Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

406new WordPress flaws this week

399,168entries in the database

19,591 results · page 187 of 392

Aug 6, 2019cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192).CVE-2016-10790 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).CVE-2017-18480 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).CVE-2017-18476 · Websites & servers · Cpanel · reported by MITREHigh 7.5
Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).CVE-2016-10772 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).CVE-2017-18466 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).CVE-2017-18465 · Websites & servers · Cpanel · reported by MITREMedium 4.4
cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).CVE-2017-18461 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).CVE-2017-18453 · Websites & servers · Cpanel · reported by MITREMedium 4.9
cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).CVE-2017-18445 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941).CVE-2017-18431 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).CVE-2017-18407 · Websites & servers · Cpanel · reported by MITREMedium 4.8
cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).CVE-2017-18397 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 does not block a username of ssl (SEC-328).CVE-2017-18395 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 68.0.15 does not block a username of ssl (SEC-328).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327).CVE-2017-18394 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).CVE-2017-18393 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315).CVE-2017-18388 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly.CVE-2019-9140 · Other software · SPC CLOUD · reported by vuln@krcert.or.krHigh 8.1
When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a specific malicious URL.
Product
Happypoint mobile app
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record boho.or.kr boho.or.kr
Aug 1, 2019cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).CVE-2018-20938 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321).CVE-2018-20937 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).CVE-2016-10831 · Websites & servers · Cpanel · reported by MITREHigh 7.2
cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts (SEC-411).CVE-2018-20934 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts (SEC-411).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432).CVE-2018-20907 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).CVE-2015-9291 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates.CVE-2019-3890 · Other software · The Gnome Project · reported by Red HatHigh 8.1
It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.
Product
evolution-ews
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Jul 30, 2019cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).CVE-2019-14411 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).CVE-2019-14391 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 29, 2019One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security (HSTS), which may allow man-in-the-middle (MITM) attacks.CVE-2019-13498 · Other software · Oneidentity · reported by MITREHigh 7.4
One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security (HSTS), which may allow man-in-the-middle (MITM) attacks. This issue is fixed in version 8.1.4.
Product
Cloud Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com support.oneidentity.com
Jul 29, 2019SmokeDetector intentionally does automatic deployments of updated copies of SmokeDetector without server operator authority.CVE-2019-1020011 · Other software · SmokeDetector · reported by josh@bress.netHigh 7.2
SmokeDetector intentionally does automatic deployments of updated copies of SmokeDetector without server operator authority.
Product
SmokeDetector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 26, 2019In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and CVE-2019-14283 · Computers, phones & browsers · Linux · reported by MITREMedium 6.8
In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Jul 25, 2019Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing.CVE-2019-13483 · Email & office · Auth0 · reported by MITREHigh 7.3
Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms.
Product
Passport-sharepoint
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record auth0.com auth0.com
Jul 25, 2019IBM Cloud Private 3.1.0, 3.1.1, and 3.1.2 does not invalidate session after logout which could allow a local user to impersonate another user on the system.CVE-2019-4439 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Cloud Private 3.1.0, 3.1.1, and 3.1.2 does not invalidate session after logout which could allow a local user to impersonate another user on the system. IBM X-Force ID: 162949.
Product
Cloud Private
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Jul 23, 2019Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local priCVE-2019-12162 · Other software · Upwork · reported by MITREHigh 7.8
Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the original update.exe.
Product
Time Tracker
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.upwork.com vuldb.com
Jul 23, 2019When an inner window is reused, it does not consider the use of document.domain for cross-origin protections.CVE-2019-11711 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did not use document.domain to relax their origin security. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Product
Firefox ESR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Jul 22, 2019The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutable but are actually CVE-2019-13097 · Other software · CAT Runner\ · reported by MITREHigh 7.5
The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. Attackers can manipulate users' score parameters exchanged between client and server.
