Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,147 results · page 18 of 23

May 12, 2021Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Website SEO Keywords" field on thCVE-2020-18165 · Other software · Laobancms · reported by MITREMedium 4.8
Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Website SEO Keywords" field on the page "admin/info.php?shuyu".
Product
Laobancms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 11, 2021Cross Site Request Forgery (CSRF) Vulnerability in ForestBlog latest version via the website Management background, which could let a remote malicious gain privCVE-2020-18964 · Other software · Forestblog Project · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) Vulnerability in ForestBlog latest version via the website Management background, which could let a remote malicious gain privileges.
Product
Forestblog
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 11, 2021In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific malicious website which could contain malware or CVE-2021-27612 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific malicious website which could contain malware or might lead to phishing attacks to steal credentials of the victim.
Product
SAP GUI for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter.CVE-2021-24206 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter.CVE-2021-24205 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter.CVE-2021-24204 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter.CVE-2021-24203 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘text’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ parameter.CVE-2021-24202 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘title’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter.CVE-2021-24201 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 2, 2021"Clear History and Website Data" did not clear the history.CVE-2020-29623 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
"Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. A user may be unable to fully delete browsing history.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Mar 31, 2021An Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to redirect users to untrusted websites via the _t_redirect parameter in a craCVE-2020-24550 · Other software · Episerver · reported by MITREMedium 6.1
An Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to redirect users to untrusted websites via the _t_redirect parameter in a crafted URL, such as a /find_v2/_click URL.
Product
Find
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.nettitude.com labs.nettitude.com
Mar 31, 2021Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=save_settings when uploading a malicious file using CVE-2020-28173 · Other software · Simple College Project · reported by MITREHigh 7.2
Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=save_settings when uploading a malicious file using the image upload functionality, which is stored in /alumni/admin/assets/uploads/.
Product
Simple College
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net github.com
Mar 31, 2021A SQL injection vulnerability in Simple College Website 1.0 allows remote unauthenticated attackers to bypass the admin authentication mechanism in college_websCVE-2020-28172 · Other software · Simple College Project · reported by MITRECritical 9.8
A SQL injection vulnerability in Simple College Website 1.0 allows remote unauthenticated attackers to bypass the admin authentication mechanism in college_website/admin/ajax.php?action=login, thus gaining access to the website administrative panel.
Product
Simple College
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net github.com
Mar 22, 2021A malicious website could execute code remotely in Sophos Connect Client before version 2.1.CVE-2021-25265 · Network & remote access · Sophos · reported by security-alert@sophos.comHigh 8.8
A malicious website could execute code remotely in Sophos Connect Client before version 2.1.
Product
Sophos Connect Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.sophos.com community.sophos.com
Mar 15, 2021The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).CVE-2020-29553 · Other software · Getgrav · reported by MITREHigh 8.8
The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).
Product
Grav CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.bssi.fr blog.bssi.fr
Feb 11, 2021Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic.CVE-2020-25493 · Other software · Oclean · reported by MITREHigh 7.5
Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payload is encrypted using XOR with a hardcoded key, which allows for the possibility to decode the traffic.
Product
Oclean
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com play.google.com
Jan 26, 2021Flarum is an open source discussion platform for websites.CVE-2021-21283 · Other software · flarum · reported by GitHubMedium 5.4
Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to be injected as HTML on the discussion list. The issue was discovered following an internal audit. Any HTML would be injected through the m.trust() helper. This resulted in an HTML injection where <script> tags would not be executed. However it was possible to run javascript from other HTML attributes, enabling a cross-site scripting (XSS) attack to be performed. Since the exploit only happens with the first post of a pinned discussion, an attacker would need the ability to pin their own discussion, or be able to edit a discussion that was previously pinned. On forums where all pinned posts are authored by your staff, you can be relatively certain the vulnerability has not been exploited. Forums where some user-created discussions were pinned can look at the first post edit date to find whether the vulnerability might have been exploited. Because Flarum doesn't store the post content histor
Product
sticky
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.flarum.org github.com
Jan 26, 2021Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unCVE-2021-22871 · Other software · Revive-adserver · reported by support@hackerone.comMedium 4.8
Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting (XSS) vulnerability.
