Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
865 results · page 11 of 18
Jun 8, 2022LibreHealth EHR Base 2.0.0 allows interface/main/finder/finder_navigation.php patient XSS.CVE-2022-31497 · Other software · Librehealth · reported by MITREMedium 6.1
LibreHealth EHR Base 2.0.0 allows interface/main/finder/finder_navigation.php patient XSS.
- Product
- Librehealth EHR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2022Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permissio to get sCVE-2022-30742 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permissio to get sim card information through device log.
- Product
- Find My Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 7, 2022Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permission to gCVE-2022-30741 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permission to get sim card information through device log.
- Product
- Find My Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
May 12, 2022Nginx NJS v0.7.2 was discovered to contain a segmentation violation via njs_lvlhsh_bucket_find at njs_lvlhsh.c.CVE-2022-29369 · Network & remote access · F5 · reported by MITREHigh 7.5
Nginx NJS v0.7.2 was discovered to contain a segmentation violation via njs_lvlhsh_bucket_find at njs_lvlhsh.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2022Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925.CVE-2022-1629 · Other software · vim · reported by security@huntr.devHigh 7.8
Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
May 10, 2022Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919.CVE-2022-1621 · Other software · vim · reported by security@huntr.devHigh 7.8
Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
May 5, 2022In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to multiple cross-site scCVE-2022-29940 · Other software · Librehealth · reported by MITREMedium 5.4
In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to multiple cross-site scripting (XSS) vulnerabilities.
- Product
- Librehealth EHR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&find=.CVE-2022-28424 · Other software · Janobe · reported by MITRECritical 9.8
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&find=.
- Product
- Baby Care System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022Improper input validation vulnerability in parser_iloc and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of boCVE-2022-27574 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.4
Improper input validation vulnerability in parser_iloc and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by privileged attacker.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 11, 2022Improper input validation vulnerability in parser_infe and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of boCVE-2022-27573 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.4
Improper input validation vulnerability in parser_infe and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by privileged attackers.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 11, 2022In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.CVE-2022-27115 · Other software · Std42 · reported by MITRECritical 9.8
In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.
- Product
- Elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2022A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary filCVE-2021-43421 · Other software · Std42 · reported by MITRECritical 9.8
A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.
- Product
- Elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Library File Manager: Is using an outdated version of the elFinder libraryCVE-2022-0403 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by security issues (CVE-2021-32682), and does not have any authorisation as well as CSRF checks in its connector AJAX action, allowing any authenticated users, such as subscriber to call it. Furthermore, as the options passed to the elFinder library does not restrict any file type, users with a role as low as subscriber can Create/Upload/Delete Arbitrary files and folders.
- Product
- Library File Manager
- Fixed in
- 5.2.3
- What to do
- Update Library File Manager to 5.2.3 or newer.
Mar 27, 2022ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.CVE-2021-26599 · Other software · Impresscms · reported by MITRECritical 9.8
ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.
- Product
- Impresscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmainsecurity.compacketstormsecurity.com
Mar 27, 2022ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have CVE-2021-26598 · Other software · Impresscms · reported by MITREMedium 5.3
ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).
- Product
- Impresscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmainsecurity.comseclists.org
Mar 25, 2022phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.CVE-2021-46426 · Websites & servers · Phpipam · reported by MITREMedium 6.1
phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 21, 2022connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal.CVE-2022-26960 · Other software · Std42 · reported by MITRECritical 9.1
connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.
- Product
- Elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsynacktiv.com
Mar 16, 2022stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype.h.CVE-2022-25516 · Other software · Nothings · reported by MITREMedium 6.5
stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.
- Product
- STB Truetype.h
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Petfinder Listings: Does not escape its settingsCVE-2022-0702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Petfinder Listings WordPress plugin through 1.0.18 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Petfinder Listings
- Affected
- up to 1.0.18
- What to do
- Affects up to 1.0.18. Update Petfinder Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 10, 2022Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine() in parser.c.CVE-2021-33293 · Other software · Libpano13 Project · reported by MITRECritical 9.1
Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine() in parser.c.
