Updated 2 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

420new WordPress flaws this week

399,200entries in the database

19,603 results · page 199 of 393

Dec 30, 2017Red Lion HMI panels allow remote attackers to cause a denial of service (software exception) via an HTTP POST request to a long URI that does not exist, as demoCVE-2017-14855 · Other software · Redlion · reported by MITREHigh 8.6
Red Lion HMI panels allow remote attackers to cause a denial of service (software exception) via an HTTP POST request to a long URI that does not exist, as demonstrated by version HMI 2.41 PLC 2.42.
Product
HMI Panel Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record misteralfa-hack.blogspot.cl misteralfa-hack.blogspot.cl
Dec 29, 2017The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter.CVE-2014-0121 · Other software · Hawt · reported by Red HatCritical 9.8
The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter.
Product
Hawtio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com github.com
Dec 29, 2017The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection CVE-2014-4914 · Other software · Zend · reported by Red HatCritical 9.8
The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.
Product
Zend Framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record framework.zend.com jvn.jp
Dec 27, 2017The File_read_line function in epan/wslua/wslua_file.c in Wireshark through 2.2.11 does not properly strip '\n' characters, which allows remote attackers to cauCVE-2017-17935 · Other software · Wireshark · reported by MITREHigh 7.5
The File_read_line function in epan/wslua/wslua_file.c in Wireshark through 2.2.11 does not properly strip '\n' characters, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet that triggers the attempted processing of an empty line.
Product
Wireshark
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugs.wireshark.org
Dec 27, 2017Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, which allows remote attackers to obtain sensitive information.CVE-2017-17898 · Other software · Dolibarr · reported by MITREHigh 7.5
Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, which allows remote attackers to obtain sensitive information.
Product
Dolibarr Erp/crm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 27, 2017kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, which allows local userCVE-2017-17863 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Dec 20, 2017The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowinCVE-2017-17806 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org lists.opensuse.org
Dec 20, 2017The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALCVE-2017-17805 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org lists.opensuse.org
Dec 20, 2017IBM Security Guardium 10.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability.CVE-2017-1270 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM Security Guardium 10.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 124745.
Product
Security Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com exchange.xforce.ibmcloud.com
Dec 19, 2017SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which makeCVE-2017-17763 · Other software · Liveqos · reported by MITREHigh 7.5
SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which makes it easier for remote attackers to send crafted files, as demonstrated by APK injection.
Product
Superbeam
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record thinktanksec.github.io thinktanksec.github.io
Dec 19, 2017The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly sanitize user input when constructing a shell command, which allowCVE-2017-15049 · Other software · Zoom · reported by MITREHigh 8.8
The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly sanitize user input when constructing a shell command, which allows remote attackers to execute arbitrary code by leveraging the zoommtg:// scheme handler.
Product
Zoom
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Dec 18, 2017CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.CVE-2017-17735 · Other software · Cmsmadesimple · reported by MITRECritical 9.8
CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.
Product
CMS Made Simple
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.cmsmadesimple.org cmsmadesimple.org
Dec 18, 2017CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions.CVE-2017-17734 · Other software · Cmsmadesimple · reported by MITRECritical 9.8
CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions.
Product
CMS Made Simple
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.cmsmadesimple.org cmsmadesimple.org
Dec 17, 2017GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcemenCVE-2017-17716 · Websites & servers · Gitlab · reported by MITREMedium 5.9
GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlab_omniauth-ldap gem.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Dec 15, 2017PCAUSA Rawether framework does not properly validate BPF data, allowing a crafted malicious BPF program to perform operations on memory outside of its typical bCVE-2017-3196 · Other software · Printing Communications Assoc., Inc. (PCAUSA) · reported by cret@cert.orgHigh 7.8
PCAUSA Rawether framework does not properly validate BPF data, allowing a crafted malicious BPF program to perform operations on memory outside of its typical bounds on the driver's receipt of network packets. Local attackers can exploit this issue to execute arbitrary code with SYSTEM privileges.