Product
Decorate Home Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pastebin.com youtube.com
Jul 22, 2019The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making itCVE-2019-9959 · Other software · Freedesktop · reported by MITREMedium 6.5
The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo.
Product
Poppler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com access.redhat.com
Jul 19, 2019Directus 7 API before 2.3.0 does not validate uploaded files.CVE-2019-13984 · Other software · Rangerstudio · reported by MITREHigh 8.8
Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, accessible by unauthenticated users, as demonstrated by the EICAR Anti-Virus Test File.
Product
Directus 7 API
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 19, 2019interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview.CVE-2019-13982 · Other software · Rangerstudio · reported by MITREMedium 5.3
interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview.
Product
Directus 7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 18, 2019lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly valiCVE-2019-13962 · Other software · Videolan · reported by MITRECritical 9.8
lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
Product
VLC Media Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.videolan.org lists.opensuse.org
Jul 18, 2019In Bento4 1.5.1-627, AP4_DataBuffer::SetDataSize does not handle reallocation failures, leading to a memory copy into a NULL pointer.CVE-2019-13959 · Other software · Axiosys · reported by MITREMedium 6.5
In Bento4 1.5.1-627, AP4_DataBuffer::SetDataSize does not handle reallocation failures, leading to a memory copy into a NULL pointer. This is different from CVE-2018-20186.
Product
Bento4
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 18, 2019Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints.CVE-2019-3794 · Other software · Cloud Foundry · reported by security_alert@emc.comMedium 5.4
Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites.
Product
UAA Release (OSS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cloudfoundry.org cloudfoundry.org
Jul 18, 2019SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properly block XSS payloads, as demonstrated by CVE-2019-13948 · Other software · Syguestbook A5 Project · reported by MITREMedium 5.4
SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properly block XSS payloads, as demonstrated by a crafted use of the onerror attribute of an IMG element.
Product
Syguestbook A5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fragrant10.github.io github.com
Jul 17, 2019In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provideCVE-2019-11772 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgCritical 9.8
In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Java code run under a SecurityManager.
Product
Eclipse OpenJ9
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jul 17, 2019Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service.CVE-2019-13453 · Other software · Zipios Project · reported by MITREMedium 6.5
Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().
Product
Zipios
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com lists.debian.org
Jul 15, 2019A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected ExchaCVE-2019-1137 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.
Product
Microsoft Exchange Server 2016
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Jul 15, 2019A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected ShaCVE-2019-1134 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.
Product
Microsoft SharePoint Enterprise Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Jul 15, 2019A spoofing vulnerability exists when Microsoft Office Javascript does not check the validity of the web page making a request to Office documents.An attacker whCVE-2019-1109 · Email & office · Microsoft · reported by secure@microsoft.comCritical 9.1
A spoofing vulnerability exists when Microsoft Office Javascript does not check the validity of the web page making a request to Office documents.An attacker who successfully exploited this vulnerability could read or write information in Office documents.The security update addresses the vulnerability by correcting the way that Microsoft Office Javascript verifies trusted web pages., aka 'Microsoft Office Spoofing Vulnerability'.
Product
Microsoft Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Jul 15, 2019A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-CVE-2019-1076 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'.
Product
Team Foundation Server 2018
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Jul 13, 2019http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into senCVE-2018-20852 · Other software · Python · reported by MITREMedium 4.3
http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.
Product
Python
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Jul 10, 2019In Hunesion i-oneNet version 3.0.7 ~ 3.0.53 and 4.0.4 ~ 4.0.16, the specific upload web module doesn't verify the file extension and type, and an attacker can uCVE-2019-12803 · Other software · Hunesion · reported by vuln@krcert.or.krCritical 9.8
In Hunesion i-oneNet version 3.0.7 ~ 3.0.53 and 4.0.4 ~ 4.0.16, the specific upload web module doesn't verify the file extension and type, and an attacker can upload a webshell. After the webshell upload, an attacker can use the webshell to perform remote code exection such as running a system command.
Product
i-oneNet
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record boho.or.kr boho.or.kr
Jul 10, 2019SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.CVE-2019-0329 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Product
SAP Information Steward
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com launchpad.support.sap.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.