Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
211 results · page 2 of 5
May 20, 2025FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bindEditMACName parameter in the web_acl_bindEdit_post function.CVE-2025-44896 · Other software · Planet · reported by MITRECritical 9.8
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bindEditMACName parameter in the web_acl_bindEdit_post function.
- Product
- Wgs-804hpt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the radDftParamKey parameter in the web_radiusSrv_dftParam_post function.CVE-2025-44894 · Other software · Planet · reported by MITRECritical 9.8
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the radDftParamKey parameter in the web_radiusSrv_dftParam_post function.
- Product
- Wgs-804hpt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the host_ip parameter in the web_snmp_v3host_add_post function.CVE-2025-44891 · Other software · Planet · reported by MITRECritical 9.8
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the host_ip parameter in the web_snmp_v3host_add_post function.
- Product
- Wgs-804hpt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the tacIp parameter in the web_tacplus_serverEdit_post function.CVE-2025-44883 · Other software · Planet · reported by MITRECritical 9.8
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the tacIp parameter in the web_tacplus_serverEdit_post function.
- Product
- Wgs-804hpt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ruleNamekey parameter in the web_acl_mgmt_Rules_Apply_post function.CVE-2025-44893 · Other software · Planet · reported by MITRECritical 9.8
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ruleNamekey parameter in the web_acl_mgmt_Rules_Apply_post function.
- Product
- Wgs-804hpt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlafdrew.github.io
May 20, 2025FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the host_ip parameter in the web_snmp_notifyv3_add_post function.CVE-2025-44890 · Other software · Planet · reported by MITRECritical 9.8
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the host_ip parameter in the web_snmp_notifyv3_add_post function.
- Product
- Wgs-804hpt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the stp_conf_name parameter in the web_stp_globalSetting_post function.CVE-2025-44888 · Other software · Planet · reported by MITRECritical 9.8
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the stp_conf_name parameter in the web_stp_globalSetting_post function.
- Product
- Wgs-804hpt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the radIpkey parameter in the web_radiusSrv_post function.CVE-2025-44887 · Other software · Planet · reported by MITRECritical 9.8
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the radIpkey parameter in the web_radiusSrv_post function.
- Product
- Wgs-804hpt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the byruleEditName parameter in the web_acl_mgmt_Rules_Edit_postcontains function.CVE-2025-44886 · Other software · Planet · reported by MITRECritical 9.8
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the byruleEditName parameter in the web_acl_mgmt_Rules_Edit_postcontains function.
- Product
- Wgs-804hpt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the remote_ip parameter in the web_snmpv3_remote_engineId_add_post function.CVE-2025-44885 · Other software · Planet · reported by MITRECritical 9.8
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the remote_ip parameter in the web_snmpv3_remote_engineId_add_post function.
- Product
- Wgs-804hpt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the web_sys_infoContact_post function.CVE-2025-44884 · Other software · Planet · reported by MITRECritical 9.8
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the web_sys_infoContact_post function.
- Product
- Wgs-804hpt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentCVE-2025-46275 · Other software · Planet Technology · reported by ics-cert@hq.dhs.govCritical 9.3
WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentials.
- Product
- WGS-804HPT-V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create entries in the managed database.CVE-2025-46274 · Other software · Planet Technology · reported by ics-cert@hq.dhs.govCritical 9.3
UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create entries in the managed database.
- Product
- UNI-NMS-Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges to all UNI-NMS managed devices.CVE-2025-46273 · Other software · Planet Technology · reported by ics-cert@hq.dhs.govCritical 9.3
UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges to all UNI-NMS managed devices.
- Product
- UNI-NMS-Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host syCVE-2025-46272 · Other software · Planet Technology · reported by ics-cert@hq.dhs.govCritical 9.3
WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host system.
- Product
- WGS-804HPT-V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025UNI-NMS-Lite is vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipulate device data.CVE-2025-46271 · Other software · Planet Technology · reported by ics-cert@hq.dhs.govCritical 9.3
UNI-NMS-Lite is vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipulate device data.
