Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
118 results · page 2 of 3
Jun 2, 2023Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.CVE-2023-3070 · Other software · tsolucio · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
- Product
- tsolucio/corebos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023Unverified Password Change in GitHub repository tsolucio/corebos prior to 8.CVE-2023-3069 · Other software · tsolucio · reported by security@huntr.devCritical 9.8
Unverified Password Change in GitHub repository tsolucio/corebos prior to 8.
- Product
- tsolucio/corebos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3 versions.CVE-2023-22689 · WordPress plugins & themes · reported by PatchstackMedium 4.6
Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3 versions.
- Affected
- up to 6.3
- What to do
- Affects up to 6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 20, 2023A vulnerability was found in Ellucian Ethos Identity up to 5.10.5.CVE-2023-2822 · Other software · Ellucian · reported by VulDBMedium 4.3
A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.10.6 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-229596.
- Product
- Ethos Identity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2023LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /system/sshkeysCVE-2023-24182 · Other software · Openwrt · reported by MITREMedium 5.4
LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /system/sshkeys.js.
- Product
- Openwrt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2023LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pagCVE-2023-24181 · Other software · Openwrt · reported by MITREMedium 5.4
LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm.
- Product
- Luci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2023Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0.CVE-2023-1527 · Other software · tsolucio · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0.
- Product
- tsolucio/corebos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3.0.2 versions.CVE-2023-25973 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3.0.2 versions.
- Affected
- up to 6.3.0.2
- What to do
- Affects up to 6.3.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 13, 2022PHP Remote File Inclusion in GitHub repository tsolucio/corebos prior to 8.0.CVE-2022-4446 · Other software · tsolucio · reported by security@huntr.devCritical 9.8
PHP Remote File Inclusion in GitHub repository tsolucio/corebos prior to 8.0.
- Product
- tsolucio/corebos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2022OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /system/sshkeys.js.CVE-2022-41435 · Other software · Openwrt · reported by MITREMedium 5.4
OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /system/sshkeys.js. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted public key comments.
- Product
- Luci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 18, 2022AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the web background.CVE-2020-14110 · Other software · MI · reported by security@xiaomi.comHigh 7.8
AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the web background.
- Product
- Ax3600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Dec 9, 2021An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luci/rc.CVE-2021-20138 · Other software · Gryphonconnect · reported by vulnreport@tenable.comHigh 8.8
An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luci/rc. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the web interface.
- Product
- Gryphon Tower Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 9, 2021A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the Gryphon Tower router's web interface.CVE-2021-20137 · Other software · Gryphonconnect · reported by vulnreport@tenable.comMedium 6.1
A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the Gryphon Tower router's web interface. An attacker could exploit this issue by tricking a user into following a specially crafted link, granting the attacker javascript execution in the context of the victim's browser.
- Product
- Gryphon Tower Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
May 25, 2021A stored cross-site scripting (XSS) vulnerability was discovered in the Web Interface for OpenWRT LuCI version 19.07 which allows attackers to inject arbitrary CVE-2021-33425 · Other software · Openwrt · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability was discovered in the Web Interface for OpenWRT LuCI version 19.07 which allows attackers to inject arbitrary Javascript in the OpenWRT Hostname via the Hostname Change operation.
- Product
- Openwrt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
May 25, 2021The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerability.CVE-2021-27821 · Other software · Openwrt · reported by MITREMedium 6.1
The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerability.
- Product
- Luci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwrt.orgopenwrt.org
Mar 21, 2021applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commandsCVE-2021-28961 · Other software · Openwrt · reported by MITREHigh 8.8
applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commands via POST requests.
- Product
- Openwrt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID.CVE-2019-25015 · Other software · Openwrt · reported by MITREMedium 5.4
LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID.
- Product
- Openwrt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2020In IgniteNet HeliOS GLinq v2.2.1 r2961, the langSelection parameter is stored in the luci configuration file (/etc/config/luci) by the authenticator.htmlauth fuCVE-2020-5781 · Other software · Ignitenet · reported by vulnreport@tenable.comMedium 4.3
In IgniteNet HeliOS GLinq v2.2.1 r2961, the langSelection parameter is stored in the luci configuration file (/etc/config/luci) by the authenticator.htmlauth function. When modified with arbitrary javascript, this causes a denial-of-service condition for all other users.
- Product
- Helios Glinq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 23, 2020In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services.CVE-2020-10871 · Other software · Openwrt · reported by MITREMedium 5.3
In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance of this report because, for instances reachable by an unauthenticated actor, the same information is available in other (more complex) ways, and there is no plan to restrict the information further
- Product
- Luci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2019OpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin/network/firewall/forwards URI (this can occur, for example, on a TP-LCVE-2019-18993 · Other software · Openwrt · reported by MITREMedium 5.4
OpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin/network/firewall/forwards URI (this can occur, for example, on a TP-Link Archer C7 device).
