Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
118 results · page 2 of 3
Jun 21, 2024The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the root of the Adminer directory.CVE-2023-45197 · Other software · Adminer · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.2
The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the root of the Adminer directory. The attacker can effectively guess the name of the uploaded file and execute it. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.3.
- Product
- Adminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024Minerbabe through V4.16 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all publiCVE-2020-5200 · Other software · reported by MITREMedium 5.9
Minerbabe through V4.16 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.minerbabe.comrsaxvc.net
Apr 3, 2024Rapid7 Minerva Armor versions below 4.5.5 suffer from a privilege escalation vulnerability whereby an authenticated attacker can elevate privileges and execute CVE-2024-0394 · Other software · Rapid7 · reported by cve@rapid7.comHigh 7.8
Rapid7 Minerva Armor versions below 4.5.5 suffer from a privilege escalation vulnerability whereby an authenticated attacker can elevate privileges and execute arbitrary code with SYSTEM privilege. The vulnerability is caused by the product's implementation of OpenSSL's`OPENSSLDIR` parameter where it is set to a path accessible to low-privileged users. The vulnerability has been remediated and fixed in version 4.5.5.
- Product
- Minerva
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2024Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php.CVE-2024-25399 · Other software · Intelliants · reported by MITREMedium 6.1
Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php.
- Product
- Subrion CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgcwe.mitre.org
Jan 19, 2024A vulnerability, which was classified as problematic, was found in FactoMineR FactoInvestigate up to 1.9.CVE-2024-0720 · Other software · FactoMineR · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in FactoMineR FactoInvestigate up to 1.9. Affected is an unknown function of the component HTML Report Generator. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251544. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- FactoInvestigate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Dec 19, 2023Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva".CVE-2023-6135 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
Oct 12, 2023A flaw was found in the tracker-miners package.CVE-2023-5557 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
- Product
- Red Hat Enterprise Linux 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 27, 2023Soundminer – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-42487 · Other software · Soundminer · reported by cna@cyber.gov.ilHigh 7.5
Soundminer – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Product
- Soundminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2023An issue in FeMiner WMS v1.1 allows attackers to execute arbitrary code via the filename parameter and the exec function.CVE-2021-33949 · Other software · WMS Project · reported by MITRECritical 9.8
An issue in FeMiner WMS v1.1 allows attackers to execute arbitrary code via the filename parameter and the exec function.
- Product
- WMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2022A vulnerability, which was classified as critical, has been found in FeMiner wms.CVE-2022-4272 · Other software · FeMiner · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in FeMiner wms. Affected by this issue is some unknown functionality of the file /product/savenewproduct.php?flag=1. The manipulation of the argument upfile leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214760.
- Product
- wms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Sep 1, 2022An access control issue in Canaan Avalon ASIC Miner 2020.3.30 and below allows unauthenticated attackers to arbitrarily change user passwords via a crafted POSTCVE-2022-36604 · Other software · Canaan · reported by MITREHigh 7.5
An access control issue in Canaan Avalon ASIC Miner 2020.3.30 and below allows unauthenticated attackers to arbitrarily change user passwords via a crafted POST request.
- Product
- Avalon Asic Miner Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjamesachambers.comjamesachambers.com
Sep 1, 2022The Eclipse TCF debug interface in JasMiner-X4-Server-20220621-090907 and below is open on port 1534.CVE-2022-36601 · Other software · Jinglemining · reported by MITRECritical 9.8
The Eclipse TCF debug interface in JasMiner-X4-Server-20220621-090907 and below is open on port 1534. This issue allows unauthenticated attackers to gain root privileges on the affected device and access sensitive data or execute arbitrary commands.
- Product
- Jasminer X4 Server Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjamesachambers.comjamesachambers.com
Jul 20, 2022The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers to access passwordsCVE-2022-24660 · Other software · Goldshell · reported by MITREHigh 7.5
The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers to access passwords and other sensitive information in plaintext.
