Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
82 results · page 2 of 2
Nov 26, 2018Incorrect access controls in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allow attackers to call dangerous internal functions via the "method" parameter.CVE-2018-13321 · Other software · Buffalo · reported by MITREHigh 8.8
Incorrect access controls in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allow attackers to call dangerous internal functions via the "method" parameter.
- Product
- Ts5600d1206 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
Nov 26, 2018System Command Injection in network.set_auth_settings in Buffalo TS5600D1206 version 3.70-0.10 allows attackers to execute system commands via the adminUsernameCVE-2018-13320 · Other software · Buffalo · reported by MITREHigh 7.2
System Command Injection in network.set_auth_settings in Buffalo TS5600D1206 version 3.70-0.10 allows attackers to execute system commands via the adminUsername and adminPassword parameters.
- Product
- Ts5600d1206 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
Nov 26, 2018Incorrect access control in get_portal_info in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device information via an unauthentCVE-2018-13319 · Other software · Buffalo · reported by MITREHigh 7.5
Incorrect access control in get_portal_info in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device information via an unauthenticated POST request.
- Product
- Ts5600d1206 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
Nov 26, 2018System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the "name" parameter.CVE-2018-13318 · Other software · Buffalo · reported by MITREHigh 7.2
System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the "name" parameter.
- Product
- Ts5600d1206 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
Apr 9, 2018Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.CVE-2018-0556 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpHigh 8.8
Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.
- Product
- WZR-1750DHP2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2018Buffer overflow in Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary code via a specially crafted file.CVE-2018-0555 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpHigh 7.8
Buffer overflow in Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary code via a specially crafted file.
- Product
- WZR-1750DHP2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2018Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspecified vectors.CVE-2018-0554 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpHigh 8.8
Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspecified vectors.
- Product
- WZR-1750DHP2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2018Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.CVE-2018-0523 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpHigh 8.8
Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.
- Product
- WXR-1900DHP2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2018Buffer overflow in Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary code via a specially crafted file.CVE-2018-0522 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpHigh 7.8
Buffer overflow in Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary code via a specially crafted file.
- Product
- WXR-1900DHP2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2018Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspecified vectCVE-2018-0521 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpHigh 8.8
Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspecified vectors.
- Product
- WXR-1900DHP2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2017Input validation issue in Buffalo BBR-4HG and and BBR-4MG broadband routers with firmware 1.00 to 1.48 and 2.00 to 2.07 allows an attacker to cause the device tCVE-2017-10897 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpMedium 4.5
Input validation issue in Buffalo BBR-4HG and and BBR-4MG broadband routers with firmware 1.00 to 1.48 and 2.00 to 2.07 allows an attacker to cause the device to become unresponsive via unspecified vectors.
- Product
- BBR-4HG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2017Cross-site scripting vulnerability in Buffalo BBR-4HG and and BBR-4MG broadband routers with firmware 1.00 to 1.48 and 2.00 to 2.07 allows an attacker to injectCVE-2017-10896 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Buffalo BBR-4HG and and BBR-4MG broadband routers with firmware 1.00 to 1.48 and 2.00 to 2.07 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
- Product
- BBR-4HG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2017Buffalo WCR-1166DS devices with firmware 1.30 and earlier allow an attacker to execute arbitrary OS commands via unspecified vectors.CVE-2017-10811 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpMedium 6.8
Buffalo WCR-1166DS devices with firmware 1.30 and earlier allow an attacker to execute arbitrary OS commands via unspecified vectors.
- Product
- WCR-1166DS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2017Cross-site scripting vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to inject arbitrary CVE-2017-2274 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- WMR-433
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2017Cross-site request forgery (CSRF) vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to hijaCVE-2017-2273 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- Product
- WMR-433
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2017WAPM-1166D firmware Ver.1.2.7 and earlier, WAPM-APG600H firmware Ver.1.16.1 and earlier allows remote attackers to bypass authentication and access the configurCVE-2017-2126 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpCritical 9.8
WAPM-1166D firmware Ver.1.2.7 and earlier, WAPM-APG600H firmware Ver.1.16.1 and earlier allows remote attackers to bypass authentication and access the configuration interface via unspecified vectors.
- Product
- WAPM-1166D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2017Directory traversal vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to read arbitrary files viCVE-2016-7826 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpMedium 6.5
Directory traversal vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to read arbitrary files via specially crafted POST requests.
- Product
- WNC01WH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbuffalo.jpsecurityfocus.com
Jun 9, 2017Directory traversal vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to read arbitrary files viCVE-2016-7825 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpMedium 6.5
Directory traversal vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to read arbitrary files via specially crafted commands.
- Product
- WNC01WH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbuffalo.jpsecurityfocus.com
Jun 9, 2017Buffalo NC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to bypass access restriction to enable the debug option via unspCVE-2016-7824 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpHigh 8.8
Buffalo NC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to bypass access restriction to enable the debug option via unspecified vectors.
