Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

1,483 results · page 16 of 30

Feb 14, 2022Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themiCVE-2022-0200 · WordPress plugins & themes · reported by WPScanMedium 5.4
Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
Fixed in
1.1.7
What to do
Update the plugin to 1.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages: Does not check for authorisation and has a flawed CSRF logicCVE-2021-25106 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for authorisation and has a flawed CSRF logic when saving its settings, allowing any authenticated users, such as subscriber, to update them. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored Cross-Site Scripting
Product
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages
Fixed in
2.7.1
What to do
Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages to 2.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022SupportCandy: Does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embedCVE-2021-24878 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embed, leading to a Reflected Cross-Site Scripting issue
Product
SupportCandy
Fixed in
2.2.7
What to do
Update SupportCandy to 2.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 18, 2022User Registration, Login & Landing Pages: Stored Cross-Site ScriptingCVE-2022-0232 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the loader_text parameter found in the ~/includes/templates/landing-page.php file which allows attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.2.7. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
User Registration, Login & Landing Pages
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update User Registration, Login & Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 18, 2022An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unprivileged context.CVE-2021-22566 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 5.1
An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unprivileged context. This can be leveraged by an attacker to bypass executability restrictions of kernel-mode pages from user-mode. An incorrect setting of PXN bits within mmu_flags_to_s1_pte_attr lead to unprivileged executable pages being mapped as executable from a privileged context. This can be leveraged by an attacker to bypass executability restrictions of user-mode pages from kernel-mode. Typically this allows a potential attacker to circumvent a mitigation, making exploitation of potential kernel-mode vulnerabilities easier. We recommend updating kernel beyond commit 7d731b4e9599088ac3073956933559da7bca6a00 and rebuilding.
Product
Fuchsia
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fuchsia.googlesource.com fuchsia.googlesource.com
Jan 3, 2022Speed Booster Pack ⚡ PageSpeed Optimization Suite: Does not escape the sbp_convert_table_name parameter before using it in a SQL statement to convert the related tableCVE-2021-25023 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.3.3.1 does not escape the sbp_convert_table_name parameter before using it in a SQL statement to convert the related table, leading to an SQL injection
Product
Speed Booster Pack ⚡ PageSpeed Optimization Suite
Fixed in
4.3.3.1
What to do
Update Speed Booster Pack ⚡ PageSpeed Optimization Suite to 4.3.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pagesCVE-2021-25022 · WordPress plugins & themes · reported by WPScanMedium 6.1
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues
Product
UpdraftPlus WordPress Backup
Fixed in
1.16.66
What to do
Update UpdraftPlus WordPress Backup to 1.16.66 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 3, 2022WP Travel Engine: Does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pagesCVE-2021-24680 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed
Product
WP Travel Engine
Fixed in
5.3.1
What to do
Update WP Travel Engine to 5.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021WordPress Download Manager: Does not sanitise and escape Template data before outputting it in various pages (suchCVE-2021-24969 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks
Product
WordPress Download Manager
Fixed in
3.2.22
What to do
Update WordPress Download Manager to 3.2.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 22, 2021DIAEnergie Version 1.7.5 and prior is vulnerable to a reflected cross-site scripting attack through error pages that are returned by “.NET Request.QueryString”.CVE-2021-23228 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.5
DIAEnergie Version 1.7.5 and prior is vulnerable to a reflected cross-site scripting attack through error pages that are returned by “.NET Request.QueryString”.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Dec 8, 2021By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock CVE-2021-43538 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org lists.debian.org
Dec 8, 2021A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or files as a 'nobody'CVE-2021-20040 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 7.5
A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or files as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
Product
SonicWall SMA100
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.global.sonicwall.com psirt.global.sonicwall.com
Dec 7, 2021grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain Xen-owned pages of memory.CVE-2021-28703 · Other software · Xen Project · reported by security@xen.orgHigh 7
grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests from the guest to insert mappings of these pages may result in any of them to become mapped in multiple locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed and perhaps re-used for other purposes. This bug was fortuitously fixed by code cleanup in Xen 4.14, and backported to security-supported Xen branches as a prerequisite of the fix for XSA-378.