- Product
- Goldshell Miner Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjamesachambers.com
Jul 20, 2022Goldshell ASIC Miners v2.2.1 and below was discovered to contain a path traversal vulnerability which allows unauthenticated attackers to retrieve arbitrary filCVE-2022-24659 · Other software · Goldshell · reported by MITREHigh 7.5
Goldshell ASIC Miners v2.2.1 and below was discovered to contain a path traversal vulnerability which allows unauthenticated attackers to retrieve arbitrary files from the device.
- Product
- Goldshell Miner Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjamesachambers.com
Jul 20, 2022Goldshell ASIC Miners v2.1.x was discovered to contain hardcoded credentials which allow attackers to remotely connect via the SSH protocol (port 22).CVE-2022-24657 · Other software · Goldshell · reported by MITRECritical 9.8
Goldshell ASIC Miners v2.1.x was discovered to contain hardcoded credentials which allow attackers to remotely connect via the SSH protocol (port 22).
- Product
- Goldshell Miner Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjamesachambers.com
Jun 20, 2022A vulnerability has been found in Adminer Login 1.4.4 and classified as problematic.CVE-2017-20066 · Other software · unspecified · reported by VulDBMedium 5.3
A vulnerability has been found in Adminer Login 1.4.4 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improper access controls. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
- Product
- Adminer Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsumofpwn.nl
Jun 17, 2022A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server.CVE-2021-40903 · Other software · Antminer Monitor Project · reported by MITRECritical 9.8
A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static.
- Product
- Antminer Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
May 16, 2022A remote command execution (RCE) vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php.CVE-2021-42897 · Other software · Feminer WMS Project · reported by MITRECritical 9.8
A remote command execution (RCE) vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $_POST[r_name] is directly passed into the $mysqlstr and is executed by exec.
- Product
- Feminer WMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by rCVE-2021-43008 · Other software · Adminer · reported by MITREHigh 7.5
Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.
- Product
- Adminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Nov 10, 2021pdf2xml v2.0 was discovered to contain a stack buffer overflow in the component getObjectStream.CVE-2020-23877 · Other software · Science-miner · reported by MITRECritical 9.8
pdf2xml v2.0 was discovered to contain a stack buffer overflow in the component getObjectStream.
- Product
- Pdf2xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021pdf2xml v2.0 was discovered to contain a memory leak in the function TextPage::testLinkedText.CVE-2020-23876 · Other software · Science-miner · reported by MITREHigh 7.5
pdf2xml v2.0 was discovered to contain a memory leak in the function TextPage::testLinkedText.
- Product
- Pdf2xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::addAttributsNode.CVE-2020-23874 · Other software · Science-miner · reported by MITRECritical 9.8
pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::addAttributsNode.
- Product
- Pdf2xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Nov 10, 2021pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::dump.CVE-2020-23873 · Other software · Science-miner · reported by MITRECritical 9.8
pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::dump.
- Product
- Pdf2xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Nov 10, 2021A NULL pointer dereference in the function TextPage::restoreState of pdf2xml v2.0 allows attackers to cause a denial of service (DoS).CVE-2020-23872 · Other software · Science-miner · reported by MITREHigh 7.5
A NULL pointer dereference in the function TextPage::restoreState of pdf2xml v2.0 allows attackers to cause a denial of service (DoS).
- Product
- Pdf2xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2021Vulnerability in the Oracle LogMiner component of Oracle Database Server.CVE-2021-2332 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.7
Vulnerability in the Oracle LogMiner component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged attacker having DBA privilege with network access via Oracle Net to compromise Oracle LogMiner. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle LogMiner accessible data as well as unauthorized read access to a subset of Oracle LogMiner accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle LogMiner. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H).
- Product
- Database - Enterprise Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021Cross Site Scripting (XSS) in Ari Adminer v1 allows remote attackers to execute arbitrary code via the 'Title' parameter of the 'Add New Connections' component CVE-2020-19156 · Other software · Ari-soft · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in Ari Adminer v1 allows remote attackers to execute arbitrary code via the 'Title' parameter of the 'Add New Connections' component when the 'save()' function is called.