- Product
- Libpano13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgroups.google.comlists.debian.org
Mar 1, 2022tsMuxer git-c6a0277 was discovered to contain a segmentation fault via DTSStreamReader::findFrame in dtsStreamReader.cpp.CVE-2021-45864 · Other software · Tsmuxer Project · reported by MITREMedium 5.5
tsMuxer git-c6a0277 was discovered to contain a segmentation fault via DTSStreamReader::findFrame in dtsStreamReader.cpp.
- Product
- Tsmuxer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2022An integer overflow in DTSStreamReader::findFrame() of tsMuxer git-2678966 allows attackers to cause a Denial of Service (DoS) via a crafted file.CVE-2021-45860 · Other software · Tsmuxer Project · reported by MITREMedium 5.5
An integer overflow in DTSStreamReader::findFrame() of tsMuxer git-2678966 allows attackers to cause a Denial of Service (DoS) via a crafted file.
- Product
- Tsmuxer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022A Remote Code Execution (RCE) vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in connetor.php.CVE-2021-44663 · Other software · Nottingham.ac · reported by MITRECritical 9.8
A Remote Code Execution (RCE) vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in connetor.php.
- Product
- Xerte Online Toolkits
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.CVE-2021-45919 · Other software · Std42 · reported by MITREMedium 5.4
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.
- Product
- Elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrustwave.comtrustwave.com
Jan 31, 2022MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE).CVE-2021-46661 · Other software · Mariadb · reported by MITREMedium 5.5
MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE).
- Product
- Mariadb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mariadb.orglists.fedoraproject.org
Jan 24, 2022Jerryscript v3.0.0 and below was discovered to contain a stack overflow via ecma_find_named_property in ecma-helpers.c.CVE-2021-44988 · Other software · Jerryscript · reported by MITREHigh 7.8
Jerryscript v3.0.0 and below was discovered to contain a stack overflow via ecma_find_named_property in ecma-helpers.c.
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022Jerryscript 3.0.0 was discovered to contain a stack overflow via ecma_op_object_find_own in /ecma/operations/ecma-objects.c.CVE-2022-22888 · Other software · Jerryscript · reported by MITREHigh 7.8
Jerryscript 3.0.0 was discovered to contain a stack overflow via ecma_op_object_find_own in /ecma/operations/ecma-objects.c.
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022ROPium v3.1 was discovered to contain an invalid memory address dereference via the find() function.CVE-2021-45761 · Other software · Ropium Project · reported by MITREHigh 7.5
ROPium v3.1 was discovered to contain an invalid memory address dereference via the find() function.
- Product
- Ropium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FIND_NODE_IN_RANGE frames, allowing a remote, unauthCVE-2020-10137 · Other software · Silicon Labs · reported by cret@cert.orgMedium 6.5
Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FIND_NODE_IN_RANGE frames, allowing a remote, unauthenticated attacker to inject a FIND_NODE_IN_RANGE frame with an invalid random payload, denying service by blocking the processing of upcoming events.
- Product
- UZB-7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021In 'ih264e_find_bskip_params()' of ih264e_me.c, there is a possible out of bounds read due to a heap buffer overflow.CVE-2021-0998 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In 'ih264e_find_bskip_params()' of ih264e_me.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-193442575
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Nov 30, 2021Browser and Operating System Finder versions prior to 1.2: Cross-site request forgery (CSRF)CVE-2021-20851 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Browser and Operating System Finder versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of an administrator via unspecified vectors.
- Product
- Browser and Operating System Finder versions prior to 1.2
- Fixed in
- 1.2
- What to do
- Update Browser and Operating System Finder versions prior to 1.2 to 1.2 or newer.
Oct 18, 2021Find My Blocks: Does not have authorisation checks in its REST APICVE-2021-24677 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles.
- Product
- Find My Blocks
- Fixed in
- 3.4.0
- What to do
- Update Find My Blocks to 3.4.0 or newer.
Oct 13, 2021SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php.CVE-2021-42224 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php.
- Product
- Ifsc Code Finder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 7, 2021Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.CVE-2021-32172 · Other software · Maianscriptworld · reported by MITRECritical 9.8
Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.
- Product
- Maian Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdreyand.github.io
Oct 4, 2021Better Find and Replace: Does not escape the 's' GET parameter before outputting back in the All Masking Rules pageCVE-2021-24676 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue
- Product
- Better Find and Replace
- Fixed in
- 1.2.9
- What to do
- Update Better Find and Replace to 1.2.9 or newer.
