Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
805 results · page 8 of 17
May 8, 2023In modem, there is a possible missing verification of NAS Security Mode Command Replay Attacks in LTE.CVE-2022-44419 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In modem, there is a possible missing verification of NAS Security Mode Command Replay Attacks in LTE. This could local denial of service with no additional execution privileges.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023YASM v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re.CVE-2023-30402 · Other software · Yasm Project · reported by MITREMedium 5.5
YASM v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.
- Product
- Yasm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Laminas Diactoros provides PSR HTTP Message implementations.CVE-2023-29530 · Other software · laminas · reported by GitHubHigh 7.5
Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value, can cause an invalid message. This can lead to denial of service vectors or application errors. The problem has been patched in following versions 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, and 2.25.1. As a workaround, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling `withHeader()`.
- Product
- laminas-diactoros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the function parse_expr5 at /nasm/nasm-parse.c.CVE-2023-29583 · Other software · yasm_project · reported by MITREMedium 5.5
yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the function parse_expr5 at /nasm/nasm-parse.c. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.
- Product
- yasm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the function parse_expr1 at /nasm/nasm-parse.c.CVE-2023-29582 · Other software · Yasm Project · reported by MITREMedium 5.5
yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the function parse_expr1 at /nasm/nasm-parse.c. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.
- Product
- Yasm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Apr 12, 2023yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token at modules/preprocs/nasm/nasm-pp.c.CVE-2023-29581 · Other software · yasm_project · reported by MITREMedium 5.5
yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token at modules/preprocs/nasm/nasm-pp.c. NOTE: although a libyasm application could become unavailable if this were exploited, the vendor's position is that there is no security relevance because there is either supposed to be input validation before data reaches libyasm, or a sandbox in which the application runs.
- Product
- yasm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Apr 10, 2023delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape.CVE-2023-26919 · Other software · Javadelight · reported by MITREHigh 7.2
delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions is set to false, the loadWithNewGlobal function can be used to invoke the exit and quit methods to exit the Java process.
- Product
- Nashorn Sandbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2023Panasonic AiSEG2 versions 2.00J through 2.93A allows adjacent attackers bypass authentication due to mishandling of X-Forwarded-For headers.CVE-2023-28727 · Other software · Panasonic · reported by product-security@gg.jp.panasonic.comCritical 9.6
Panasonic AiSEG2 versions 2.00J through 2.93A allows adjacent attackers bypass authentication due to mishandling of X-Forwarded-For headers.
- Product
- AiSEG2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww2.panasonic.bizwww2.panasonic.biz
Mar 31, 2023Panasonic AiSEG2 versions 2.80F through 2.93A allows remote attackers to execute arbitrary OS commands.CVE-2023-28726 · Other software · Panasonic · reported by product-security@gg.jp.panasonic.comHigh 7.5
Panasonic AiSEG2 versions 2.80F through 2.93A allows remote attackers to execute arbitrary OS commands.
- Product
- AiSEG2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww2.panasonic.bizwww2.panasonic.biz
Mar 29, 2023NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856CVE-2022-44370 · Other software · Nasm · reported by MITREHigh 7.8
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
- Product
- Netwide Assembler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.nasm.ussecurity.gentoo.org
Mar 29, 2023NASM 2.16 (development) is vulnerable to 476: Null Pointer Dereference via output/outaout.c.CVE-2022-44369 · Other software · Nasm · reported by MITREMedium 5.5
NASM 2.16 (development) is vulnerable to 476: Null Pointer Dereference via output/outaout.c.
- Product
- Netwide Assembler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.nasm.usbugzilla.nasm.us
Mar 29, 2023NASM v2.16 was discovered to contain a null pointer deference in the NASM componentCVE-2022-44368 · Other software · Nasm · reported by MITREMedium 5.5
NASM v2.16 was discovered to contain a null pointer deference in the NASM component
- Product
- Netwide Assembler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.nasm.usbugzilla.nasm.us
Mar 13, 2023github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow.CVE-2023-27581 · Other software · rlespinasse · reported by GitHubHigh 8.8
github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. This can be used to execute code on the GitHub runners and to exfiltrate any secrets one uses in the CI pipeline. A patched action is available in version 4.4.1. No workaround is available.