- Product
- ARI Adminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2021Adminer is open-source database management software.CVE-2021-29625 · Other software · vrana · reported by GitHubHigh 7.5
Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`).
- Product
- adminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2021Adminer Server-Side Request Forgery VulnerabilityCVE-2021-21311 · Other software · Adminer · reported by GitHubExploitedHigh 7.2
Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.
- Product
- Adminer
- On CISA’s list since
- Sep 29, 2025 (federal fix deadline Oct 20, 2025)
- What to do
- Attackers are using this now. Install Adminer’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Feb 9, 2021Adminer through 4.7.8 allows XSS via the history parameter to the default URI.CVE-2020-35572 · Other software · Adminer · reported by MITREMedium 6.1
Adminer through 4.7.8 allows XSS via the history parameter to the default URI.
- Product
- Adminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Dec 16, 2020The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user.CVE-2020-35186 · Other software · Docker · reported by MITRECritical 9.8
The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. System using the adminer docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Adminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2020Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator (thatCVE-2020-15931 · Other software · Netwrix · reported by MITREHigh 7.5
Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator (that is configured within the product in its installation state) by generating a single Kerberos Pre-Authentication Failed (ID 4771) event on a Domain Controller.
- Product
- Account Lockout Examiner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2019The MinervaNeue Skin in MediaWiki from 2019-11-05 to 2019-12-13 (1.35 and/or 1.34) mishandles certain HTML attributes, as demonstrated by IMG onmouseover= (impaCVE-2019-19910 · Other software · Mediawiki · reported by MITREMedium 6.1
The MinervaNeue Skin in MediaWiki from 2019-11-05 to 2019-12-13 (1.35 and/or 1.34) mishandles certain HTML attributes, as demonstrated by IMG onmouseover= (impact is XSS) and IMG src=http (impact is disclosing the client's IP address). This can occur within a talk page topical header that is viewed within a mobile (MobileFrontend) context.
- Product
- Mediawiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Dec 12, 2019minerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product.CVE-2019-19750 · Other software · minerstat · reported by MITRECritical 9.8
minerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product.
- Product
- msos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2019A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever aCVE-2019-6122 · Other software · Nicehash · reported by MITRELow 3.1
A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address.
- Product
- Miner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberworldmirror.comdocs.google.com
Nov 6, 2019An issue was discovered in NiceHash Miner before 2.0.3.0.CVE-2019-6121 · Other software · Nicehash · reported by MITRELow 3.7
An issue was discovered in NiceHash Miner before 2.0.3.0. Missing Authorization allows an adversary to can gain access to a miner's information about such as his recent payments, unclaimed Balance, Old Balance (at the time of December 2017 breach) , Projected payout, Mining stats like profitability, Efficiency, Number of workers, etc.. A valid Email address is required in order to retrieve this Information.
- Product
- Miner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberworldmirror.comdocs.google.com
Nov 6, 2019An issue was discovered in NiceHash Miner before 2.0.3.0.CVE-2019-6120 · Other software · Nicehash · reported by MITREHigh 7.5
An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a large number of email addresses to identify valid ones. By exploiting this vulnerability with CVE-2019-6122 (Username Enumeration) an adversary can enumerate a large number of valid users' Email addresses.
- Product
- Miner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberworldmirror.comdocs.google.com
Sep 17, 2019The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS.CVE-2016-10979 · WordPress plugins & themes · reported by MITREMedium 6.1
The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS.
- Product
- fossura-tag-miner
- Fixed in
- 1.1.5
- What to do
- Update fossura-tag-miner to 1.1.5 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Sep 17, 2019The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.CVE-2016-10978 · WordPress plugins & themes · reported by MITREHigh 8.8
The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.