- Product
- UNI-NMS-Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2024The affected product is vulnerable to an integer underflow.CVE-2024-52558 · Other software · Planet Technology · reported by ics-cert@hq.dhs.govMedium 6.9
The affected product is vulnerable to an integer underflow. An unauthenticated attacker could send a malformed HTTP request, which could allow the attacker to crash the program.
- Product
- Planet WGS-804HPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2024The affected product is vulnerable to a command injection.CVE-2024-52320 · Other software · Planet Technology · reported by ics-cert@hq.dhs.govCritical 9.3
The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result in remote code execution.
- Product
- Planet WGS-804HPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2024The affected product is vulnerable to a stack-based buffer overflow.CVE-2024-48871 · Other software · Planet Technology · reported by ics-cert@hq.dhs.govCritical 9.3
The affected product is vulnerable to a stack-based buffer overflow. An unauthenticated attacker could send a malicious HTTP request that the webserver fails to properly check input size before copying data to the stack, potentially allowing remote code execution.
- Product
- Planet WGS-804HPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN).CVE-2024-54130 · Other software · nasa-jpl · reported by GitHubCritical 9.2
The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A segmentation fault occurs with ION-DTN BPv7 software version 4.1.3 when a bundle with a Destination Endpoint ID (EID) set to dtn:none is received. This causes the node to become unresponsive to incoming bundles, leading to a Denial of Service (DoS) condition. This vulnerability is fixed in 4.1.3s.
- Product
- ION-DTN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN).CVE-2024-54129 · Other software · nasa-jpl · reported by GitHubCritical 9.2
The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A vulnerability exists in the version ION-DTN BPv7 implementation version 4.1.3 when receiving a bundle with an improper reference to the imc scheme with valid Service-Specific Part (SSP) in their Previous Node Block. The vulnerability can cause ION to become unresponsive. This vulnerability is fixed in 4.1.3s.
- Product
- ION-DTN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024Certain switch models from PLANET Technology store SNMPv3 users' passwords in plaintext within the configuration files, allowing remote attackers with administrCVE-2024-8459 · Other software · PLANET Technology · reported by twcert@cert.org.twHigh 7.2
Certain switch models from PLANET Technology store SNMPv3 users' passwords in plaintext within the configuration files, allowing remote attackers with administrator privileges to read the file and obtain the credentials.
- Product
- GS-4210-24PL4C hardware 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2024Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request Forgery (CSRF).CVE-2024-8458 · Other software · PLANET Technology · reported by twcert@cert.org.twHigh 8.8
Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request Forgery (CSRF). An unauthenticated remote attacker can trick a user into visiting a malicious website, allowing the attacker to impersonate the user and perform actions on their behalf, such as creating accounts.
- Product
- GS-4210-24PL4C hardware 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2024Certain switch models from PLANET Technology have a web application that does not properly validate specific parameters, allowing remote authenticated users witCVE-2024-8457 · Other software · PLANET Technology · reported by twcert@cert.org.twMedium 4.8
Certain switch models from PLANET Technology have a web application that does not properly validate specific parameters, allowing remote authenticated users with administrator privileges to inject arbitrary JavaScript, leading to Stored XSS attack.
- Product
- GS-4210-24PL4C hardware 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2024Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackersCVE-2024-8456 · Other software · PLANET Technology · reported by twcert@cert.org.twCritical 9.8
Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices.
- Product
- GS-4210-24PL4C hardware 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2024The swctrl service is used to detect and remotely manage PLANET Technology devices.CVE-2024-8455 · Other software · PLANET Technology · reported by twcert@cert.org.twHigh 8.1
The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote attackers who intercept the packets can directly crack them to obtain plaintext passwords.
- Product
- GS-4210-24PL4C hardware 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2024The swctrl service is used to detect and remotely manage PLANET Technology devices.CVE-2024-8454 · Other software · PLANET Technology · reported by twcert@cert.org.twMedium 5.3
The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have a Denial-of-Service vulnerability in the swctrl service, allowing unauthenticated remote attackers to send crafted packets that can crash the service.