Product
Xen
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.gentoo.org xenbits.xenproject.org
Dec 6, 2021It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above.CVE-2021-39890 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.1
It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above.
Product
GitLab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com gitlab.com
Dec 6, 2021Import any XML or CSV File to: Does not escape the Import's Title and Unique Identifier fields before outputting them in admin pagesCVE-2021-24714 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed.
Product
Import any XML or CSV File to
Fixed in
3.6.3
What to do
Update Import any XML or CSV File to to 3.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 3, 2021Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.CVE-2021-44278 · Other software · Librenms · reported by MITRECritical 9.8
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.
Product
Librenms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 2, 2021nZEDb v0.4.20 is affected by a Cross Site Scripting (XSS) vulnerability in www/pages/api.php.CVE-2021-43686 · Other software · Nzedb Project · reported by MITREMedium 6.1
nZEDb v0.4.20 is affected by a Cross Site Scripting (XSS) vulnerability in www/pages/api.php. The exit function will terminate the script and print the message which has the input $_GET['t'].
Product
Nzedb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 1, 2021Events Manager: Does not sanitise and escape some search parameter before outputing them in pagesCVE-2020-35037 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues
Product
Events Manager
Fixed in
5.9.8
What to do
Update Events Manager to 5.9.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 17, 2021Insert Pages: Allows users with a roleCVE-2021-24851 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardless of their author and status (ie private), using a shortcode. Password protected posts/pages are not affected by such issue.
Product
Insert Pages
Fixed in
3.7.0
What to do
Update Insert Pages to 3.7.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 17, 2021Insert Pages: Adds a shortcode that prints out other pages' content and custom fieldsCVE-2021-24850 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insert Pages WordPress plugin before 3.7.0 adds a shortcode that prints out other pages' content and custom fields. It can be used by users with a role as low as Contributor to perform Cross-Site Scripting attacks by storing the payload/s in another post's custom fields.
Product
Insert Pages
Fixed in
3.7.0
What to do
Update Insert Pages to 3.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 15, 2021plugins/wordpress_sso/pages/index.php: ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site ScriptingCVE-2021-41951 · WordPress plugins & themes · reported by MITREMedium 6.1
ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter. If an attacker is able to persuade a victim to visit a crafted URL, malicious JavaScript content may be executed within the context of the victim's browser.
Product
plugins/wordpress_sso/pages/index.php
Fixed in
9.6
What to do
Update plugins/wordpress_sso/pages/index.php to 9.6 or newer.
Full record and what to do →NVD record horizon3.ai horizon3.ai
Nov 15, 2021A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arCVE-2021-41765 · Other software · Montala · reported by MITRECritical 9.8
A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. This allows attackers to uncover the full contents of the ResourceSpace database, including user session cookies. An attacker who gets an admin user session cookie can use the session cookie to execute arbitrary code on the server.
Product
Resourcespace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record svn.resourcespace.com horizon3.ai
Nov 9, 2021A path traversal vulnerability was identified in GitHub Pages builds on GitHub Enterprise Server that could allow an attacker to read system files.CVE-2021-22870 · Other software · GitHub · reported by product-cna@github.comMedium 6.5
A path traversal vulnerability was identified in GitHub Pages builds on GitHub Enterprise Server that could allow an attacker to read system files. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.0.19, 3.1.11, and 3.2.3. This vulnerability was reported via the GitHub Bug Bounty program.