Product
Revive Adserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 7, 2021When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the uCVE-2020-26979 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the user before navigation occurred to the desired, entered address. To construct a convincing spoof the attacker would have had to guess what the user was typing, perhaps by suggesting it. This vulnerability affects Firefox < 84.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jan 7, 2021By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab while the URL bar displayed the original dCVE-2020-26977 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab while the URL bar displayed the original domain. *Note: This issue only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 84.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jan 6, 2021The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads.CVE-2020-36171 · WordPress plugins & themes · reported by MITREMedium 6.1
The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads.
Product
Elementor Website Builder
Fixed in
3.0.14
What to do
Update Elementor Website Builder to 3.0.14 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Dec 31, 2020Seo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter, as demonstrated by the seo/seopanel/websites.php URI.CVE-2020-35930 · Other software · Seopanel · reported by MITREMedium 5.4
Seo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter, as demonstrated by the seo/seopanel/websites.php URI.
Product
SEO Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 18, 2020Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpagesCVE-2020-25901 · Other software · Spiceworks · reported by MITREMedium 6.1
Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages.
Product
Spiceworks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com frontend.spiceworks.com
Dec 18, 2020The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malicious script due to iCVE-2020-27340 · Email & office · Mitel · reported by MITREMedium 6.1
The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malicious script due to insufficient access control.
Product
Micollab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mitel.com mitel.com
Dec 8, 2020Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password.CVE-2020-26965 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their password and used that feature, the type of the password field was changed, resulting in a keyboard layout change and the possibility for the software keyboard to remember the typed password. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Nov 16, 2020In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows aCVE-2020-26224 · Websites & servers · PrestaShop · reported by GitHubHigh 7.5
In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.
Product
PrestaShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2020Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed (such as Payment Settings)CVE-2020-22273 · Other software · Creativeitem · reported by MITREMedium 6.5
Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed (such as Payment Settings)
Product
Neoflex Video Subscription System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.ikiu.ac.ir uploadboy.com
Oct 1, 2020By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original siCVE-2020-15677 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Oct 1, 2020WebsiteBaker 2.12.2 allows SQL Injection via parameter 'display_name' in /websitebaker/admin/preferences/save.php.CVE-2020-25990 · Other software · Websitebaker · reported by MITRECritical 9.8
WebsiteBaker 2.12.2 allows SQL Injection via parameter 'display_name' in /websitebaker/admin/preferences/save.php. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Product
Websitebaker
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record websitebaker.org exploit-db.com
Sep 18, 2020UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via a malicious App created by the thirdCVE-2020-5629 · Other software · UNIQLO CO., LTD. · reported by vultures@jpcert.or.jpMedium 6.5
UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via a malicious App created by the third party. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack.
Product
UNIQLO App for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvn.jp
Sep 18, 2020UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App.CVE-2020-5628 · Other software · UNIQLO CO., LTD. · reported by vultures@jpcert.or.jpMedium 6.5
UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack.
Product
UNIQLO App for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvn.jp
Sep 9, 2020Yodobashi App for Android versions 1.8.7 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App.CVE-2020-5627 · Other software · YODOBASHI CAMERA CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Yodobashi App for Android versions 1.8.7 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.
Product
Yodobashi App for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp tenable.com
Aug 21, 2020The management website of the Verint S5120FD Verint_FW_0_42 unit features a CGI endpoint ('ipfilter.cgi') that allows the user to manage network filtering on thCVE-2020-24057 · Other software · Verint · reported by MITREHigh 8.8
The management website of the Verint S5120FD Verint_FW_0_42 unit features a CGI endpoint ('ipfilter.cgi') that allows the user to manage network filtering on the unit. This endpoint is vulnerable to a command injection. An authenticated attacker can leverage this issue to execute arbitrary commands as 'root'.
Product
S5120fd Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ioac.tv ioactive.com
Aug 10, 2020When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are nCVE-2020-15654 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
Product
Firefox ESR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org bugzilla.mozilla.org
Aug 10, 2020Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header.CVE-2020-15648 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird < 78 and Firefox < 78.0.2.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jul 2, 2020In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a successfCVE-2020-4061 · Other software · October CMS · reported by GitHubLow 3.7
In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack. This has been fixed in 1.0.467.