- Product
- github-slug-action
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2023A vulnerability classified as critical has been found in EasyNAS 1.1.0.CVE-2023-0830 · Other software · Easynas · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in EasyNAS 1.1.0. Affected is the function system of the file /backup.pl. The manipulation leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
- Product
- Easynas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023Panasonic Sanyo CCTV Network Cameras versions 1.02-05 and 2.03-0x are vulnerable to CSRFs that can be exploited to allow an attacker to perform changes with aCVE-2022-4621 · Other software · Panasonic · reported by ics-cert@hq.dhs.govHigh 7.5
Panasonic Sanyo CCTV Network Cameras versions 1.02-05 and 2.03-0x are vulnerable to CSRFs that can be exploited to allow an attacker to perform changes with administrator level privileges.
- Product
- Sanyo CCTV Network Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.connect.panasonic.comcisa.gov
Jan 9, 2023Memory corruption due to information exposure in Powerline Communication Firmware while sending different MMEs from a single, unassociated device.CVE-2022-33265 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.3
Memory corruption due to information exposure in Powerline Communication Firmware while sending different MMEs from a single, unassociated device.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jan 4, 2023NASM v2.16 was discovered to contain a segmentation violation in the component ieee_write_file at /output/outieee.c.CVE-2022-46457 · Other software · Nasm · reported by MITREMedium 5.5
NASM v2.16 was discovered to contain a segmentation violation in the component ieee_write_file at /output/outieee.c.
- Product
- Netwide Assembler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.nasm.usbugzilla.nasm.us
Jan 4, 2023NASM v2.16 was discovered to contain a global buffer overflow in the component dbgdbg_typevalue at /output/outdbg.c.CVE-2022-46456 · Other software · Nasm · reported by MITREMedium 6.1
NASM v2.16 was discovered to contain a global buffer overflow in the component dbgdbg_typevalue at /output/outdbg.c.
- Product
- Netwide Assembler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.nasm.usbugzilla.nasm.us
Dec 27, 2022Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be cCVE-2020-36564 · Other software · github.com/justinas/nosurf · reported by security@golang.orgHigh 7.5
Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.
- Product
- github.com/justinas/nosurf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2022The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirCVE-2020-6627 · Other software · Seagate · reported by MITRECritical 9.8
The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirrus/application/helpers/mv_backend_helper.php by leveraging the "start" state and sending a check_device_name request.
- Product
- Stcg2000300 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 1, 2022Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Asus NAS-M25 allows an unauthenticated attacker to iCVE-2022-4221 · Network & remote access · Asus · reported by research@onekey.comCritical 9.8
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Asus NAS-M25 allows an unauthenticated attacker to inject arbitrary OS commands via unsanitized cookie values.This issue affects NAS-M25: through 1.0.1.7.
- Product
- NAS-M25
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2022In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages.CVE-2022-38871 · Other software · Free5gc · reported by MITREHigh 7.5
In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionAssign function in expression.c when called from ExpressionParseFunctionCaCVE-2022-44315 · Other software · Picoc Project · reported by MITREMedium 5.5
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionAssign function in expression.c when called from ExpressionParseFunctionCall.
- Product
- Picoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2022This vulnerability occurs in user accounts creation and deleteion related pages of IPTIME NAS products.CVE-2022-23771 · Other software · EFM Networks Co., Ltd · reported by vuln@krcert.or.krHigh 8
This vulnerability occurs in user accounts creation and deleteion related pages of IPTIME NAS products. The vulnerability could be exploited by a lack of validation when a POST request is made to this page. An attacker can use this vulnerability to or delete user accounts, or to escalate arbitrary user privileges.
- Product
- NAS1dual, NAS2dual, NAS4dual
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Oct 3, 2022nasm v2.16 was discovered to contain a stack overflow in the Ndisasm componentCVE-2022-41420 · Other software · Nasm · reported by MITREMedium 5.5
nasm v2.16 was discovered to contain a stack overflow in the Ndisasm component
- Product
- Netwide Assembler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.nasm.usbugzilla.nasm.us
Sep 20, 2022McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads.CVE-2022-39221 · Other software · J-onasJones · reported by GitHubHigh 7.5
McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod for Fabric and Quilt up to and including 0.1.2.1 and McWebserver Minecraft Mod for Forge up to and including 0.1.1 allows all files, accessible by the program, to be read by anyone via HTTP request. Version 0.2.0 with patches are released to both platforms (Fabric and Quilt, Forge). As a workaround, the McWebserver mod can be disabled by removing the file from the `mods` directory.
- Product
- McWebserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2022A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized remote code execution CVE-2022-34747 · Network & remote access · Zyxel · reported by security@zyxel.com.twCritical 9.8
A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized remote code execution via a crafted UDP packet.
