Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
702 results · page 14 of 15
Oct 6, 2020"HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details."CVE-2019-4325 · Other software · Hcltech · reported by psirt@hcl.comMedium 5.3
"HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details."
- Product
- Appscan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 1, 2020HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS).CVE-2020-14223 · Other software · Hcltech · reported by psirt@hcl.comMedium 6.1
HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS). The vulnerability could be employed in a reflected or non-persistent XSS attack.
- Product
- Digital Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 20, 2020Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download files from the RHEL environment by doing some modification in the CVE-2020-4125 · Other software · IBM · reported by psirt@hcl.comHigh 8.1
Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download files from the RHEL environment by doing some modification in the link, giving the attacker access to confidential information.
- Product
- Marketing Operations
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 17, 2020HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module.CVE-2020-4104 · Other software · HCL · reported by psirt@hcl.comMedium 5.4
HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module. An attacker can use XSS to send a malicious script to an unsuspecting user. This affects all versions prior to latest releases as specified in https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080855&sys_kb_id=971d99ed1b8ed01c086dcbfc0a4bcb6a.
- Product
- HCL BigFix WebUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 17, 2020"HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for users in Dashboard, potentially giving aCVE-2019-4091 · Other software · Hcltech · reported by psirt@hcl.comMedium 5.4
"HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for users in Dashboard, potentially giving an attacker ability to inject malicious code into the system. "
- Product
- Marketing Campaign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 17, 2020"HCL Campaign is vulnerable to cross-site scripting when a user provides XSS scripts in Campaign Description field."CVE-2019-4090 · Other software · Hcltech · reported by psirt@hcl.comMedium 5.4
"HCL Campaign is vulnerable to cross-site scripting when a user provides XSS scripts in Campaign Description field."
- Product
- Marketing Campaign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 16, 2020"BigFix Platform is storing clear text credentials within the system's memory.CVE-2020-4095 · Other software · Hcltech · reported by psirt@hcl.comMedium 6
"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to create a memory dump and extract the credentials. These credentials can be used to pivot further into the environment. The principle of least privilege should be applied to all BigFix deployments, limiting administrative access."
- Product
- Bigfix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 15, 2020"HCL Verse for Android was found to employ dynamic code loading.CVE-2020-4100 · Other software · Hcltechsw · reported by psirt@hcl.comMedium 4.4
"HCL Verse for Android was found to employ dynamic code loading. This mechanism allows a developer to specify which components of the application should not be loaded by default when the application is started. Typically, core components and additional dependencies are loaded natively at runtime; however, dynamically loaded components are only loaded as they are specifically requested. While this can have a positive impact on performance, or grant additional functionality (for example, a non-invasive update feature), it can also open the application to loading unintended code if not implemented properly."
- Product
- HCL Verse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 7, 2020"HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy."CVE-2019-4324 · Other software · Hcltech · reported by psirt@hcl.comMedium 6.1
"HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy."
- Product
- Appscan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 7, 2020"HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of untrusted web pages inCVE-2019-4323 · Other software · Hcltech · reported by psirt@hcl.comMedium 4.3
"HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of untrusted web pages in a frame."
- Product
- Appscan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 1, 2020"A vulnerability in the TLS protocol implementation of the Domino server could allow an unauthenticated, remote attacker to access sensitive information, aka a CVE-2017-1712 · Other software · Hcltech · reported by psirt@hcl.comMedium 5.9
"A vulnerability in the TLS protocol implementation of the Domino server could allow an unauthenticated, remote attacker to access sensitive information, aka a Return of Bleichenbacher's Oracle Threat (ROBOT) attack. An attacker could iteratively query a server running a vulnerable TLS stack implementation to perform cryptanalytic operations that may allow decryption of previously captured TLS sessions."