Product
GitHub Enterprise Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.github.com docs.github.com
Nov 8, 2021Simple Download Monitor: Does not escape the "File Thumbnail" post meta before outputting it in some pagesCVE-2021-24693 · WordPress plugins & themes · reported by WPScanCritical 9
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin
Product
Simple Download Monitor
Fixed in
3.9.5
What to do
Update Simple Download Monitor to 3.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Storefront Footer Text: Does not sanitize and escape the "Footer Credit Text" added to pagesCVE-2021-24607 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the "Footer Credit Text" added to pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed.
Product
Storefront Footer Text
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Storefront Footer Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Translate WordPress – Google Language Translator: Does not sanitise and escape some of its settings before outputting it in various pagesCVE-2021-24594 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Translate WordPress – Google Language Translator WordPress plugin before 6.0.12 does not sanitise and escape some of its settings before outputting it in various pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Translate WordPress – Google Language Translator
Fixed in
6.0.12
What to do
Update Translate WordPress – Google Language Translator to 6.0.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 2, 2021When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers to launch pages and execute scripts in IntCVE-2021-38492 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers to launch pages and execute scripts in Internet Explorer in unprivileged mode. *This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 92, Thunderbird < 91.1, Thunderbird < 78.14, Firefox ESR < 78.14, and Firefox ESR < 91.1.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org security.gentoo.org
Nov 1, 2021WP Reactions Lite: Does not properly sanitize inputs within wp-admin pagesCVE-2021-24723 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages, allowing users with sufficient access to inject XSS payloads within /wp-admin/ pages.
Product
WP Reactions Lite
Fixed in
1.3.6
What to do
Update WP Reactions Lite to 1.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021WordPress Contact Forms by Cimatti: Does not sanitise and escape the Form Title before outputting it in some admin pagesCVE-2021-24744 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Contact Forms by Cimatti WordPress plugin before 1.4.12 does not sanitise and escape the Form Title before outputting it in some admin pages. which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Product
WordPress Contact Forms by Cimatti
Fixed in
1.4.12
What to do
Update WordPress Contact Forms by Cimatti to 1.4.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021GamePress: Does not escape the op_edit POST parameter before outputting it back in multiple Game Option pagesCVE-2021-24617 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GamePress WordPress plugin through 1.1.0 does not escape the op_edit POST parameter before outputting it back in multiple Game Option pages, leading to Reflected Cross-Site Scripting issues
Product
GamePress
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update GamePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021Quiz And Survey Master: Does not escape the Quiz Url Slug setting before outputting it in some pagesCVE-2021-24691 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Quiz And Survey Master
Fixed in
7.3.2
What to do
Update Quiz And Survey Master to 7.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021Simple Social Media Share Buttons: Does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used)CVE-2021-24656 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Simple Social Media Share Buttons
Fixed in
3.2.4
What to do
Update Simple Social Media Share Buttons to 3.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 4, 2021A Stored Cross Site Scripting vulnerability via Malicious File Upload exists in multiple pages of IceHrm 30.0.0.OS that allows for arbitrary execution of JavaScCVE-2021-38822 · Other software · Icehrm · reported by MITREMedium 5.4
A Stored Cross Site Scripting vulnerability via Malicious File Upload exists in multiple pages of IceHrm 30.0.0.OS that allows for arbitrary execution of JavaScript commands.
Product
Icehrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record navidkagalwalla.com navidkagalwalla.com
Sep 24, 2021A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site.CVE-2021-22868 · Other software · GitHub · reported by product-cna@github.comMedium 4.3
A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to read files on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.1.8 and was fixed in 3.1.8, 3.0.16, and 2.22.22. This vulnerability was reported via the GitHub Bug Bounty program. This is the result of an incomplete fix for CVE-2021-22867.
Product
GitHub Enterprise Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.github.com docs.github.com
Sep 23, 2021IBM Edge 4.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system.CVE-2020-4941 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Edge 4.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 191941.
Product
Edge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Sep 23, 2021IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system.CVE-2020-4809 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189633.
Product
Edge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Sep 23, 2021IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system.CVE-2020-4805 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189539.