- Product
- Zyxel NAS326 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS.CVE-2022-23765 · Other software · EFM Networks Co.,Ltd · reported by vuln@krcert.or.krHigh 8
This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers can steal root privileges by changing the password of the root through a POST request.
- Product
- NAS1dual, NAS2dual, NAS4dual
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Aug 10, 2022WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 nas.cgi has no filtering on parameters: User1Passwd and User1, which leads to command injection in page /naCVE-2022-35518 · Other software · Wavlink · reported by MITRECritical 9.8
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 nas.cgi has no filtering on parameters: User1Passwd and User1, which leads to command injection in page /nas_disk.shtml.
- Product
- Wn572hp3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces.CVE-2022-31109 · Other software · laminas · reported by GitHubHigh 7.2
laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a `Laminas\Diactoros\Uri` instance associated with the incoming server request modified to reflect values from `X-Forwarded-*` headers. Such changes can potentially lead to XSS attacks (if a fully-qualified URL is used in links) and/or URL poisoning. Since the `X-Forwarded-*` headers do have valid use cases, particularly in clustered environments using a load balancer, the library offers mitigation measures only in the v2 releases, as doing otherwise would break these use cases immediately. Users of v2 releases from 2.11.1 can provide an additional argument to `Laminas\Diactoros\ServerRequestFactory::fromGlobals()` in the form of a `Laminas\Diactoros\RequestFilter\RequestFilterInterface` instance, including the shipped `Laminas\Diactoros\RequestFilter\NoOpRequestFilter` implementation which ignores the `X-Forwarded-*` headers. Starting in version 3.0, the library will reverse be
- Product
- laminas-diactoros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022An issue was discovered in NASM version 2.16rc0.CVE-2021-33452 · Other software · Nasm · reported by MITREMedium 5.5
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_malloc() in nasmlib/alloc.c.
- Product
- Netwide Assembler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.nasm.usgist.github.com
Jul 26, 2022An issue was discovered in NASM version 2.16rc0.CVE-2021-33450 · Other software · Nasm · reported by MITREMedium 5.5
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.
- Product
- Netwide Assembler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.nasm.usgist.github.com
Jul 10, 2022The olmax99/pyathenastack repository through 2019-11-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31550 · Other software · Python Athena Stack Project · reported by MITRECritical 9.3
The olmax99/pyathenastack repository through 2019-11-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Python Athena Stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022NestJS Proxy is a NestJS module to decorate and proxy calls.CVE-2022-31070 · Other software · Finastra · reported by GitHubMedium 5.8
NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to block sensitive cookies (e.g. session cookies) from being forwarded to backend services configured by the application developer. This could have led to sensitive cookies being inadvertently exposed to such services that should not see them. The patched version now blocks cookies from being forwarded by default. However developers can configure an allow-list of cookie names by using the `allowedCookies` config setting. This issue has been fixed in version 0.7.0 of `@finastra/nestjs-proxy`. Users of `@ffdc/nestjs-proxy` are advised that this package has been deprecated and is no longer being maintained or receiving updates. Such users should update their package.json file to use `@finastra/nestjs-proxy` instead.
- Product
- finastra-nodejs-libs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022NestJS Proxy is a NestJS module to decorate and proxy calls.CVE-2022-31069 · Other software · Finastra · reported by GitHubMedium 5.8
NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to control when Authorization headers should should be forwarded for specific backend services configured by the application developer. This could have resulted in sensitive information such as OAuth bearer access tokens being inadvertently exposed to such services that should not see them. A new feature has been introduced in the patched version of nestjs-proxy that allows application developers to opt out of forwarding the Authorization headers on a per service basis using the `forwardToken` config setting. Developers are advised to review the README for this library on Github or NPM for further details on how this configuration can be applied. This issue has been fixed in version 0.7.0 of `@finastra/nestjs-proxy`. Users of `@ffdc/nestjs-proxy` are advised that this package has been deprecated and is no longer being maintained or receiving updates. Such users should update their package.json file to use `@finastra/nestjs-proxy` instead.
- Product
- finastra-nodejs-libs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022The UE and the EMM communicate with each other using NAS messages.CVE-2022-20210 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
The UE and the EMM communicate with each other using NAS messages. When a new NAS message arrives from the EMM, the modem parses it and fills in internal objects based on the received data. A bug in the parsing code could be used by an attacker to remotely crash the modem, which could lead to DoS or RCE.Product: AndroidVersions: Android SoCAndroid ID: A-228868888
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 14, 2022An issue was discovered in Delight Nashorn Sandbox 0.2.0.CVE-2021-40660 · Other software · Javadelight · reported by MITREHigh 7.5
An issue was discovered in Delight Nashorn Sandbox 0.2.0. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack.