- Product
- Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 1, 2020"HCL iNotes is susceptible to a Cross-Site Scripting (XSS) Vulnerability.CVE-2017-1659 · Other software · IBM · reported by psirt@hcl.comMedium 6.1
"HCL iNotes is susceptible to a Cross-Site Scripting (XSS) Vulnerability. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials."
- Product
- Inotes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 26, 2020HCL Notes is vulnerable to an information leakage vulnerability through its support for the 'mailto' protocol.CVE-2020-4089 · Other software · HCL · reported by psirt@hcl.comMedium 6.5
HCL Notes is vulnerable to an information leakage vulnerability through its support for the 'mailto' protocol. This vulnerability could result in files from the user's filesystem or connected network filesystems being leaked to a third party. All versions of HCL Notes 9, 10 and 11 are affected.
- Product
- HCL Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 22, 2020Artica Proxy before 4.30.000000 Community Edition allows OS command injection via the Netbios name, Server domain name, dhclient_mac, Hostname, or Alias field.CVE-2020-13159 · Other software · Articatech · reported by MITRECritical 9.8
Artica Proxy before 4.30.000000 Community Edition allows OS command injection via the Netbios name, Server domain name, dhclient_mac, Hostname, or Alias field. NOTE: this may overlap CVE-2020-10818.
- Product
- Artica Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Jun 11, 2020"HCL Digital Experience is susceptible to Server Side Request Forgery."CVE-2020-4101 · Other software · Hcltech · reported by psirt@hcl.comCritical 9.8
"HCL Digital Experience is susceptible to Server Side Request Forgery."
- Product
- HCL Digital Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 6, 2020"If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not currently have a useCVE-2020-4092 · Other software · Hcltech · reported by psirt@hcl.comMedium 5.3
"If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not currently have a user interface option to change the setting to request an encrypted communication channel with the Domino server. This can potentially expose sensitive information including but not limited to server names, user IDs and document content."
- Product
- HCL Nomad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 1, 2020HCL Connections v5.5, v6.0, and v6.5 contains an open redirect vulnerability which could be exploited by an attacker to conduct phishing attacks.CVE-2019-4209 · Other software · HCL · reported by psirt@hcl.comMedium 6.1
HCL Connections v5.5, v6.0, and v6.5 contains an open redirect vulnerability which could be exploited by an attacker to conduct phishing attacks.
- Product
- HCL Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Apr 22, 2020"HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace to a local user."CVE-2020-4085 · Other software · Hcltech · reported by psirt@hcl.comMedium 6.5
"HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace to a local user."
- Product
- Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Apr 21, 2020"HCL AppScan Enterprise uses hard-coded credentials which can be exploited by attackers to get unauthorized access to application's encrypted files."CVE-2019-4327 · Other software · Hcltech · reported by psirt@us.ibm.comHigh 7.5
"HCL AppScan Enterprise uses hard-coded credentials which can be exploited by attackers to get unauthorized access to application's encrypted files."
- Product
- Appscan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Apr 7, 2020HCL AppScan Standard is vulnerable to excessive authorization attemptsCVE-2019-4393 · Other software · Hcltech · reported by psirt@us.ibm.comCritical 9.8
HCL AppScan Standard is vulnerable to excessive authorization attempts
- Product
- Appscan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Apr 7, 2020HCL AppScan Standard is vulnerable to XML External Entity Injection (XXE) attack when processing XML dataCVE-2019-4391 · Other software · Hcltech · reported by psirt@us.ibm.comHigh 8.2
HCL AppScan Standard is vulnerable to XML External Entity Injection (XXE) attack when processing XML data
- Product
- Appscan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Mar 9, 2020HCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting.CVE-2020-4084 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- HCL Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Mar 5, 2020HCL Connections 6.5 is vulnerable to possible information leakage.CVE-2020-4083 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.5
HCL Connections 6.5 is vulnerable to possible information leakage. Connections could disclose sensitive information via trace logs to a local user.
