Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,220 results · page 14 of 25

Jan 31, 2019An issue was discovered in OpenSSH 7.9.CVE-2019-6111 · Other software · Siemens · reported by MITREMedium 5.9
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
Product
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org openwall.com
Jan 31, 2019In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the cCVE-2019-6110 · Other software · Siemens · reported by MITREMedium 6.8
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.
Product
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cvsweb.openbsd.org
Jan 31, 2019An issue was discovered in OpenSSH 7.9.CVE-2019-6109 · Other software · Siemens · reported by MITREMedium 6.8
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
Product
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org access.redhat.com
Jan 18, 2019AGPS session failure in GNSS module due to cyphersuites are hardcoded and needed manual update everytime in snapdragon mobile and snapdragon wear in versions MDCVE-2017-18160 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
AGPS session failure in GNSS module due to cyphersuites are hardcoded and needed manual update everytime in snapdragon mobile and snapdragon wear in versions MDM9635M, MDM9645, MDM9650, MDM9655, MSM8909W, SD 835, SD 845, SD 850
Product
Snapdragon Mobile, Snapdragon Wear
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com qualcomm.com
Jan 10, 2019In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of .CVE-2018-20685 · Other software · Openbsd · reported by MITREMedium 5.3
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
Product
Openssh
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com access.redhat.com
Nov 16, 2018An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3.CVE-2018-16395 · Other software · Ruby-lang · reported by MITRECritical 9.8
An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.
Product
Openssl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org securitytracker.com
Oct 30, 2018The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack.CVE-2018-0734 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgMedium 5.9
The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).
Product
OpenSSL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Oct 29, 2018The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack.CVE-2018-0735 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgMedium 5.9
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).
Product
OpenSSL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Oct 23, 2018Under certain mode of operations, HLOS may be able get direct or indirect access through DXE channels to tamper with the authenticated WCNSS firmware stored in CVE-2017-18313 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 5.3
Under certain mode of operations, HLOS may be able get direct or indirect access through DXE channels to tamper with the authenticated WCNSS firmware stored in DDR because DXE-accessible memory is located within the authenticated image in Snapdragon Mobile and Snapdragon Wear in version MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 617.
Product
Snapdragon Mobile, Snapdragon Wear
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com qualcomm.com
Oct 8, 2018Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in CVE-2018-1000808 · Other software · Pyopenssl Project · reported by MITREMedium 5.9
Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.
Product
Pyopenssl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org access.redhat.com
Oct 8, 2018Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can resulCVE-2018-1000807 · Other software · Pyopenssl · reported by MITREHigh 8.1
Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.
Product
Pyopenssl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org access.redhat.com
Sep 10, 2018A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys.CVE-2016-7056 · Other software · The OpenSSL Project · reported by Red HatMedium 5.5
A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys.
Product
openssl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com securityfocus.com
Aug 28, 2018Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 CVE-2018-15919 · Other software · Openbsd · reported by MITREMedium 5.3
Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.'
Product
Openssh
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org securityfocus.com
Aug 17, 2018Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application.CVE-2018-14982 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application. The LG ID is LVE-SMP-180004.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lgsecurity.lge.com lgsecurity.lge.com
Aug 17, 2018OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containinCVE-2018-15473 · Other software · Openbsd · reported by MITREMedium 5.3
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Product
Openssh
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Aug 10, 2018The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links.CVE-2018-6553 · Other software · Cups · reported by security@ubuntu.comHigh 8.8
The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. A local attacker could possibly use this issue to escape confinement. This flaw affects versions prior to 2.2.7-1ubuntu2.1 in Ubuntu 18.04 LTS, prior to 2.2.4-7ubuntu3.1 in Ubuntu 17.10, prior to 2.1.3-4ubuntu0.5 in Ubuntu 16.04 LTS, and prior to 1.7.2-0ubuntu1.10 in Ubuntu 14.04 LTS.