Product
October
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 24, 2020In django-basic-auth-ip-whitelist before 0.3.4, a potential timing attack exists on websites where the basic authentication is used or configured, i.e.CVE-2020-4071 · Other software · tm-kn · reported by GitHubLow 2.2
In django-basic-auth-ip-whitelist before 0.3.4, a potential timing attack exists on websites where the basic authentication is used or configured, i.e. BASIC_AUTH_LOGIN and BASIC_AUTH_PASSWORD is set. Currently the string comparison between configured credentials and the ones provided by users is performed through a character-by-character string comparison. This enables a possibility that attacker may time the time it takes the server to validate different usernames and password, and use this knowledge to work out the valid credentials. This attack is understood not to be realistic over the Internet. However, it may be achieved from within local networks where the website is hosted, e.g. from inside a data centre where a website's server is located. Sites protected by IP address whitelisting only are unaffected by this vulnerability. This vulnerability has been fixed on version 0.3.4 of django-basic-auth-ip-whitelist. Update to version 0.3.4 as soon as possible and change basic authentication username and password configured on a Django project using this package. A workaround without upgrading to version 0.3.4 is to stop using basic authentication and use the IP whitelisting compo
Product
django-basic-auth-ip-whitelist
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com groups.google.com
Jun 12, 2020The Branding Module in Viki Vera 4.9.1.26180 allows an authenticated user to change the logo on the website.CVE-2019-15123 · Other software · Vikisolutions · reported by MITREHigh 7.2
The Branding Module in Viki Vera 4.9.1.26180 allows an authenticated user to change the logo on the website. An attacker could use this to upload a malicious .aspx file and gain Remote Code Execution on the site.
Product
Vera
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vikisolutions.com gosecure.net
May 26, 2020The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website.CVE-2020-12392 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.5
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
Product
Firefox ESR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org security.gentoo.org
May 26, 2020The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website.CVE-2020-12393 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.8
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
Product
Firefox ESR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
May 13, 2020Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow.CVE-2020-5409 · Other software · Pivotal · reported by security@pivotal.ioMedium 6.1
Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user's access token in Concourse. (This issue is similar to, but distinct from, CVE-2018-15798.)
Product
Concourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tanzu.vmware.com tanzu.vmware.com
May 13, 2020A cross-site scripting (XSS) vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise CVE-2020-2005 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comHigh 7.1
A cross-site scripting (XSS) vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise the user's active session. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7; All versions of PAN-OS 8.0.
Product
PAN-OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.paloaltonetworks.com security.paloaltonetworks.com
Apr 16, 2020A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites.CVE-2020-11814 · Other software · Qdpm · reported by MITREMedium 5.4
A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites.
Product
Qdpm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fatihhcelik.blogspot.com fatihhcelik.blogspot.com
Apr 1, 2020The issue was addressed by clearing website permission prompts after navigation.CVE-2020-9781 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
The issue was addressed by clearing website permission prompts after navigation. This issue is fixed in iOS 13.4 and iPadOS 13.4. A user may grant website permissions to a site they didn't intend to.
Product
iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Mar 25, 2020The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website.CVE-2020-6811 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org usn.ubuntu.com
Mar 25, 2020After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification that indicates the browser is in fullscreeCVE-2020-6810 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification that indicates the browser is in fullscreen mode. Combined with spoofing the browser chrome, this could have led to confusing the user about the current origin of the page and credential theft or other attacks. This vulnerability affects Firefox < 74.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Mar 2, 2020The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability, allowing remote authenticated attacCVE-2018-14384 · Other software · Seopanel · reported by MITREMedium 4.8
The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability, allowing remote authenticated attackers to inject arbitrary web script or HTML via the websites.php name parameter.
Product
SEO Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wizlynxgroup.com wizlynxgroup.com
Feb 24, 2020In MIELE XGW 3000 ZigBee Gateway before 2.4.0, a malicious website visited by an authenticated admin user or a malicious mail is allowed to make arbitrary changCVE-2019-20480 · Other software · Miele · reported by MITREHigh 8.8
In MIELE XGW 3000 ZigBee Gateway before 2.4.0, a malicious website visited by an authenticated admin user or a malicious mail is allowed to make arbitrary changes in the "admin panel" because there is no CSRF protection.
Product
XGW 3000 Zigbee Gateway Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Feb 3, 2020Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URCVE-2013-2621 · Other software · Telaen Project · reported by MITREMedium 6.1
Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL.
Product
Telaen
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Jan 21, 2020websitebaker prior to and including 2.8.1 has an authentication error in backup module.CVE-2011-4322 · Other software · websitebaker · reported by Red HatHigh 7.5
websitebaker prior to and including 2.8.1 has an authentication error in backup module.
Product
websitebaker
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.