Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
63 results · page 2 of 2
Aug 21, 2019An exploitable out-of-bounds read vulnerability exists in the LabelSst record parser of Aspose Aspose.Cells 19.1.0 library.CVE-2019-5032 · Other software · Aspose · reported by talos-cna@cisco.comHigh 8.8
An exploitable out-of-bounds read vulnerability exists in the LabelSst record parser of Aspose Aspose.Cells 19.1.0 library. A specially crafted XLS file can cause an out-of-bounds read, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.
- Product
- Aspose.cells
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jun 19, 2019Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database column/table name as pCVE-2019-12903 · Other software · Pydio · reported by MITREMedium 4.3
Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database column/table name as pert of the error message, exposing sensitive information.
- Product
- Cells
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpydio.comresearch.loginsoft.com
Jun 19, 2019Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion.CVE-2019-12902 · Other software · Pydio · reported by MITREMedium 6.5
Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data.
- Product
- Cells
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpydio.comresearch.loginsoft.com
Jun 19, 2019Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an uCVE-2019-12901 · Other software · Pydio · reported by MITREHigh 8.8
Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an unprivileged directory, leading to Privilege escalation.
- Product
- Cells
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpydio.comresearch.loginsoft.com
Oct 12, 2018Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the pCVE-2018-15755 · Other software · Cloud Foundry · reported by security_alert@emc.comMedium 6.6
Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. A remote authenticated malicious user with mTLS certs can issue arbitrary SQL queries and gain access to the policy server.
- Product
- CF Networking Release
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudfoundry.orgcloudfoundry.org
May 17, 2018Windows 2012R2 stemcells, versions prior to 1200.17, contain an information exposure vulnerability on vSphere.CVE-2018-1276 · Other software · Cloud Foundry · reported by security_alert@emc.comMedium 6.5
Windows 2012R2 stemcells, versions prior to 1200.17, contain an information exposure vulnerability on vSphere. A remote user with the ability to push apps can execute crafted commands to read the IaaS metadata from the VM, which may contain BOSH credentials.
- Product
- Windows2012R2 stemcell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudfoundry.orgcloudfoundry.org
Mar 19, 2018In Windows Stemcells versions prior to 1200.14, apps running inside containers in Windows on Google Cloud Platform are able to access the metadata endpoint.CVE-2018-1197 · Other software · Dell EMC · reported by security_alert@emc.comHigh 8.5
In Windows Stemcells versions prior to 1200.14, apps running inside containers in Windows on Google Cloud Platform are able to access the metadata endpoint. A malicious developer could use this access to gain privileged credentials.
- Product
- Windows Stemcells
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudfoundry.orgcloudfoundry.org
Dec 28, 2017Cells Blog 3.5 has SQL Injection via the pub_readpost.php ptid parameter.CVE-2017-17950 · Other software · Cells · reported by MITREHigh 8.8
Cells Blog 3.5 has SQL Injection via the pub_readpost.php ptid parameter.
- Product
- Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017Cells Blog 3.5 has XSS via the pub_readpost.php fmid parameter.CVE-2017-17949 · Other software · Cells · reported by MITREMedium 6.1
Cells Blog 3.5 has XSS via the pub_readpost.php fmid parameter.
- Product
- Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request.CVE-2017-17948 · Other software · Cells · reported by MITREMedium 6.1
Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request.
- Product
- Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2017An exploitable out-of-bounds write vulnerability exists in the xls_mergedCells function of libxls 1.4.CVE-2017-2896 · Other software · libxls · reported by talos-cna@cisco.comHigh 7.8
An exploitable out-of-bounds write vulnerability exists in the xls_mergedCells function of libxls 1.4. . A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
- Product
- libxls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgdebian.org
Jul 30, 2007Tor before 0.1.2.15 sends "destroy cells" containing the reason for tearing down a circuit, which allows remote attackers to obtain sensitive information, contrCVE-2007-4097 · Other software · TOR · reported by MITREMedium 6.4
Tor before 0.1.2.15 sends "destroy cells" containing the reason for tearing down a circuit, which allows remote attackers to obtain sensitive information, contrary to specifications.
- Product
- TOR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.seul.orgosvdb.org
Apr 21, 2006Apple Safari 2.0.3 allows remote attackers to cause a denial of service and possibly execute code via a large CELLSPACING attribute in a TABLE tag, which triggeCVE-2006-1986 · Computers, phones & browsers · Apple · reported by MITREHigh 7.5
Apple Safari 2.0.3 allows remote attackers to cause a denial of service and possibly execute code via a large CELLSPACING attribute in a TABLE tag, which triggers an error in KWQListIteratorImpl::KWQListIteratorImpl.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurity-protocols.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.