vulnerability classified as critical was found in eolinker goku_lite.CVE-2022-3948 · Other software · eolinker · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in eolinker goku_lite. This vulnerability affects unknown code of the file /plugin/getList. The manipulation of the argument route/keyword leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-213454 is the identifier assigned to this vulnerability.
- Product
- goku_lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordc2.im5i.comc2.im5i.com
Nov 11, 2022A vulnerability classified as critical has been found in eolinker goku_lite.CVE-2022-3947 · Other software · eolinker · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in eolinker goku_lite. This affects an unknown part of the file /balance/service/list. The manipulation of the argument route/keyword leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213453 was assigned to this vulnerability.
- Product
- goku_lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordc2.im5i.comc2.im5i.com
Nov 11, 2022A vulnerability has been found in Activity Log Plugin and classified as critical.CVE-2022-3941 · Other software · unspecified · reported by VulDBMedium 5.3
A vulnerability has been found in Activity Log Plugin and classified as critical. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutralization for logs. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213448.
- Product
- Activity Log Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Nov 11, 2022A vulnerability, which was classified as problematic, was found in lanyulei ferry.CVE-2022-3940 · Other software · lanyulei · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in lanyulei ferry. This affects an unknown part of the file apis/process/task.go. The manipulation of the argument file_name leads to path traversal. The associated identifier of this vulnerability is VDB-213447.
- Product
- ferry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022A vulnerability, which was classified as critical, has been found in lanyulei ferry.CVE-2022-3939 · Other software · lanyulei · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in lanyulei ferry. Affected by this issue is some unknown functionality of the file apis/public/file.go of the component API. The manipulation of the argument file leads to path traversal. The attack may be launched remotely. VDB-213446 is the identifier assigned to this vulnerability.
- Product
- ferry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.