- Product
- WNC01WH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbuffalo.jpsecurityfocus.com
Jun 9, 2017Cross-site scripting vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to inject arbitrary web sCVE-2016-7823 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- WNC01WH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbuffalo.jpsecurityfocus.com
Jun 9, 2017Cross-site request forgery (CSRF) vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows remote attackers to hijack the autheCVE-2016-7822 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows remote attackers to hijack the authentication of a logged in user to perform unintended operations via unspecified vectors.
- Product
- WNC01WH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbuffalo.jpsecurityfocus.com
Jun 9, 2017Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allow remote attackers to cause a denial of service against the management screen via unspecifCVE-2016-7821 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpMedium 6.5
Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allow remote attackers to cause a denial of service against the management screen via unspecified vectors.
- Product
- WNC01WH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbuffalo.jpsecurityfocus.com
Apr 28, 2017WNC01WH firmware 1.0.0.9 and earlier allows authenticated attackers to execute arbitrary OS commands via unspecified vectors.CVE-2017-2152 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpMedium 6.8
WNC01WH firmware 1.0.0.9 and earlier allows authenticated attackers to execute arbitrary OS commands via unspecified vectors.
- Product
- WNC01WH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2016BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices allow remote attackers to discover credentials and other sensitive informatioCVE-2016-4816 · Other software · Buffalo · reported by vultures@jpcert.or.jpMedium 6.5
BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices allow remote attackers to discover credentials and other sensitive information via unspecified vectors.
- Product
- Wzr-600dhp3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2016Directory traversal vulnerability on BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices with firmware 2.16 and earlier allows reCVE-2016-4815 · Other software · Buffalo · reported by vultures@jpcert.or.jpHigh 7.5
Directory traversal vulnerability on BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices with firmware 2.16 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
- Product
- Wzr-900dhp2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2016Cross-site scripting (XSS) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166DHCVE-2016-1135 · Other software · Buffalotech · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166DHP devices with firmware 1.90 and earlier, WHR-300HP2 devices with firmware 1.90 and earlier, WHR-600D devices with firmware 1.90 and earlier, WMR-300 devices with firmware 1.90 and earlier, WMR-433 devices with firmware 1.01 and earlier, and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Wmr-300 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2016Cross-site request forgery (CSRF) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHRCVE-2016-1134 · Other software · Buffalotech · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166DHP devices with firmware 1.90 and earlier, WHR-300HP2 devices with firmware 1.90 and earlier, WHR-600D devices with firmware 1.90 and earlier, WMR-300 devices with firmware 1.90 and earlier, WMR-433 devices with firmware 1.01 and earlier, and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to hijack the authentication of arbitrary users.
- Product
- Whr-1166dhp Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2015Buffalo WZR-600DHP2 devices with firmware 2.09, 2.13, and 2.16 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes itCVE-2015-8262 · Other software · Buffalotech · reported by cret@cert.orgMedium 6.8
Buffalo WZR-600DHP2 devices with firmware 2.09, 2.13, and 2.16 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value.
- Product
- Airstation Extreme N600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comkb.cert.org
Jun 8, 2015The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 and earlier, WEX-300CVE-2014-9284 · Other software · Buffalotech · reported by vultures@jpcert.or.jpHigh 7.7
The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 and earlier, WEX-300 1.60 and earlier, and BHR-4GRV2 1.04 and earlier routers allow remote authenticated users to execute arbitrary OS commands via unspecified vectors.
- Product
- Wsr-600dhp Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2011Multiple cross-site request forgery (CSRF) vulnerabilities in the management screen on Buffalo WHR, WZR2, WZR, WER, and BBR series routers with firmware 1.x; BHCVE-2011-1324 · Other software · Buffalotech · reported by vultures@jpcert.or.jpMedium 5.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the management screen on Buffalo WHR, WZR2, WZR, WER, and BBR series routers with firmware 1.x; BHR-4RV and FS-G54 routers with firmware 2.x; and AS-100 routers allow remote attackers to hijack the authentication of administrators for requests that modify settings, as demonstrated by changing the login password.
- Product
- Bbr-4hg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2007Cross-site request forgery (CSRF) vulnerability in the device management interface in Buffalo AirStation WHR-G54S 1.20 allows remote attackers to make configuraCVE-2007-4822 · Other software · Buffalotech · reported by MITREMedium 4.3
Cross-site request forgery (CSRF) vulnerability in the device management interface in Buffalo AirStation WHR-G54S 1.20 allows remote attackers to make configuration changes as an administrator via HTTP requests to certain HTML pages in the res parameter with an inp req parameter to cgi-bin/cgi, as demonstrated by accessing (1) ap.html and (2) filter_ip.html.
- Product
- Airstation Whr-g54s
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2006Cross-site request forgery (CSRF) vulnerability in the administrative interface for the TeraStation HD-HTGL firmware 2.05 beta 1 and earlier allows remote attacCVE-2006-5175 · Other software · Buffalo-technology · reported by MITREHigh 7.6
Cross-site request forgery (CSRF) vulnerability in the administrative interface for the TeraStation HD-HTGL firmware 2.05 beta 1 and earlier allows remote attackers to modify configurations or delete arbitrary data via unspecified vectors.
- Product
- Terastation Hd-htgl Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.