Sep 7, 2021The find_color_or_error function in gifsicle 1.92 contains a NULL pointer dereference.CVE-2020-19752 · Other software · Lcdf · reported by MITREHigh 7.5
The find_color_or_error function in gifsicle 1.92 contains a NULL pointer dereference.
- Product
- Gifsicle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Sep 7, 2021A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.CVE-2021-39258 · Other software · Tuxera · reported by MITREHigh 7.8
A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.
- Product
- Ntfs-3g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22.CVE-2021-39255 · Other software · Tuxera · reported by MITREHigh 7.8
A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22.
- Product
- Ntfs-3g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2021Malicious attacker is able to find out valid user logins by using the "lost password" feature.CVE-2021-36095 · Other software · OTRS AG · reported by security@otrs.comMedium 5.3
Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions.
- Product
- ((OTRS)) Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2021This affects all versions of package elFinder.NetCore.CVE-2021-23428 · Other software · Elfinder.netcore Project · reported by report@snyk.ioHigh 8.6
This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal
- Product
- Elfinder.netcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2021This affects all versions of package elFinder.NetCore.CVE-2021-23427 · Other software · Elfinder.netcore Project · reported by report@snyk.ioHigh 8.6
This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to arbitrary extraction due to insufficient validation.
- Product
- Elfinder.netcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2021An information disclosure vulnerability exists in the Friend finder functionality of GmbH Komoot version 10.26.9 up to 11.1.11.CVE-2021-21823 · Other software · Komoot · reported by talos-cna@cisco.comHigh 7.5
An information disclosure vulnerability exists in the Friend finder functionality of GmbH Komoot version 10.26.9 up to 11.1.11. A specially crafted series of network requests can lead to the disclosure of sensitive information.
- Product
- Komoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 18, 2021A SQL injection vulnerability in /oa.php?c=Staff&a=read of Find a Place LJCMS v 1.3 allows attackers to access sensitive database information via a crafted POSTCVE-2020-22122 · Other software · Find A Place Ljcms Project · reported by MITREHigh 7.5
A SQL injection vulnerability in /oa.php?c=Staff&a=read of Find a Place LJCMS v 1.3 allows attackers to access sensitive database information via a crafted POST request.
- Product
- Find A Place Ljcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2021This affects the package elFinder.AspNet before 1.1.1.CVE-2021-23415 · Other software · Elfinder.aspnet Project · reported by report@snyk.ioHigh 7.5
This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path.
- Product
- Elfinder.aspnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2021This affects the package elFinder.Net.Core from 0 and before 1.2.4.CVE-2021-23407 · Other software · Elfinder.net.core Project · reported by report@snyk.ioHigh 7.5
This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is used to create a file system path.
- Product
- Elfinder.net.core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2021elFinder is an open-source file manager for web, written in JavaScript using jQuery UI.CVE-2021-32682 · Other software · Studio-42 · reported by GitHubCritical 9.8
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.
- Product
- elFinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comblog.sonarsource.com
Jun 13, 2021The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file.CVE-2021-23394 · Other software · Std42 · reported by report@snyk.ioHigh 8.1
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
- Product
- Elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comgithub.com
Jun 11, 2021In FindOrCreatePeer of btif_av.cc, there is a possible use after free due to a race condition.CVE-2021-0476 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In FindOrCreatePeer of btif_av.cc, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-9 Android-10Android ID: A-169252501
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 2, 2021FDCMS (also known as Fangfa Content Management System) 4.0 allows remote attackers to get a webshell in the background via Front/lib/Action/FindexAction.class.pCVE-2020-35442 · Other software · Fangfa · reported by MITRECritical 9.8
FDCMS (also known as Fangfa Content Management System) 4.0 allows remote attackers to get a webshell in the background via Front/lib/Action/FindexAction.class.php.
- Product
- Fdcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2021A user authorized to performing a specific type of find query may trigger a denial of service.CVE-2021-20326 · Other software · MongoDB Inc. · reported by cna@mongodb.comMedium 6.5
A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgjira.mongodb.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.