Product
Cups
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org security.gentoo.org
Aug 1, 2018It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack.CVE-2016-8635 · Computers, phones & browsers · Mozilla · reported by Red HatMedium 5.3
It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group.
Product
nss
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com securityfocus.com
Jul 19, 2018nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.CVE-2016-9574 · Other software · [UNKNOWN] · reported by Red HatMedium 5.9
nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.
Product
nss
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org bugzilla.redhat.com
Jun 12, 2018During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client.CVE-2018-0732 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgHigh 7.5
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).
Product
OpenSSL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com securityfocus.com
Jun 11, 2018A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over.CVE-2017-5462 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated with NSS version 3.28.4. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jun 8, 2018The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20.CVE-2011-4190 · Other software · SUSE · reported by security@opentext.comMedium 5.9
The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this flaw to impersonate the correct kdump server to obtain security sensitive information (kdump core files).
Product
kdump
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.suse.com suse.com
Jun 6, 2018openssl.js was a malicious module published with the intent to hijack environment variables.CVE-2017-16065 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
openssl.js node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018node-openssl was a malicious module published with the intent to hijack environment variables.CVE-2017-16064 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
node-openssl node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Apr 16, 2018The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack.CVE-2018-0737 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgMedium 5.9
The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).
Product
OpenSSL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com securityfocus.com
Apr 4, 2018lib/interface.php of the Relevanssi plugin 4.0.4 for: Cross-site scripting (XSS)CVE-2018-9034 · WordPress plugins & themes · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the tab GET parameter.
Product
lib/interface.php of the Relevanssi plugin 4.0.4 for
Affected
up to 4.0.4
What to do
Affects up to 4.0.4. Update lib/interface.php of the Relevanssi plugin 4.0.4 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Mar 27, 2018Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recurCVE-2018-0739 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgMedium 6.5
Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).
Product
OpenSSL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Mar 27, 2018Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte.CVE-2018-0733 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgMedium 5.9
Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security claims of the scheme. The module can only be compiled by the HP-UX assembler, so that only HP-UX PA-RISC targets are affected. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g).
Product
OpenSSL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Feb 15, 2018A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.CVE-2016-8518 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.5
A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.
Product
Systems Insight Manager using OpenSSL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com h20566.www2.hpe.com
Feb 15, 2018A cross site scripting vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.CVE-2016-8517 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 6.1
A cross site scripting vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.
Product
Systems Insight Manager using OpenSSL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com h20566.www2.hpe.com
Feb 15, 2018A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.CVE-2016-8516 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.5
A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.
Product
Systems Insight Manager using OpenSSL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com h20566.www2.hpe.com
Feb 15, 2018Authentication bypass vulnerability in mod_nss 1.0.8 allows remote attackers to assume the identity of a valid user by using their certificate and entering 'pasCVE-2011-4973 · Other software · MOD NSS Project · reported by Red HatCritical 9.8
Authentication bypass vulnerability in mod_nss 1.0.8 allows remote attackers to assume the identity of a valid user by using their certificate and entering 'password' as the password.
Product
MOD NSS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com redhat.com
Jan 23, 2018A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78.CVE-2017-15107 · Other software · Simon Kelley · reported by Red HatHigh 7.5
A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist.
Product
dnsmasq
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.thekelleys.org.uk
Jan 23, 2018An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially craCVE-2017-15094 · Other software · PowerDNS · reported by Red HatMedium 5.9
An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or process-no-validate (default).
Product
PowerDNS Recursor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com doc.powerdns.com
Jan 23, 2018An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been aCVE-2017-15090 · Other software · PowerDNS · reported by Red HatMedium 5.9
An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuing a valid signature for the crafted records.
Product
PowerDNS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com doc.powerdns.com
Jan 22, 2018Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some CVE-2018-1000003 · Other software · Powerdns · reported by MITRELow 3.7
Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay.
