Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

512new WordPress flaws this week

391,181entries in the database

1,743 results · page 22 of 35

Nov 2, 2021Use after free in Profiles in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who convinced a user to engage in specific gestures to potentially eCVE-2021-37988 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Profiles in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who convinced a user to engage in specific gestures to potentially exploit heap corruption via a crafted HTML page.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com crbug.com
Nov 2, 2021An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile tCVE-2021-26107 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 6.3
An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile to modify the VPN tunnel status of other VDOMs using VPN Manager.
Product
Fortinet FortiManager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortiguard.com
Oct 21, 2021On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectionalCVE-2021-28496 · Other software · Arista Networks · reported by psirt@arista.comMedium 5.7
On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectional Forwarding Detection (BFD) will be leaked when displaying output over eAPI or other JSON outputs to other authenticated users on the device. The affected EOS Versions are: all releases in 4.22.x train, 4.23.9 and below releases in the 4.23.x train, 4.24.7 and below releases in the 4.24.x train, 4.25.4 and below releases in the 4.25.x train, 4.26.1 and below releases in the 4.26.x train
Product
Arista EOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arista.com arista.com
Oct 14, 2021In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable CVE-2021-36388 · Other software · Yellowfinbi · reported by MITREHigh 7.5
In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".
Product
Yellowfin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org cyberaz0r.info
Oct 13, 2021The Profile Name field in the floor plan (Network Menu) page in Draytek VigorConnect 1.6.0-B3 was found to be vulnerable to stored XSS, as user input is not proCVE-2021-20128 · Network & remote access · Draytek · reported by vulnreport@tenable.comMedium 5.4
The Profile Name field in the floor plan (Network Menu) page in Draytek VigorConnect 1.6.0-B3 was found to be vulnerable to stored XSS, as user input is not properly sanitized.
Product
Vigorconnect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
Oct 8, 2021A Cross-Site Request Forgery (CSRF) vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrative profile and add aCVE-2021-41916 · Other software · Webtareas Project · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrative profile and add a new user to the new profile. without the victim's knowledge, by enticing an authenticated admin user to visit an attacker's web page.
Product
Webtareas
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record n4nj0.github.io n4nj0.github.io
Oct 6, 2021In lockAllProfileTasks of RootWindowContainer.java, there is a possible way to access the work profile without the profile PIN, after logging in.CVE-2021-0595 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In lockAllProfileTasks of RootWindowContainer.java, there is a possible way to access the work profile without the profile PIN, after logging in. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-177457096
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Oct 4, 2021User Registration: Does not properly sanitise the user_registration_profile_pic_url valueCVE-2021-24654 · WordPress plugins & themes · reported by WPScanMedium 5.4
The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url value when submitted directly via the user_registration_update_profile_details AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attacks when their profile is viewed
Product
User Registration
Fixed in
2.0.2
What to do
Update User Registration to 2.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 30, 2021Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter.CVE-2021-41325 · Other software · Pydio · reported by MITREMedium 6.5
Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. (In addition, such users can be granted several admin permissions via the Roles parameter.)
Product
Cells
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record charonv.net github.com
Sep 17, 2021In Ericsson ECM before 18.0, it was observed that Security Management Endpoint in User Profile Management Section is vulnerable to stored XSS via a name, leadinCVE-2021-41391 · Other software · Ericsson · reported by MITREMedium 5.4
In Ericsson ECM before 18.0, it was observed that Security Management Endpoint in User Profile Management Section is vulnerable to stored XSS via a name, leading to session hijacking and full account takeover.
Product
Enterprise Content Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record the-it-wonders.blogspot.com the-it-wonders.blogspot.com
Sep 17, 2021In Ericsson ECM before 18.0, it was observed that Security Provider Endpoint in the User Profile Management Section is vulnerable to CSV Injection.CVE-2021-41390 · Other software · Ericsson · reported by MITREHigh 8
In Ericsson ECM before 18.0, it was observed that Security Provider Endpoint in the User Profile Management Section is vulnerable to CSV Injection.
