Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,591 results · page 169 of 392
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Get video file function) does not filter the specific parameter.CVE-2021-28208 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Get video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Get Help file function) does not filter the specific parameter.CVE-2021-28207 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Get Help file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Record video file function) does not filter the specific parameter.CVE-2021-28206 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Record video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Delete SOL video file function) does not filter the specific parameter.CVE-2021-28205 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Delete SOL video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not filter the specific parameter.CVE-2021-28204 · Network & remote access · ASUS · reported by twcert@cert.org.twHigh 7.2
The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter.CVE-2021-28203 · Network & remote access · ASUS · reported by twcert@cert.org.twHigh 7.2
The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The Service configuration-2 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflCVE-2021-28202 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The Service configuration-2 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The Service configuration-1 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflCVE-2021-28201 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The Service configuration-1 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The CD media configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overfloCVE-2021-28200 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The CD media configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users, resultCVE-2021-28199 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The Firmware protocol configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a BuffeCVE-2021-28198 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The Firmware protocol configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a BufferCVE-2021-28197 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Generate SSL certificate function) does not verify the string length entered by users, resultiCVE-2021-28196 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Generate SSL certificate function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow CVE-2021-28195 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Remote image configuration setting) does not verify the string length entered by users, resultCVE-2021-28194 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Remote image configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vuCVE-2021-28193 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Remote video storage function) does not verify the string length entered by users, resulting iCVE-2021-28192 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Remote video storage function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The Firmware update function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulneCVE-2021-28191 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The Firmware update function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Generate new certificate function) does not verify the string length entered by users, resultiCVE-2021-28190 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Generate new certificate function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vuCVE-2021-28189 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users, resultCVE-2021-28188 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Generate new SSL certificate) does not verify the string length entered by users, resulting inCVE-2021-28187 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Generate new SSL certificate) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-2 acquisition) does not verify the string length entered by users, resulCVE-2021-28186 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-2 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-1 acquisition) does not verify the string length entered by users, resulCVE-2021-28185 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-1 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a BufferCVE-2021-28184 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Web License configuration setting) does not verify the string length entered by users, resultiCVE-2021-28183 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Web License configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The Web Service configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overCVE-2021-28182 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The Web Service configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Remote video configuration setting) does not verify the string length entered by users, resultCVE-2021-28181 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Remote video configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Audit log configuration setting) does not verify the string length entered by users, resultingCVE-2021-28180 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Audit log configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Media support configuration setting) does not verify the string length entered by users, resulCVE-2021-28179 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Media support configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The UEFI configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vuCVE-2021-28178 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The UEFI configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The LDAP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vuCVE-2021-28177 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The LDAP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The DNS configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulCVE-2021-28176 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The DNS configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow CVE-2021-28175 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2021JH 404 Logger: Doesn't sanitise the referer and path of 404 pagesCVE-2021-24176 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.
- Product
- JH 404 Logger
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update JH 404 Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordganofins.comwpscan.com
Apr 5, 2021Database Backups: Does not have CSRF checksCVE-2021-24174 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the database, change the plugin's settings and delete backups.
- Product
- Database Backups
- Affected
- up to 1.2.2.6
- What to do
- Affects up to 1.2.2.6. Update Database Backups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 5, 2021VM Backups: Does not have CSRF checksCVE-2021-24173 · WordPress plugins & themes · reported by WPScanMedium 6.1
The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as update the plugin's options, leading to a Stored Cross-Site Scripting issue.
- Product
- VM Backups
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update VM Backups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 5, 2021VM Backups: Does not have CSRF checksCVE-2021-24172 · WordPress plugins & themes · reported by WPScanMedium 4.3
The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the DB, plugins, and current .
- Product
- VM Backups
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update VM Backups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 2, 2021docsify 4.12.1 is affected by Cross Site Scripting (XSS) because the search component does not appropriately encode Code Blocks and mishandles the " character.CVE-2021-30074 · Other software · Docsifyjs · reported by MITREMedium 6.1
docsify 4.12.1 is affected by Cross Site Scripting (XSS) because the search component does not appropriately encode Code Blocks and mishandles the " character.
- Product
- Docsify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2021The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in soCVE-2021-29662 · Other software · Data\ · reported by MITREHigh 7.5
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
- Product
- \
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.urth.orggithub.com
Mar 31, 2021On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ does not make use of TCVE-2021-23005 · Network & remote access · F5 · reported by f5sirt@f5.comCritical 9.1
On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ does not make use of Transport Layer Security (TLS) with the Corosync protocol. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
- Product
- Big-iq Centralized Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Mar 31, 2021On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport serviceCVE-2021-22997 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
- Product
- Big-iq Centralized Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Mar 31, 2021On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of autCVE-2021-22995 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
- Product
- Big-iq Centralized Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Mar 30, 2021Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a stored cross-site scriptiCVE-2021-21635 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
- Product
- Jenkins REST List Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 30, 2021Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knCVE-2021-21631 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages.
- Product
- Jenkins Cloud Statistics Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 30, 2021Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS) CVE-2021-21630 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
- Product
- Jenkins Extra Columns Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 30, 2021Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerabCVE-2021-21628 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
- Product
- Jenkins Build With Parameters Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 29, 2021In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 rtsold(8) does notCVE-2020-25577 · Other software · Freebsd · reported by secteam@freebsd.orgCritical 9.8
In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 rtsold(8) does not verify that the RDNSS option does not extend past the end of the received packet before processing its contents. While the kernel currently ignores such malformed packets, it passes them to userspace programs. Any programs expecting the kernel to do validation may be vulnerable to an overflow.
- Product
- Freebsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.freebsd.orgsecurity.netapp.com
Mar 25, 2021SSH server configuration file does not implement some best practices.CVE-2021-27450 · Other software · GE · reported by ics-cert@hq.dhs.govHigh 7.8
SSH server configuration file does not implement some best practices. This could lead to a weakening of the SSH protocol strength, which could lead to additional misconfiguration or be leveraged as part of a larger attack on the MU320E (all firmware versions prior to v04A00.1).
- Product
- Mu320e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Mar 24, 2021An outbound read/write vulnerability exists in XPLATFORM that does not check offset input ranges, allowing out-of-range data to be read.CVE-2020-7853 · Other software · Tobesoft · reported by vuln@krcert.or.krMedium 5.5
An outbound read/write vulnerability exists in XPLATFORM that does not check offset input ranges, allowing out-of-range data to be read. An attacker can exploit arbitrary code execution.
- Product
- Xplatform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.