Product
ASUS PCE-AC56 WLAN Card Utilities
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.rewolf.pl securityfocus.com
Dec 15, 2017Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remove feedback.CVE-2017-17693 · Other software · Techno - Portfolio Management Panel Project · reported by MITREMedium 4.3
Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remove feedback.
Product
Techno - Portfolio Management Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 14, 2017lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow reCVE-2017-17535 · Other software · Gjots2 Project · reported by MITREHigh 8.8
lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Gjots2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attCVE-2017-17534 · Other software · Mensis Project · reported by MITREHigh 8.8
uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17521.
Product
Mensis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackCVE-2017-17533 · Other software · Tkabber Project · reported by MITREHigh 8.8
default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has indicated that the attack cannot occur because of the argument-parsing behavior of the Tcl exec function
Product
Tkabber
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which mighCVE-2017-17532 · Other software · Kiwi Project · reported by MITREHigh 8.8
examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Kiwi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attCVE-2017-17531 · Other software · GNU · reported by MITREHigh 8.8
gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Global
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security.gentoo.org
Dec 14, 2017common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote aCVE-2017-17530 · Other software · Geomview · reported by MITREHigh 8.8
common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: this is disputed by a third party because no untrusted input can be used for the injection
Product
Geomview
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.gentoo.org security-tracker.debian.org
Dec 14, 2017af/util/xp/ut_go_file.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BROWSER environment variable, which might aCVE-2017-17529 · Other software · Abisource · reported by MITREHigh 8.8
af/util/xp/ut_go_file.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Abiword
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, whiCVE-2017-17528 · Other software · Scummvm · reported by MITREHigh 8.8
backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Scummvm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017delphi_gui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the BROWSER environment variable, which migCVE-2017-17527 · Other software · Pasdoc Project · reported by MITREHigh 8.8
delphi_gui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer has indicated that the code referencing the BROWSER environment variable is never used
Product
Pasdoc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017Input.cc in Bernard Parisse Giac 1.2.3.57 does not validate strings before launching the program specified by the BROWSER environment variable, which might alloCVE-2017-17526 · Other software · Giac Project · reported by MITREHigh 8.8
Input.cc in Bernard Parisse Giac 1.2.3.57 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Giac
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by the BROWSER environment variable, which miCVE-2017-17525 · Other software · Xtuple · reported by MITREHigh 8.8
guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Postbooks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017library/www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allCVE-2017-17524 · Other software · Swi-prolog · reported by MITREHigh 8.8
library/www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Swi-prolog
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might alloCVE-2017-17522 · Other software · Python · reported by MITREHigh 8.8
Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting
Product
Python
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugs.python.org
Dec 14, 2017uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow rCVE-2017-17521 · Other software · Fontforge · reported by MITREHigh 8.8
uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534.
Product
Fontforge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remoteCVE-2017-17520 · Other software · debian · reported by MITREHigh 8.8
tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has reported that this is intentional behavior, because the documentation states "url_handler.pl was designed to work together with tin which only issues shell escaped absolute URLs.
Product
tin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017batteriesConfig.mlp in OCaml Batteries Included (aka ocaml-batteries) 2.6 does not validate strings before launching the program specified by the BROWSER enviroCVE-2017-17519 · Other software · Ocaml Batteries Project · reported by MITREHigh 8.8
batteriesConfig.mlp in OCaml Batteries Included (aka ocaml-batteries) 2.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Ocaml Batteries
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017swt/motif/browser.c in White_dune (aka whitedune) 0.30.10 does not validate strings before launching the program specified by the BROWSER environment variable, CVE-2017-17518 · Other software · White Dune Project · reported by MITREHigh 8.8
swt/motif/browser.c in White_dune (aka whitedune) 0.30.10 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: This issue is being disputed as not being a vulnerability because “the current version of white_dune (1.369 at https://wdune.ourproject.org/) do not use a "BROWSER environment variable". Instead, the "browser" variable is read from the $HOME/.dunerc file (or from the M$Windows registry). It is configurable in the "options" menu. The default is chosen in the ./configure script, which tests various programs, first tested is "xdg-open".