Product
Enterprise Content Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record the-it-wonders.blogspot.com the-it-wonders.blogspot.com
Sep 14, 2021On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs CVE-2021-23028 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall (WAF)/BIG-IP ASM security policy and applied to a virtual server, undisclosed requests may cause the BIG-IP ASM bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Product
Big-ip Advanced Web Application Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.f5.com support.f5.com
Sep 14, 2021On version 16.0.x before 16.0.1.2, when a BIG-IP ASM and DataSafe profile are configured on a virtual server, undisclosed requests can cause the Traffic ManagemCVE-2021-23036 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
On version 16.0.x before 16.0.1.2, when a BIG-IP ASM and DataSafe profile are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Product
Big-ip Advanced Web Application Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.f5.com support.f5.com
Sep 14, 2021On BIG-IP 14.1.x before 14.1.4.4, when an HTTP profile is configured on a virtual server, after a specific sequence of packets, chunked responses can cause the CVE-2021-23035 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
On BIG-IP 14.1.x before 14.1.4.4, when an HTTP profile is configured on a virtual server, after a specific sequence of packets, chunked responses can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Product
Big-ip Access Policy Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.f5.com support.f5.com
Sep 14, 2021On BIG-IP version 16.x before 16.1.0 and 15.1.x before 15.1.3.1, when a DNS profile using a DNS cache resolver is configured on a virtual server, undisclosed reCVE-2021-23034 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
On BIG-IP version 16.x before 16.1.0 and 15.1.x before 15.1.3.1, when a DNS profile using a DNS cache resolver is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Product
Big-ip Access Policy Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.f5.com support.f5.com
Sep 14, 2021On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6, when an HTTP profile is coCVE-2021-23042 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6, when an HTTP profile is configured on a virtual server, undisclosed requests can cause a significant increase in system resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Product
Big-ip Access Policy Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.f5.com support.f5.com
Sep 13, 2021Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the profile parameter whichCVE-2021-33547 · Other software · Geutebrück · reported by info@cert.vde.comHigh 7.2
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the profile parameter which may allow an attacker to remotely execute arbitrary code.
Product
E2 Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov randorisec.fr
Sep 6, 2021An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user profile to access thCVE-2021-24006 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 6.3
An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user profile to access the SD-WAN Orchestrator panel via directly visiting its URL.
Product
Fortinet FortiManager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortiguard.com
Aug 25, 2021An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.CVE-2021-21869 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
Product
Codesys
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com talosintelligence.com
Aug 24, 2021Description: A memory corruption issue in the processing of ICC profiles was addressed with improved input validation.CVE-2021-30942 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
Description: A memory corruption issue in the processing of ICC profiles was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, Security Update 2021-008 Catalina, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing a maliciously crafted image may lead to arbitrary code execution.
Product
watchOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com support.apple.com
Aug 24, 2021Description: A memory corruption issue in the processing of ICC profiles was addressed with improved input validation.CVE-2021-30926 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
Description: A memory corruption issue in the processing of ICC profiles was addressed with improved input validation. This issue is fixed in macOS Monterey 12.1, watchOS 8.3, iOS 15.2 and iPadOS 15.2, tvOS 15.2. Processing a maliciously crafted image may lead to arbitrary code execution.
Product
watchOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Aug 24, 2021A memory corruption issue existed in the processing of ICC profiles.CVE-2021-30917 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A memory corruption issue existed in the processing of ICC profiles. This issue was addressed with improved input validation. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1, Security Update 2021-007 Catalina, macOS Big Sur 11.6.1. Processing a maliciously crafted image may lead to arbitrary code execution.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com support.apple.com
Aug 18, 2021An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development SysteCVE-2021-21867 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
Product
Codesys
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com talosintelligence.com
Aug 18, 2021Improper input validation vulnerability in User Profile of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of User ProfileCVE-2021-20760 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 4.3
Improper input validation vulnerability in User Profile of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of User Profile without the appropriate privilege.
Product
Cybozu Garoon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cs.cybozu.co.jp jvn.jp
Aug 16, 2021User Registration & User Profile – Profile Builder: Has a bug allowing any user to reset the password of the admin of the blogCVE-2021-24527 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.
Product
User Registration & User Profile – Profile Builder
Fixed in
3.4.9
What to do
Update User Registration & User Profile – Profile Builder to 3.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 13, 2021Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argumentCVE-2021-37347 · Other software · Nagios · reported by MITREHigh 7.8
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argument.
Product
Nagios XI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nagios.com nagios.com
Aug 12, 2021Microsoft Windows User Profile Service Privilege Escalation VulnerabilityCVE-2021-34484 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Aug 12, 2021Windows User Account Profile Picture Elevation of Privilege VulnerabilityCVE-2021-26426 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Windows User Account Profile Picture Elevation of Privilege Vulnerability
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com portal.msrc.microsoft.com
Aug 10, 2021Cross Site Scripting (XSS) vulnerability in TRENDnet TV-IP110WN V1.2.2.64 V1.2.2.65 V1.2.2.68 via the profile parameter.CVE-2021-31655 · Other software · Trendnet · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in TRENDnet TV-IP110WN V1.2.2.64 V1.2.2.65 V1.2.2.68 via the profile parameter. in a GET request in view.cgi.