- Product
- GS-4210-24PL4C hardware 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2024Certain switch models from PLANET Technology use an insecure hashing function to hash user passwords without being salted.CVE-2024-8453 · Other software · PLANET Technology · reported by twcert@cert.org.twMedium 4.9
Certain switch models from PLANET Technology use an insecure hashing function to hash user passwords without being salted. Remote attackers with administrator privileges can read configuration files to obtain the hash values, and potentially crack them to retrieve the plaintext passwords.
- Product
- GS-4210-24PL4C hardware 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2024Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowinCVE-2024-8452 · Other software · PLANET Technology · reported by twcert@cert.org.twHigh 7.5
Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially.
- Product
- GS-4210-24PL4C hardware 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2024Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authenticated connection requests, allowing unauthorizedCVE-2024-8451 · Other software · PLANET Technology · reported by twcert@cert.org.twHigh 7.5
Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authenticated connection requests, allowing unauthorized remote attackers to exploit this weakness to occupy connection slots and prevent legitimate users from accessing the SSH service.
- Product
- GS-4210-24PL4C hardware 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2024Certain switch models from PLANET Technology have a Hard-coded community string in the SNMPv1 service, allowing unauthorized remote attackers to use this communCVE-2024-8450 · Other software · PLANET Technology · reported by twcert@cert.org.twHigh 8.6
Certain switch models from PLANET Technology have a Hard-coded community string in the SNMPv1 service, allowing unauthorized remote attackers to use this community string to access the SNMPv1 service with read-write privileges.
- Product
- GS-4210-24PL4C hardware 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2024Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to connCVE-2024-8449 · Other software · PLANET Technology · reported by twcert@cert.org.twMedium 6.8
Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to connect to the device via the serial console and use this credential to reset any user's password.
- Product
- GS-4210-24PL4C hardware 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2024Certain switch models from PLANET Technology have a hard-coded credential in the specific command-line interface, allowing remote attackers with regular privileCVE-2024-8448 · Other software · PLANET Technology · reported by twcert@cert.org.twHigh 8.8
Certain switch models from PLANET Technology have a hard-coded credential in the specific command-line interface, allowing remote attackers with regular privilege to log in with this credential and obtain a Linux root shell.
- Product
- GS-4210-24PL4C hardware 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 23, 2024The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtaCVE-2024-43201 · Other software · Planet Fitness · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.7
The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information. Planet Fitness first addressed this vulnerability in version 9.8.12 (released on 2024-07-25) and more recently in version 9.9.13 (released on 2025-02-11).
- Product
- Planet Fitness Workouts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapps.apple.comdontvacuum.me
Apr 10, 2024Operating system command injection vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528.CVE-2024-2742 · Other software · Planet · reported by cve-coordination@incibe.esMedium 6.4
Operating system command injection vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. An authenticated attacker could execute arbitrary code on the remote host by exploiting IP address functionality.
- Product
- IGS-4215-16T2S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2024Cross-Site Request Forgery (CSRF) vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528.CVE-2024-2741 · Other software · Planet · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. This vulnerability could allow a remote attacker to trick some authenticated users into performing actions in their session, such as adding or updating accounts through the Switch web interface.
- Product
- IGS-4215-16T2S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2024Information exposure vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528.CVE-2024-2740 · Other software · Planet · reported by cve-coordination@incibe.esHigh 7.7
Information exposure vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. This vulnerability could allow a remote attacker to access some administrative resources due to lack of proper management of the Switch web interface.
- Product
- IGS-4215-16T2S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024 In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation.CVE-2024-2005 · Other software · Blue Planet · reported by 7bd90cf1-1651-495e-9ae8-9415fb3c9febCritical 9
In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected. Blue Planet® has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.
- Product
- Inventory (BPI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2024A vulnerability was found in planet-freo up to 20150116 and classified as problematic.CVE-2015-10129 · Other software · samwilson · reported by VulDBLow 3.7
A vulnerability was found in planet-freo up to 20150116 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/inc/auth.inc.php. The manipulation of the argument auth leads to incorrect comparison. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 6ad38c58a45642eb8c7844e2f272ef199f59550d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-252716.