Product
White Dune
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allowCVE-2017-17517 · Other software · Sylpheed Project · reported by MITREHigh 8.8
libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Sylpheed
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by the BROWSER environmentCVE-2017-17516 · Other software · Reddit Terminal Viewer Project · reported by MITREHigh 8.8
scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Reddit Terminal Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote aCVE-2017-17515 · Other software · Ecmwf · reported by MITREHigh 8.8
etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has indicated that the code to access this environment variable is not enabled in the shipped product
Product
Metview
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers tCVE-2017-17514 · Other software · debian · reported by MITREHigh 8.8
boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that this product does not use the BROWSER environment variable
Product
debian_linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com security-tracker.debian.org
Dec 14, 2017TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackeCVE-2017-17513 · Other software · TUG · reported by MITREHigh 8.8
TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to linked_scripts/context/stubs/unix/mtxrun, texmf-dist/scripts/context/stubs/mswin/mtxrun.lua, and texmf-dist/tex/luatex/lualibs/lualibs-os.lua.
Product
TEX Live
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conCVE-2017-17511 · Other software · Kildclient · reported by MITREHigh 8.8
KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to prefs.c and worldgui.c.
Product
Kildclient
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org security-tracker.debian.org
Dec 13, 2017In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments.CVE-2017-17665 · Other software · Octopus · reported by MITREHigh 8.8
In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass because the set of environments to which a machine is scoped may include environments in which the user lacks access.
Product
Octopus Deploy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 12, 2017The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum nCVE-2017-17558 · Computers, phones & browsers · Linux · reported by MITREMedium 6.6
The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org openwall.com
Dec 12, 2017SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, and 4.30, does not perform authentication checks for functionalities that reqCVE-2017-16684 · Network & remote access · SAP · reported by cna@sap.comCritical 9.8
SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, and 4.30, does not perform authentication checks for functionalities that require user identity.
Product
SAP Business Intelligence Promotion Management Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com blogs.sap.com
Dec 11, 2017The console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x does not set the secure flag for the JSESSIONID cookie in an HTTPS session, which makes it easier foCVE-2015-8470 · Other software · Puppet · reported by MITREMedium 6.5
The console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x does not set the secure flag for the JSESSIONID cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.
Product
Puppet Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record puppet.com puppet.com
Dec 11, 2017The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain seCVE-2014-3250 · Other software · Puppet · reported by MITREMedium 6.5
The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4.
Product
Puppet
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com puppet.com
Dec 11, 2017Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary cCVE-2017-17536 · Other software · Phacility · reported by MITREHigh 8.8
Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary code by using the web UI to browse a branch whose name begins with a --config= or --debugger= substring.
Product
Phabricator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com secure.phabricator.com
Dec 11, 2017lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows reCVE-2017-17523 · Other software · Lilypond · reported by MITREHigh 8.8
lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument.
Product
Lilypond
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org bugs.debian.org
Dec 11, 2017sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allCVE-2017-17512 · Other software · Siemens · reported by MITREHigh 8.8
sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument.
Product
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record metadata.ftp-master.debian.org bugs.debian.org
Dec 6, 2017A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned CVE-2017-15121 · Other software · Red Hat, Inc. · reported by Red HatMedium 5.5
A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned to a page boundary.
Product
Red Hat Enterprise Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com access.redhat.com
Dec 6, 2017net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which aCVE-2017-17450 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allows local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org securityfocus.com
Dec 6, 2017The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not restrict observatiCVE-2017-17449 · Computers, phones & browsers · Linux · reported by MITREMedium 4.7
The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com access.redhat.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.