- Product
- Nashorn Sandbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2022StarWind SAN and NAS v0.2 build 1914 allow remote code execution.CVE-2022-32268 · Other software · Starwindsoftware · reported by MITREHigh 8.8
StarWind SAN and NAS v0.2 build 1914 allow remote code execution. A flaw was found in REST API in StarWind Stack. REST command, which allows changing the hostname, doesn’t check a new hostname parameter. It goes directly to bash as part of a script. An attacker with non-root user access can inject arbitrary data into the command that will be executed with root privileges.
- Product
- Starwind SAN & NAS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstarwindsoftware.comstarwindsoftware.com
May 10, 2022This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs prinCVE-2022-0866 · Other software · Redhat · reported by Red HatMedium 5.3
This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.
- Product
- Jboss Enterprise Application Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
May 5, 2022A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS.CVE-2021-44051 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.8
A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 5.0.0.1986 build 20220324 and later
- Product
- QuTScloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2022Linksys MR9600 devices before 2.0.5 allow attackers to read arbitrary files via a symbolic link to the root directory of a NAS SMB share.CVE-2022-24372 · Network & remote access · Linksys · reported by MITREMedium 4.6
Linksys MR9600 devices before 2.0.5 allow attackers to read arbitrary files via a symbolic link to the root directory of a NAS SMB share.
- Product
- Mr9600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlinksys.comlinksys.com
Apr 1, 2022An local privilege escalation vulnerability due to a "runasroot" command in eScan Anti-Virus.CVE-2021-26624 · Other software · MicroWorld Technologies Inc. · reported by vuln@krcert.or.krHigh 7.8
An local privilege escalation vulnerability due to a "runasroot" command in eScan Anti-Virus. This vulnerability is due to invalid arguments and insufficient execution conditions related to "runasroot" command. This vulnerability can induce remote attackers to exploit root privileges by manipulating parameter values.
- Product
- eScan Anti-Virus for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Mar 25, 2022An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual.CVE-2021-26620 · Other software · EFM Networks Co., Ltd · reported by vuln@krcert.or.krHigh 7.5
An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords.
- Product
- ipTIME NAS product (NAS1, 2, 3, 4, 1dual, 2dual 4dual)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Mar 16, 2022RunAsSpc 4.0 uses a universal and recoverable encryption key.CVE-2022-26660 · Other software · Robotronic · reported by MITREHigh 7.5
RunAsSpc 4.0 uses a universal and recoverable encryption key. In possession of a file encrypted by RunAsSpc, an attacker can recover the credentials that were used.
- Product
- Runasspc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrobotronic.derobotronic.de
Mar 1, 2022ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR).CVE-2022-24718 · Other software · Finastra · reported by GitHubHigh 7.6
ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.4, a path traversal issue can occur when providing untrusted input to the `svg` property as an argument to the `build(MessagePageOptions)` function. While there is no known workaround at this time, there is a patch in version 0.1.4.
- Product
- ssr-pages
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2022ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR).CVE-2022-24717 · Other software · Finastra · reported by GitHubMedium 6.1
ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.5, a cross site scripting (XSS) issue can occur when providing untrusted input to the `redirect.link` property as an argument to the `build(MessagePageOptions)` function. While there is no known workaround at this time, there is a patch in version 0.1.5.
- Product
- ssr-pages
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2022Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Summary Widget” element, that allows the injection of malicious JavaScript into the ‘CVE-2022-23054 · Other software · nasa · reported by vulnerabilitylab@mend.ioMedium 6.1
Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Summary Widget” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 version and later versions.
- Product
- openmct
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2022Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Condition Widget” element, that allows the injection of malicious JavaScript into theCVE-2022-23053 · Other software · nasa · reported by vulnerabilitylab@mend.ioMedium 6.1
Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Condition Widget” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 version and later versions.
- Product
- openmct
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2022Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Web Page” element, that allows the injection of malicious JavaScript into the ‘URL’ fCVE-2022-22126 · Other software · nasa · reported by vulnerabilitylab@mend.ioMedium 6.1
Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Web Page” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 version and later versions.
- Product
- openmct
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022Improper input validation in Exynos baseband prior to SMR Feb-2022 Release 1 allows attackers to send arbitrary NAS signaling messages with fake base station.CVE-2022-23425 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 8.6
Improper input validation in Exynos baseband prior to SMR Feb-2022 Release 1 allows attackers to send arbitrary NAS signaling messages with fake base station.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.