Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
83 results · page 2 of 2
Sep 21, 2021ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities.CVE-2021-37741 · Email & office · Zohocorp · reported by MITREHigh 8.8
ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Sep 21, 2021ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover.CVE-2021-37424 · Email & office · Zohocorp · reported by MITRECritical 9.8
ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.commanageengine.com
Sep 21, 2021Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.CVE-2021-37420 · Email & office · Zohocorp · reported by MITREMedium 6.5
Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.stmcyber.compitstop.manageengine.com
Sep 21, 2021Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.CVE-2021-37419 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.stmcyber.compitstop.manageengine.com
Jul 17, 2021Zoho ManageEngine ADManager Plus before 7110 allows stored XSS.CVE-2021-36772 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine ADManager Plus before 7110 allows stored XSS.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jul 17, 2021Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS.CVE-2021-36771 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jul 17, 2021Zoho ManageEngine ADManager Plus before 7110 allows remote code execution.CVE-2021-33911 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus before 7110 allows remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jul 7, 2021Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerablCVE-2020-24141 · WordPress plugins & themes · reported by MITREMedium 5.3
Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify open ports, local network hosts and execute command on services
- Product
- WP-DownloadManager
- Affected
- 1.68.4 to 1.68.4
- What to do
- Affects 1.68.4 to 1.68.4. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2021Use after free in camera If the threadmanager is being cleaned up while the worker thread is processing objects in Snapdragon Auto, Snapdragon Compute, SnapdragCVE-2020-11295 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.8
Use after free in camera If the threadmanager is being cleaned up while the worker thread is processing objects in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Mar 5, 2021Zoho ManageEngine ADManager Plus before 7066 allows XSS.CVE-2020-35594 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine ADManager Plus before 7066 allows XSS.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jul 17, 2019Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low CVE-2019-12876 · Email & office · Zohocorp · reported by MITREHigh 7.3
Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to System.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comcriticalstart.com
Apr 30, 2019Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin diCVE-2018-19374 · Email & office · Zohocorp · reported by MITREHigh 7
Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin directory.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.digitalinterruption.comresearch.digitalinterruption.com
Aug 28, 2018Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen.CVE-2018-15740 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdrive.google.com
Aug 28, 2018Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen.CVE-2018-15608 · Other software · Manageengine · reported by MITREMedium 6.1
Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen.
- Product
- Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 7, 2018/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypaCVE-2017-17552 · Email & office · Zohocorp · reported by MITREHigh 8.8
/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordumbrielsecurity.wordpress.comumbrielsecurity.wordpress.com
May 14, 2015Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause CVE-2015-2715 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.8
Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) by leveraging improper Media Decoder Thread creation at the time of a shutdown.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgmozilla.org
Mar 11, 2015Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web scrCVE-2015-1026 · Email & office · Zohocorp · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the (1) technicianSearchText parameter to the Help Desk Technician page or (2) rolesSearchText parameter to the Help Desk Roles.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Mar 18, 2014Stack-based buffer overflow in the CDownloads_Deleted::UpdateDownload function in Downloads_Deleted.cpp in Free Download Manager 3.9.3 build 1360, 3.8 build 117CVE-2014-2087 · Other software · Freedownloadmanager · reported by MITREHigh 9.3
Stack-based buffer overflow in the CDownloads_Deleted::UpdateDownload function in Downloads_Deleted.cpp in Free Download Manager 3.9.3 build 1360, 3.8 build 1173, 3.0 build 852, and earlier allows user-assisted remote attackers to execute arbitrary code via a long file name, which is then deleted from the download queue by the user.
- Product
- Free Download Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Apr 19, 2013Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote attackers to hijack the authentication CVE-2013-2697 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
- Product
- Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager
- Fixed in
- 1.61
- What to do
- Update Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager to 1.61 or newer.
Full record and what to do →NVD recordsecunia.comwordpress.org
Feb 13, 2012Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ADManager Plus 5.2 Build 5210 allow remote attackers to inject arbitrary web script or HTML CVE-2012-1049 · Other software · Manageengine · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ADManager Plus 5.2 Build 5210 allow remote attackers to inject arbitrary web script or HTML via the (1) domainName parameter to jsp/AddDC.jsp or (2) operation parameter to DomainConfig.do.
- Product
- Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Nov 22, 2011Cross-site scripting (XSS) vulnerability in jsp/admin/tools/remote_share.jsp in ManageEngine ADManager Plus 4.4.0 allows remote attackers to inject arbitrary weCVE-2010-5050 · Email & office · Zohocorp · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in jsp/admin/tools/remote_share.jsp in ManageEngine ADManager Plus 4.4.0 allows remote attackers to inject arbitrary web script or HTML via the computerName parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2010Directory traversal vulnerability in Free Download Manager (FDM) before 3.0.852 allows remote attackers to create arbitrary files via directory traversal sequenCVE-2010-0999 · Other software · Freedownloadmanager · reported by PSIRT-CNA@flexerasoftware.comHigh 7.1
Directory traversal vulnerability in Free Download Manager (FDM) before 3.0.852 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file.
- Product
- Free Download Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2010Multiple stack-based buffer overflows in Free Download Manager (FDM) before 3.0.852 allow remote attackers to execute arbitrary code via vectors involving (1) tCVE-2010-0998 · Other software · Freedownloadmanager · reported by PSIRT-CNA@flexerasoftware.comHigh 10
Multiple stack-based buffer overflows in Free Download Manager (FDM) before 3.0.852 allow remote attackers to execute arbitrary code via vectors involving (1) the folders feature in Site Explorer, (2) the websites feature in Site Explorer, (3) an FTP URI, or (4) a redirect.