- Product
- "HCL Connections"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Mar 5, 2020The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.CVE-2020-4082 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
- Product
- "HCL Connections"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Feb 28, 2020BigFix Self-Service Application (SSA) is vulnerable to arbitrary code execution if Javascript code is included in Running Message or Post Message HTML.CVE-2019-4301 · Other software · IBM Corporation · reported by psirt@hcl.comHigh 8.4
BigFix Self-Service Application (SSA) is vulnerable to arbitrary code execution if Javascript code is included in Running Message or Post Message HTML.
- Product
- HCL BigFix Self-Service Application (SSA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Feb 14, 2020HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system.CVE-2019-4392 · Other software · IBM Corporation · reported by psirt@hcl.comCritical 9.8
HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system.
- Product
- HCL AppScan Standard Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhclpnpsupport.hcltech.comhclpnpsupport.hcltech.com
Dec 18, 2019HCL AppScan Source 9.0.3.13 and earlier is susceptible to cross-site scripting (XSS) attacks by allowing users to embed arbitrary JavaScript code in the Web UI.CVE-2019-4388 · Other software · HCL · reported by psirt@hcl.comMedium 4.8
HCL AppScan Source 9.0.3.13 and earlier is susceptible to cross-site scripting (XSS) attacks by allowing users to embed arbitrary JavaScript code in the Web UI.
- Product
- AppScan Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhclpnpsupport.hcltech.comhclpnpsupport.hcltech.com
Nov 27, 2019An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable.CVE-2012-2248 · Other software · isc-dhcp · reported by security@debian.orgHigh 8.1
An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable.
- Product
- isc-dhcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Oct 18, 2019HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks.CVE-2019-4409 · Other software · HCL · reported by psirt@hcl.comMedium 5.4
HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the entered file name. If the file name is not escaped in the returned error page, it could expose a cross-site scripting (XSS) vulnerability.
- Product
- HCL Traveler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhclpnpsupport.hcltech.comhclpnpsupport.hcltech.com
Sep 25, 2019HCL AppScan Source before 9.03.13 is susceptible to XML External Entity (XXE) attacks in multiple locations.CVE-2019-16188 · Other software · Hcltech · reported by MITREHigh 7.1
HCL AppScan Source before 9.03.13 is susceptible to XML External Entity (XXE) attacks in multiple locations. In particular, an attacker can send a specially crafted .ozasmt file to a targeted victim and ask the victim to open it. When the victim imports the .ozasmt file in AppScan Source, the content of any file in the local file system (to which the victim as read access) can be exfiltrated to a remote listener under the attacker's control. The product does not disable external XML Entity Processing, which can lead to information disclosure and denial of services attacks.
- Product
- Appscan Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhclpnpsupport.hcltech.comhclpnpsupport.hcltech.com
Apr 19, 2019SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, whCVE-2018-20817 · Other software · Activision · reported by MITRECritical 9.8
SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, which allows one to execute code on the remote target machine when sending a steam authentication request. This affects Call of Duty: Modern Warfare 2, Call of Duty: Modern Warfare 3, Call of Duty: Ghosts, Call of Duty: Advanced Warfare, Call of Duty: Black Ops 1, and Call of Duty: Black Ops 2.
- Product
- Call Of Duty\
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2018A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the web application API.CVE-2018-14893 · Network & remote access · Zyxel · reported by MITREHigh 8.8
A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the web application API.
- Product
- Nsa325 V2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
Nov 13, 2018SAP BusinessObjects Business Intelligence Platform Server, versions 4.1 and 4.2, when using Web Intelligence Richclient 3 tiers mode gateway allows an attacker CVE-2018-2473 · Network & remote access · SAP · reported by cna@sap.comMedium 6.5
SAP BusinessObjects Business Intelligence Platform Server, versions 4.1 and 4.2, when using Web Intelligence Richclient 3 tiers mode gateway allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
- Product
- SAP BusinessObjects Business Intelligence Platform Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comlaunchpad.support.sap.com
May 30, 2018A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP.CVE-2018-11518 · Other software · Hcltech · reported by MITREHigh 8.1
A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These IVR systems rely on various frequencies of audio signals; based on the frequency, certain commands and functions are processed. Since these frequencies are accepted within a phone call, an attacker can record these frequencies and use them for service activations. This is a request-forgery issue when the required series of DTMF signals for a service activation is predictable (e.g., the IVR system does not speak a nonce to the caller). In this case, the IVR system accepts an activation request from a less-secure channel (any loudspeaker in the caller's physical environment) without verifying that the request was intended (it matches a nonce sent over a more-secure channel to the caller's earpiece).