- Product
- Openwrt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2019OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on router" and "New forward rule" and "New SoCVE-2019-18992 · Other software · Openwrt · reported by MITREMedium 5.4
OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on router" and "New forward rule" and "New Source NAT" (this can occur, for example, on a TP-Link Archer C7 device).
- Product
- Openwrt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2019/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2(PSG1218) V22.5.9.163 devices allows remote authenticated users to execute any command via shellCVE-2019-19117 · Other software · Phicomm · reported by MITREHigh 8.8
/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2(PSG1218) V22.5.9.163 devices allows remote authenticated users to execute any command via shell metacharacters in the cgi-bin/luci autoUpTime parameter.
- Product
- K2(psg1218) Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2019In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affectedCVE-2019-12272 · Other software · Openwrt · reported by MITRECritical 9.8
In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command injection vulnerability.
- Product
- Luci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2019An improper authentication vulnerability can be exploited through a race condition that occurs in Ellucian Banner Web Tailor 8.8.3, 8.8.4, and 8.9 and Banner EnCVE-2019-8978 · Other software · Ellucian · reported by MITREHigh 8.1
An improper authentication vulnerability can be exploited through a race condition that occurs in Ellucian Banner Web Tailor 8.8.3, 8.8.4, and 8.9 and Banner Enterprise Identity Services 8.3, 8.3.1, 8.3.2, and 8.4, in conjunction with SSO Manager. This vulnerability allows remote attackers to steal a victim's session (and cause a denial of service) by repeatedly requesting the initial Banner Web Tailor main page with the IDMSESSID cookie set to the victim's UDCID, which in the case tested is the institutional ID. During a login attempt by a victim, the attacker can leverage the race condition and will be issued the SESSID that was meant for this victim.
- Product
- Banner Enterprise Identity Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 28, 2019An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX (e.g., RUT950) R_31.04.89 before R_00.05.00.5 devices.CVE-2018-19879 · Other software · Teltonika · reported by MITREHigh 7.1
An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX (e.g., RUT950) R_31.04.89 before R_00.05.00.5 devices. The authentication functionality is not protected from automated tools used to make login attempts to the application. An anonymous attacker has the ability to make unlimited login attempts with an automated tool. This ability could lead to cracking a targeted user's password.
- Product
- Rut950 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.teltonika.lttriadsec.com
Jul 14, 2018OS command injection in the AP mode settings feature in /cgi-bin/luci /api/misystem/set_router_wifiap on Xiaomi R3D before 2.26.4 devices allows an attacker to CVE-2018-14060 · Other software · MI · reported by MITRECritical 9.8
OS command injection in the AP mode settings feature in /cgi-bin/luci /api/misystem/set_router_wifiap on Xiaomi R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data.
- Product
- Xiaomi R3d Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2018OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.2CVE-2018-14010 · Other software · MI · reported by MITRECritical 9.8
OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data.
- Product
- Xiaomi R3p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2018/usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0oxKXL0 password.CVE-2018-11482 · Network & remote access · Tp-link · reported by MITRECritical 9.8
/usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0oxKXL0 password.
- Product
- IPC Tl-ipc223(p)-6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2017The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary fCVE-2017-16959 · Network & remote access · Tp-link · reported by MITREMedium 6.5
The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP header, related to the set_sysinfo and get_sysinfo functions in /usr/lib/lua/luci/controller/locale.lua in uhttpd.
- Product
- Tl-wvr300 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2017Open redirect vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to redirect users to arbitrary web sites aCVE-2015-5054 · Other software · Ellucian · reported by MITREMedium 6.1
Open redirect vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter.
- Product
- Banner Student
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Sep 11, 2017Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka "Weak Password CVE-2015-4689 · Other software · Ellucian · reported by MITRECritical 9.8
Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka "Weak Password Reset."
- Product
- Banner Student
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Sep 11, 2017Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allow remote attackers to enumerate user accounts via a series of requests.CVE-2015-4688 · Other software · Ellucian · reported by MITREMedium 5.3
Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allow remote attackers to enumerate user accounts via a series of requests.
- Product
- Banner Student
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Sep 11, 2017Cross-site scripting (XSS) vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 allows remote attackers to inject arbitrary web script or HTML viCVE-2015-4687 · Other software · Ellucian · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Banner Student
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Jul 3, 2017The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands wCVE-2017-8116 · Other software · Teltonika · reported by MITRECritical 9.8
The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands with root privileges via shell metacharacters in the username parameter in a login request.
- Product
- Rut900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2017Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request fCVE-2017-7402 · Other software · Lucidcrew · reported by MITRECritical 9.8
Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg.
- Product
- Pixie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrungga.blogspot.co.idexploit-db.com
Mar 31, 2017Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack.CVE-2017-7363 · Other software · Lucidcrew · reported by MITREMedium 6.1
Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack.