- Product
- fossura-tag-miner
- Fixed in
- 1.1.5
- What to do
- Update fossura-tag-miner to 1.1.5 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Jan 24, 2019A vulnerability in the chat feed feature of Cisco SocialMiner could allow an unauthenticated, remote attacker to perform cross-site scripting (XSS) attacks agaiCVE-2019-1668 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the chat feed feature of Cisco SocialMiner could allow an unauthenticated, remote attacker to perform cross-site scripting (XSS) attacks against a user of the web-based user interface of an affected system. This vulnerability is due to insufficient sanitization of user-supplied input delivered to the chat feed as part of an HTTP request. An attacker could exploit this vulnerability by persuading a user to follow a link to attacker-controlled content. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
- Product
- Cisco SocialMiner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Oct 17, 2018A vulnerability in the web-based management interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to conduct a stored cross-site scriptCVE-2018-15435 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the web-based management interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information.
- Product
- Cisco SocialMiner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Jun 5, 2018The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to execute arbitrary code due to a stack-based buffCVE-2018-10058 · Other software · Cgminer Project · reported by MITREHigh 8.8
The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to execute arbitrary code due to a stack-based buffer overflow in the addpool, failover-only, poolquota, and save command handlers.
- Product
- Cgminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Jun 5, 2018The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to write the miner configuration file to arbitrary CVE-2018-10057 · Other software · Bfgminer · reported by MITREMedium 6.5
The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to write the miner configuration file to arbitrary locations on the server due to missing basedir restrictions (absolute directory traversal).
- Product
- Bfgminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
May 31, 2018Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution via the system restore function.CVE-2018-11220 · Other software · Bitmain · reported by MITREHigh 8.8
Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution via the system restore function.
- Product
- Antminer D3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
May 16, 2018A vulnerability in the TCP stack of Cisco SocialMiner could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition in the notifiCVE-2018-0290 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the TCP stack of Cisco SocialMiner could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition in the notification system. The vulnerability is due to faulty handling of new TCP connections to the affected application. An attacker could exploit this vulnerability by sending a malicious TCP packet to the vulnerable service. An exploit could allow the attacker to create a DoS condition by interrupting certain phone services. A manual restart of the service may be required to restore full functionalities. Cisco Bug IDs: CSCvh48368.
- Product
- Socialminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Mar 5, 2018Adminer through 4.3.1 has SSRF via the server parameter.CVE-2018-7667 · Other software · Adminer · reported by MITRECritical 9.8
Adminer through 4.3.1 has SSRF via the server parameter.
- Product
- Adminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhyp3rlinx.altervista.orglists.debian.org
Feb 9, 2018Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner API.CVE-2018-1000049 · Other software · Nanopool · reported by MITREHigh 7.5
Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner API. The flaw can be exploited only if the software is executed with read/write mode enabled.
- Product
- Claymore Dual Miner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Feb 2, 2018The remote management interface in Claymore Dual Miner 10.5 and earlier is vulnerable to an unauthenticated format string vulnerability, allowing remote attackeCVE-2018-6317 · Other software · Claymore Dual Miner Project · reported by MITRECritical 9.1
The remote management interface in Claymore Dual Miner 10.5 and earlier is vulnerable to an unauthenticated format string vulnerability, allowing remote attackers to read memory or cause a denial of service.
- Product
- Claymore Dual Miner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comexploit-db.com
Jan 19, 2018An exploitable improper authorization vulnerability exists in miner_stop API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768).CVE-2017-12118 · Other software · Talos · reported by talos-cna@cisco.comHigh 8.1
An exploitable improper authorization vulnerability exists in miner_stop API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). An attacker can send JSON to trigger this vulnerability.
- Product
- CPP-Ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtalosintelligence.com
Jan 19, 2018An exploitable improper authorization vulnerability exists in miner_setGasPrice API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768)CVE-2017-12116 · Other software · Talos · reported by talos-cna@cisco.comHigh 8.1
An exploitable improper authorization vulnerability exists in miner_setGasPrice API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability.
- Product
- CPP-Ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtalosintelligence.com
Jan 19, 2018An exploitable improper authorization vulnerability exists in miner_start API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768).CVE-2017-12117 · Other software · Talos · reported by talos-cna@cisco.comHigh 8.1
An exploitable improper authorization vulnerability exists in miner_start API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability.
- Product
- CPP-Ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtalosintelligence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.