- Product
- Legacy IVR Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvirgil-cj.blogspot.comdatarift.blogspot.com
Jan 13, 2015SQL injection vulnerability in ChangeEmail.php in iTechClassifieds 3.03.057 allows remote attackers to execute arbitrary SQL commands via the PreviewNum parametCVE-2014-100020 · Other software · Itechscripts · reported by MITREHigh 7.5
SQL injection vulnerability in ChangeEmail.php in iTechClassifieds 3.03.057 allows remote attackers to execute arbitrary SQL commands via the PreviewNum parameter. NOTE: the CatID parameter is already covered by CVE-2008-0685.
- Product
- Itechclassifieds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgexploit-db.com
Apr 8, 2011dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary CVE-2011-0997 · Other software · ISC · reported by MITREHigh 7.5
dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is provided to dhclient-script.
- Product
- Dhcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.juniper.netlists.fedoraproject.org
May 3, 2010Directory traversal vulnerability in the HelpCenter module in Help Center Live (HCL) 2.0.6 and 2.1.7 allows remote attackers to read arbitrary files and possiblCVE-2010-1652 · Other software · Helpcenterlive · reported by MITREMedium 5
Directory traversal vulnerability in the HelpCenter module in Help Center Live (HCL) 2.0.6 and 2.1.7 allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the file parameter to module.php. NOTE: some of these details are obtained from third party information.
- Product
- HCL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Mar 30, 2010freshclam in ClamAV in Apple Mac OS X 10.5.8 with Security Update 2009-005 has an incorrect launchd.plist ProgramArguments key and consequently does not run, whCVE-2010-0058 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.4
freshclam in ClamAV in Apple Mac OS X 10.5.8 with Security Update 2009-005 has an incorrect launchd.plist ProgramArguments key and consequently does not run, which might allow remote attackers to introduce viruses into the system.
- Product
- MAC OS X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comsupport.apple.com
Jul 14, 2009Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 before 3.1.2CVE-2009-0692 · Other software · ISC · reported by cret@cert.orgHigh 10
Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 before 3.1.2p1, 3.0, and 2.0 allows remote DHCP servers to execute arbitrary code via a crafted subnet-mask option.
- Product
- Dhcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.netbsd.orgitrc.hp.com
Oct 23, 2008Stack-based buffer overflow in Hummingbird.XWebHostCtrl.1 ActiveX control (hclxweb.dll) in Hummingbird Xweb ActiveX Control 13.0 and earlier allows remote attacCVE-2008-4729 · Other software · Hummingbird · reported by MITREMedium 6.8
Stack-based buffer overflow in Hummingbird.XWebHostCtrl.1 ActiveX control (hclxweb.dll) in Hummingbird Xweb ActiveX Control 13.0 and earlier allows remote attackers to execute arbitrary code via a long PlainTextPassword property. NOTE: code execution might not be possible in 13.0.
- Product
- Exceed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Sep 10, 2008Multiple memory leaks in freshclam/manager.c in ClamAV before 0.94 might allow attackers to cause a denial of service (memory consumption) via unspecified vectoCVE-2008-3913 · Other software · Clamav · reported by MITREMedium 5
Multiple memory leaks in freshclam/manager.c in ClamAV before 0.94 might allow attackers to cause a denial of service (memory consumption) via unspecified vectors related to "error handling logic".