Product
Recursor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record doc.powerdns.com doc.powerdns.com
Jan 22, 2018Improper input validation bugs in DNSSEC validators components in Knot Resolver (prior version 1.5.2) allow attacker in man-in-the-middle position to deny existCVE-2018-1000002 · Other software · NIC · reported by MITRELow 3.7
Improper input validation bugs in DNSSEC validators components in Knot Resolver (prior version 1.5.2) allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay.
Product
Knot Resolver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record knot-resolver.cz knot-resolver.cz
Jan 21, 2018sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS messaCVE-2016-10708 · Other software · Openbsd · reported by MITREHigh 7.5
sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c.
Product
Openssh
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.swiecki.net securityfocus.com
Dec 27, 2017Heap-based buffer overflow in the __get_page function in lib/dbm/src/h_page.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to hCVE-2017-11698 · Computers, phones & browsers · Mozilla · reported by MITREHigh 7.8
Heap-based buffer overflow in the __get_page function in lib/dbm/src/h_page.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.
Product
Network Security Services
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Dec 27, 2017The __hash_open function in hash.c:229 in Mozilla Network Security Services (NSS) allows context-dependent attackers to cause a denial of service (floating poinCVE-2017-11697 · Computers, phones & browsers · Mozilla · reported by MITREHigh 7.8
The __hash_open function in hash.c:229 in Mozilla Network Security Services (NSS) allows context-dependent attackers to cause a denial of service (floating point exception and crash) via a crafted cert8.db file.
Product
Network Security Services
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Dec 27, 2017Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to haCVE-2017-11696 · Computers, phones & browsers · Mozilla · reported by MITREHigh 7.8
Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.
Product
Network Security Services
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Dec 27, 2017Heap-based buffer overflow in the alloc_segs function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to havCVE-2017-11695 · Computers, phones & browsers · Mozilla · reported by MITREHigh 7.8
Heap-based buffer overflow in the alloc_segs function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.
Product
Network Security Services
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Dec 11, 2017Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure.CVE-2017-15896 · Other software · The Node.js Project · reported by cve-request@iojs.orgCritical 9.1
Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.
Product
Node.js
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org nodejs.org
Dec 7, 2017There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli.CVE-2017-3738 · Websites & servers · OpenSSL Software Foundation · reported by openssl-security@openssl.orgMedium 5.9
There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version 1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it becomes available. The fix is also available in commit e502
Product
OpenSSL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Dec 7, 2017OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism.CVE-2017-3737 · Websites & servers · OpenSSL Software Foundation · reported by openssl-security@openssl.orgMedium 5.9
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. OpenSSL 1.1.0 is not affected.
Product
OpenSSL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Nov 23, 2017plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackCVE-2017-15088 · Other software · MIT · reported by Red HatCritical 9.8
plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.
Product
Kerberos 5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugs.debian.org
Nov 17, 2017Reflected XSS in Relevanssi Premium version 1.14.8 when using relevanssi_didyoumean() could allow unauthenticated attacker to do almost anything an admin canCVE-2017-1000225 · Other software · Relevanssi · reported by MITREMedium 6.1
Reflected XSS in Relevanssi Premium version 1.14.8 when using relevanssi_didyoumean() could allow unauthenticated attacker to do almost anything an admin can
Product
Relevanssi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.dxw.com security.dxw.com
Nov 13, 2017A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets CVE-2016-8610 · Websites & servers · OpenSSL · reported by Red HatHigh 7.5
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
Product
OpenSSL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com rhn.redhat.com
Nov 2, 2017There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g.CVE-2017-3736 · Websites & servers · OpenSSL Software Foundation · reported by openssl-security@openssl.orgMedium 6.5
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.
Product
OpenSSL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Oct 25, 2017The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zCVE-2017-15906 · Other software · Openbsd · reported by MITREMedium 5.3
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
Product
Openssh
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com access.redhat.com
Sep 25, 2017Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.CVE-2015-7510 · Other software · Systemd Project · reported by Red HatCritical 9.8
Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
Product
Systemd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.