- Product
- Pixie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrungga.blogspot.co.idsecurityfocus.com
Mar 31, 2017Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack.CVE-2017-7362 · Other software · Lucidcrew · reported by MITREMedium 6.1
Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack.
- Product
- Pixie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrungga.blogspot.co.idsecurityfocus.com
Mar 31, 2017Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack.CVE-2017-7361 · Other software · Lucidcrew · reported by MITREMedium 6.1
Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack.
- Product
- Pixie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrungga.blogspot.co.idsecurityfocus.com
Mar 31, 2017Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack.CVE-2017-7360 · Other software · Lucidcrew · reported by MITREMedium 6.1
Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack.
- Product
- Pixie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrungga.blogspot.co.idsecurityfocus.com
Mar 31, 2017Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack.CVE-2017-7359 · Other software · Lucidcrew · reported by MITREMedium 6.1
Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack.
- Product
- Pixie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrungga.blogspot.co.idsecurityfocus.com
Dec 29, 2014Plogger 1.0 RC1 and earlier, when the Lucid theme is used, does not assign new values for certain codes, which makes it easier for remote attackers to bypass thCVE-2014-2224 · Other software · Plogger · reported by MITREMedium 5
Plogger 1.0 RC1 and earlier, when the Lucid theme is used, does not assign new values for certain codes, which makes it easier for remote attackers to bypass the CAPTCHA protection mechanism via a series of form submissions.
- Product
- Plogger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsysdream.comsysdream.com
Oct 20, 2014The eBiblio Andalucia (aka com.bqreaders.reader.ebiblioandalucia) application 1.6.5 for Android does not verify X.509 certificates from SSL servers, which allowCVE-2014-7575 · Other software · Ebiblio · reported by cret@cert.orgMedium 5.4
The eBiblio Andalucia (aka com.bqreaders.reader.ebiblioandalucia) application 1.6.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Ebiblio Andalucia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Oct 15, 2014Eval injection vulnerability in luci 0.26.0 allows remote authenticated users with certain permissions to execute arbitrary Python code via a crafted cluster coCVE-2014-3593 · Other software · Scientificlinux · reported by Red HatMedium 6
Eval injection vulnerability in luci 0.26.0 allows remote authenticated users with certain permissions to execute arbitrary Python code via a crafted cluster configuration.
- Product
- Luci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.combugzilla.redhat.com
Oct 6, 2014The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions CVE-2014-3521 · Other software · Redhat · reported by Red HatMedium 5.5
The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions via a crafted URL.
- Product
- Conga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.combugzilla.redhat.com
Jun 4, 2014Multiple cross-site scripting (XSS) vulnerabilities in the contact module (admin/modules/contact.php) in Pixie CMS 1.04 allow remote attackers to inject arbitraCVE-2014-3786 · Other software · Lucidcrew · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the contact module (admin/modules/contact.php) in Pixie CMS 1.04 allow remote attackers to inject arbitrary web script or HTML via the (1) uemail or (2) subject parameter in the Contact form to contact/.
- Product
- Pixie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Mar 31, 2014Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session CVE-2013-7347 · Other software · Redhat · reported by MITRELow 3.7
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.
- Product
- Conga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.combugzilla.redhat.com
Mar 31, 2014Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges bCVE-2012-3359 · Other software · Redhat · reported by Red HatLow 3.7
Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout.
- Product
- Conga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.combugzilla.redhat.com
Nov 23, 2013Untrusted search path vulnerability in python-paste-script (aka paster) in Luci 0.26.0, when started using the initscript, allows local users to gain privilegesCVE-2013-4482 · Other software · Scientificlinux · reported by Red HatMedium 6.2
Untrusted search path vulnerability in python-paste-script (aka paster) in Luci 0.26.0, when started using the initscript, allows local users to gain privileges via a Trojan horse .egg-info file in the (1) current working directory or (2) its parent directories.
- Product
- Luci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.combugzilla.redhat.com
Nov 23, 2013Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users toCVE-2013-4481 · Other software · Scientificlinux · reported by Red HatLow 1.9
Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "authentication secrets."
- Product
- Luci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.combugzilla.redhat.com
Jan 24, 2012The Scan to PDF Free (com.scan.to.pdf.trial) application 2.0.4 for Android does not properly protect data, which allows remote attackers to read or modify scannCVE-2011-4771 · Other software · Lucion · reported by MITREMedium 5.8
The Scan to PDF Free (com.scan.to.pdf.trial) application 2.0.4 for Android does not properly protect data, which allows remote attackers to read or modify scanned files and a Google account via a crafted application.
- Product
- Scan TO PDF Free
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww4.comp.polyu.edu.hkwww4.comp.polyu.edu.hk
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.