- Product
- planet-freo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2024Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead tCVE-2023-4472 · Other software · Objectplanet · reported by mandiant-cve@google.comCritical 9.8
Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application.
- Product
- Opinio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comobjectplanet.com
Jan 8, 2024WP Blogs' Planetarium: Does not have CSRF check in placeCVE-2023-6532 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Blogs' Planetarium WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP Blogs' Planetarium
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Blogs' Planetarium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jun 7, 2023An issue in Planet Technologies WDRT-1800AX v1.01-CP21 allows attackers to bypass authentication and escalate privileges to root via manipulation of the LoginStCVE-2023-33553 · Other software · Planet · reported by MITRECritical 9.8
An issue in Planet Technologies WDRT-1800AX v1.01-CP21 allows attackers to bypass authentication and escalate privileges to root via manipulation of the LoginStatus cookie.
- Product
- Wdrt-1800ax Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.complanet.com.tw
May 12, 2023Planet is software that provides satellite data.CVE-2023-32303 · Other software · planetlabs · reported by GitHubMedium 5.2
Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in version 2.0.1. As a workaround, set the secret file permissions to only user read/write by hand.
- Product
- planet-client-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability has been found in frontaccounting faplanet and classified as critical.CVE-2014-125080 · Other software · frontaccounting · reported by VulDBMedium 5.5
A vulnerability has been found in frontaccounting faplanet and classified as critical. This vulnerability affects unknown code. The manipulation leads to path traversal. The patch is identified as a5dcd87f46080a624b1a9ad4b0dd035bbd24ac50. It is recommended to apply a patch to fix this issue. VDB-218398 is the identifier assigned to this vulnerability.
- Product
- faplanet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSOCVE-2023-22460 · Other software · ipld · reported by GitHubHigh 7.5
go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Encoding data which contains a Bytes kind Node will pass a Bytes token to the JSON encoder which will panic as it doesn't expect to receive Bytes tokens. Such an encode should be treated as an error, as plain JSON should not be able to encode Bytes. This only impacts uses of the `json` codec. `dag-json` is not impacted. Use of `json` as a decoder is not impacted. This issue is fixed in v0.19.0. As a workaround, one may prefer the `dag-json` codec, which has the ability to encode bytes.
- Product
- go-ipld-prime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upload Document.CVE-2022-45896 · Other software · Planetestream · reported by MITRECritical 9.8
Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upload Document. Upload2.ashx can be used, or Ajax.asmx/ProcessUpload2. This leads to remote code execution.
- Product
- Planet Estream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec-consult.comsec-consult.com
Dec 25, 2022Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source code for Default.aspx in some situations) anCVE-2022-45895 · Other software · Planetestream · reported by MITREMedium 6.5
Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source code for Default.aspx in some situations) and the WhoAmI endpoint (e.g., path disclosure).
- Product
- Planet Estream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec-consult.comsec-consult.com
Dec 25, 2022GetFile.aspx in Planet eStream before 6.72.10.07 allows ..\ directory traversal to read arbitrary local files.CVE-2022-45894 · Other software · Planetestream · reported by MITREMedium 6.5
GetFile.aspx in Planet eStream before 6.72.10.07 allows ..\ directory traversal to read arbitrary local files.
- Product
- Planet Estream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec-consult.comsec-consult.com
Dec 25, 2022Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing the value of the ONCVE-2022-45893 · Other software · Planetestream · reported by MITREHigh 8.8
Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing the value of the ON cookie. A brute-force attack can calculate a value that provides permanent access.
- Product
- Planet Estream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec-consult.comsec-consult.com
Dec 24, 2022In Planet eStream before 6.72.10.07, multiple Stored Cross-Site Scripting (XSS) vulnerabilities exist: Disclaimer, Search Function, Comments, Batch editing toolCVE-2022-45892 · Other software · Planetestream · reported by MITREMedium 5.4
In Planet eStream before 6.72.10.07, multiple Stored Cross-Site Scripting (XSS) vulnerabilities exist: Disclaimer, Search Function, Comments, Batch editing tool, Content Creation, Related Media, Create new user, and Change Username.
- Product
- Planet Estream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec-consult.comsec-consult.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.