- Product
- Clamav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkolab.orglists.apple.com
Feb 11, 2008Cross-site scripting (XSS) vulnerability in ViewCat.php in iTechClassifieds 3.0 allows remote attackers to inject arbitrary web script or HTML via the CatID parCVE-2008-0684 · Other software · Itechscripts · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in ViewCat.php in iTechClassifieds 3.0 allows remote attackers to inject arbitrary web script or HTML via the CatID parameter.
- Product
- Itechclassifieds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2008SQL injection vulnerability in ViewCat.php in iTechClassifieds 3.0 allows remote attackers to execute arbitrary SQL commands via the CatID parameter.CVE-2008-0685 · Other software · Itechscripts · reported by MITREHigh 7.5
SQL injection vulnerability in ViewCat.php in iTechClassifieds 3.0 allows remote attackers to execute arbitrary SQL commands via the CatID parameter.
- Product
- Itechclassifieds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2007The check_logout function in class/auth.php in Help Center Live (hcl) 2.1.3a sends a redirect to the web browser but does not exit when administrative credentiaCVE-2007-4240 · Other software · Help Center Live · reported by MITREHigh 7.5
The check_logout function in class/auth.php in Help Center Live (hcl) 2.1.3a sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to delete administrative users and have other unspecified impact via certain requests to (1) admin/departments.php, (2) admin/operators.php, and other unspecified scripts. NOTE: some of these details are obtained from third party information.
- Product
- Help Center Live
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2006freshclam in (1) Clam Antivirus (ClamAV) 0.88 and (2) ClamXav 1.0.3h and earlier does not drop privileges before processing the config-file command line option,CVE-2006-2427 · Other software · Clam Anti-virus · reported by MITREHigh 7.2
freshclam in (1) Clam Antivirus (ClamAV) 0.88 and (2) ClamXav 1.0.3h and earlier does not drop privileges before processing the config-file command line option, which allows local users to read portions of arbitrary files when an error message displays the first line of the target file.
- Product
- Clamav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
May 1, 2006Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to execute arbitrary code vCVE-2006-1989 · Other software · Clam Anti-virus · reported by MITREMedium 5.1
Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to execute arbitrary code via long HTTP headers.
- Product
- Clamav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkolab.orglists.apple.com
Feb 22, 2006SQL injection vulnerability in include/includes/user/login.php in ilchClan before 1.05g allows remote attackers to execute arbitrary SQL commands via the login_CVE-2006-0850 · Other software · Ilch.de · reported by MITREHigh 7.5
SQL injection vulnerability in include/includes/user/login.php in ilchClan before 1.05g allows remote attackers to execute arbitrary SQL commands via the login_name parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- Ilchclan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2006SQL injection vulnerability in the forum module of ilchClan 1.05g and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter, wCVE-2006-0851 · Other software · Ilch.de · reported by MITREHigh 7.5
SQL injection vulnerability in the forum module of ilchClan 1.05g and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter, when creating a newpost.
- Product
- Ilchclan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2004PHP remote file inclusion vulnerability in UberTec Help Center Live (HCL) allows remote attackers to read local files and possibly execute PHP code via a URL inCVE-2004-2601 · Other software · Ubertec · reported by MITREMedium 6.4
PHP remote file inclusion vulnerability in UberTec Help Center Live (HCL) allows remote attackers to read local files and possibly execute PHP code via a URL in the SKIN_inner parameter to inc/skin.php.
- Product
- Help Center Live
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Dec 31, 2004Cross-site scripting (XSS) vulnerability in the Search module in UberTec Help Center Live (HCL) allows remote attackers to inject arbitrary web script or HTML vCVE-2004-2603 · Other software · Ubertec · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Search module in UberTec Help Center Live (HCL) allows remote attackers to inject arbitrary web script or HTML via the find parameter to index.php.
- Product
- Help Center Live
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.