Product
Edge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Sep 23, 2021IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system.CVE-2020-4803 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189535.
Product
Edge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Sep 20, 2021WP Dialog: Does not sanitise and escape some of its settings before outputting them in pagesCVE-2021-24600 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them in pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
WP Dialog
Affected
up to 1.2.5.5
What to do
Affects up to 1.2.5.5. Update WP Dialog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 13, 2021StopBadBots: Did not validate or escape the order and orderby GET parameter in some of its admin dashboard pagesCVE-2021-24727 · WordPress plugins & themes · reported by WPScanHigh 8.8
The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Authenticated SQL Injections
Product
StopBadBots
Fixed in
6.60
What to do
Update StopBadBots to 6.60 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Sep 9, 2021FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/itemsCVE-2021-38723 · Other software · Thedaylightstudio · reported by MITREHigh 8.8
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items
Product
Fuel CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 8, 2021Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory.CVE-2021-28701 · Other software · Xen · reported by security@xen.orgHigh 7.8
Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervisor enforce that no parallel request can result in the addition of a mapping of such a page to a guest. That enforcement was missing, allowing guests to retain access to pages that were freed and perhaps re-used for other purposes. Unfortunately, when XSA-379 was being prepared, this similar issue was not noticed.
Product
xen
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com xenbits.xen.org
Sep 7, 2021better_errors is an open source replacement for the standard Rails error page with more information rich error pages.CVE-2021-39197 · Other software · BetterErrors · reported by GitHubMedium 6.3
better_errors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outside of Rails in any Rack app as Rack middleware. better_errors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with better_errors enabled open to cross-origin attacks. As a developer tool, better_errors documentation strongly recommends addition only to the `development` bundle group, so this vulnerability should only affect development environments. Please ensure that your project limits better_errors to the `development` group (or the non-Rails equivalent). Starting with release 2.8.x, CSRF protection is enforced. It is recommended that you upgrade to the latest release, or minimally to "~> 2.8.3". There are no known workarounds to mitigate the risk of using older releases of better_errors.
Product
better_errors
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 3, 2021A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript (gibbonCourseClCVE-2021-40492 · Other software · Gibbonedu · reported by MITREMedium 6.1
A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript (gibbonCourseClassID, gibbonPersonID, subpage, currentDate, or allStudents to index.php).
Product
Gibbon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gibbonedu.org github.com
Aug 31, 2021IBM OpenPages with Watson 8.1 and 8.2 could allow an authenticated user to upload a file that could execute arbitrary code on the system.CVE-2021-29907 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM OpenPages with Watson 8.1 and 8.2 could allow an authenticated user to upload a file that could execute arbitrary code on the system. IBM X-Force ID: 207633.
Product
OpenPages with Watson
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 31, 2021In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings.CVE-2021-34559 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 5.4
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings.
Product
WHA-GW-F2D2-0-AS- Z2-ETH
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Aug 31, 2021KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable CVE-2021-36356 · Other software · Kramerav · reported by MITRECritical 9.8
KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI). NOTE: this issue exists because of an incomplete fix for CVE-2019-17124.
Product
Viaware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com write-up.github.io
Aug 30, 2021The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSorCVE-2021-38343 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSort`, and `npCategoryFilter` `admin_post` actions.
Product
Nested Pages
Affected
up to 3.1.15
What to do
Affects up to 3.1.15. Update Nested Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 30, 2021The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which alCVE-2021-38342 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which allowed attackers to trash or permanently purge arbitrary posts as well as changing their status, reassigning their ownership, and editing other metadata.
Product
Nested Pages
Affected
up to 3.1.15
What to do
Affects up to 3.1.15. Update Nested Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 30, 2021Sitewide Notice WP: Does not sanitise some of its settings before outputting them in frontend pagesCVE-2021-24592 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Sitewide Notice WP
Fixed in
2.3
What to do
Update Sitewide Notice WP to 2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.