- Product
- Free Download Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2010Cross-site request forgery (CSRF) vulnerability in administration/admins.php in Ad Manager Pro (aka AdManagerPro) 3.0 allows remote attackers to hijack the authCVE-2009-4828 · Websites & servers · Phpwebscripts · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in administration/admins.php in Ad Manager Pro (aka AdManagerPro) 3.0 allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an admin_created action. NOTE: some of these details are obtained from third party information.
- Product
- AD Manager Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
Feb 24, 2009SQL injection vulnerability in view.php in E-topbiz AdManager 4 allows remote attackers to execute arbitrary SQL commands via the group parameter.CVE-2008-6261 · Other software · E-topbiz · reported by MITREHigh 7.5
SQL injection vulnerability in view.php in E-topbiz AdManager 4 allows remote attackers to execute arbitrary SQL commands via the group parameter.
- Product
- Admanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Dec 16, 2008Ikon AdManager 2.1 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the dCVE-2008-5596 · Other software · Dotnetindex · reported by MITREMedium 5
Ikon AdManager 2.1 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for ikonBAnner_AdManager.mdb.
- Product
- Ikon Admanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Oct 15, 2008Insecure method vulnerability in the MSVNClientDownloadManager61Lib.DownloadManager.1 ActiveX control (ISDM.exe 6.1.100.61372) in Macrovision FLEXnet Connect 6.CVE-2008-4587 · Other software · Acresso · reported by MITREHigh 9.3
Insecure method vulnerability in the MSVNClientDownloadManager61Lib.DownloadManager.1 ActiveX control (ISDM.exe 6.1.100.61372) in Macrovision FLEXnet Connect 6.1 allows remote attackers to force the download and execution of arbitrary files via the AddFile and RunScheduledJobs methods. NOTE: this could be leveraged for code execution by uploading executable files to Startup folders.
- Product
- Flexnet Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
May 1, 2008The Akamai Download Manager (aka DLM or dlmanager) ActiveX control (DownloadManagerV2.ocx) before 2.2.3.5 allows remote attackers to force the download and execCVE-2007-6339 · Other software · Akamai Technologies · reported by MITREMedium 6.8
The Akamai Download Manager (aka DLM or dlmanager) ActiveX control (DownloadManagerV2.ocx) before 2.2.3.5 allows remote attackers to force the download and execution of arbitrary code via unspecified "undocumented object parameters."
- Product
- Download Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.idefense.comlists.grok.org.uk
Apr 17, 2007Stack-based buffer overflow in Akamai Technologies Download Manager ActiveX Control (DownloadManagerV2.ocx) before 2.2.1.0 allows remote attackers to execute arCVE-2007-1892 · Other software · Akamai Technologies · reported by MITREHigh 9.3
Stack-based buffer overflow in Akamai Technologies Download Manager ActiveX Control (DownloadManagerV2.ocx) before 2.2.1.0 allows remote attackers to execute arbitrary code via unspecified vectors, a different issue than CVE-2007-1891.
- Product
- Download Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2007Stack-based buffer overflow in the GetPrivateProfileSectionW function in Akamai Technologies Download Manager ActiveX Control (DownloadManagerV2.ocx) after 2.0.CVE-2007-1891 · Other software · Akamai Technologies · reported by MITREHigh 9.3
Stack-based buffer overflow in the GetPrivateProfileSectionW function in Akamai Technologies Download Manager ActiveX Control (DownloadManagerV2.ocx) after 2.0.4.4 but before 2.2.1.0 allows remote attackers to execute arbitrary code, related to misinterpretation of the nSize parameter as a byte count instead of a wide character count.
- Product
- Download Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.idefense.comsecunia.com
Jun 15, 2006Multiple cross-site scripting (XSS) vulnerabilities in publish.php in ST AdManager Lite allow remote attackers to inject arbitrary web script or HTML via the (1CVE-2006-3037 · Other software · Site Trade · reported by MITRELow 2.6
Multiple cross-site scripting (XSS) vulnerabilities in publish.php in ST AdManager Lite allow remote attackers to inject arbitrary web script or HTML via the (1) title, (2) description, (3) article, (4) bio, and (5) name parameters.
- Product
- ST Admanager Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Sep 30, 2005The ActiveX control for NateOn Messenger (NateonDownloadManager.ocx) allows remote attackers to download and execute arbitrary programs by setting the argumentsCVE-2005-3113 · Other software · Nateon · reported by MITREHigh 7.5
The ActiveX control for NateOn Messenger (NateonDownloadManager.ocx) allows remote attackers to download and execute arbitrary programs by setting the arguments to the GotNate.Excute method.
- Product
- Nateon Messenger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2005Buffer overflow in the ActiveX control for NateOn Messenger (NateonDownloadManager.ocx) allows remote attackers to cause a denial of service (crash) and possiblCVE-2005-3114 · Other software · Nateon · reported by MITREHigh 7.5
Buffer overflow in the ActiveX control for NateOn Messenger (NateonDownloadManager.ocx) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long third argument to the GotNate.Excute method.
- Product
- Nateon Messenger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.