Product
Tv-ip110wn Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 9, 2021The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/registCVE-2021-24522 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could be used in an XSS attack which could lead to wp-admin access. Further, the plugin in several places assigned $_POST as $_GET which meant that in some cases this could be replicated with just $_GET parameters and no need for $_POST values.
Product
User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar)
Fixed in
3.1.11
What to do
Update User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) to 3.1.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 5, 2021A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has either Citrix Profile MCVE-2021-22928 · Network & remote access · Citrix · reported by support@hackerone.comHigh 7.8
A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has either Citrix Profile Management or Citrix Profile Management WMI Plugin installed to escalate their privilege level on that Windows VDA to SYSTEM.
Product
Virtual Apps And Desktops
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.citrix.com support.citrix.com
Aug 5, 2021A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.1CVE-2021-21863 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
Product
Development System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com customers.codesys.com
Aug 2, 2021A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development SysteCVE-2021-21866 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
Product
Development System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com talosintelligence.com
Aug 2, 2021User Profile Picture: Was affected by an IDOR issueCVE-2021-24473 · WordPress plugins & themes · reported by WPScanMedium 5.4
The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and above) to change and delete the profile pictures of other users (including those with higher roles).
Product
User Profile Picture
Fixed in
2.6.0
What to do
Update User Profile Picture to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar): Did not sanitise or escape some of its settings before saving them and outputting them back in the pageCVE-2021-24450 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Product
User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar)
Fixed in
3.1.8
What to do
Update User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) to 3.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021User Registration & User Profile – Profile Builder: Does not sanitise or escape its 'Modify default Redirect Delay timer' settingCVE-2021-24448 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Product
User Registration & User Profile – Profile Builder
Fixed in
3.4.8
What to do
Update User Registration & User Profile – Profile Builder to 3.4.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership: Does not properly sanitise its Biography fieldCVE-2021-24443 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the affected user profile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an admin, inducing them to view their profile with a malicious payload adding a rogue account for example.
Product
About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership
Fixed in
1.0.7
What to do
Update About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership to 1.0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 23, 2021Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows authenticated attackersCVE-2021-25791 · Other software · Online Doctor Appointment System PHP Full Source Code Project · reported by MITREMedium 5.4
Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in the First Name, Last Name, and Address text fields.
Product
Online Doctor Appointment System PHP Full Source Code
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com sourcecodester.com
Jul 22, 2021Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile.CVE-2020-7390 · Other software · Sage · reported by cve@rapid7.comMedium 4.6
Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address" fields of this web application component. Updates are available for on-premises versions of Version 12 (components shipped with Syracuse 12.10.0 and later) of Sage X3. Other on-premises versions of Sage X3 are unaffected or unsupported by the vendor.
Product
X3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rapid7.com sagecity.com
Jul 14, 2021Cross Site Scripting (XSS) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 via the (1) "About Yourself” section under the “My ProfileCVE-2020-25444 · Other software · Bookingcore · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 via the (1) "About Yourself” section under the “My Profile” page, " (2) “Hotel Policy” field under the “Hotel Details” page, (3) “Pricing code” and “name” fields under the “Manage Tour” page, and (4) all the labels under the “Menu” section.
Product
Booking Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com medium.com
Jul 14, 2021In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account names due to a missing permission check.CVE-2021-0597 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account names due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-176496502
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Jul 7, 2021A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users CVE-2021-34624 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for userCVE-2021-34623 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible fCVE-2021-34622 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administrator while editing their profile. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible foCVE-2021-34621 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordfence.com
Jul 7, 2021A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile page via using a speciCVE-2021-22231 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.5
A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile page via using a specially crafted username.
Product
GitLab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com gitlab.com
Jul 2, 2021An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36.CVE-2021-36130 · Other software · Mediawiki · reported by MITREMedium 4.8
An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36. Within several gift-related special pages, a privileged user with the awardmanage right could inject arbitrary HTML and JavaScript within various gift-related data fields. The attack could easily propagate across many pages for many users.
Product
Mediawiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gerrit.wikimedia.org phabricator.wikimedia.org
Jun 22, 2021In onReceive of DevicePolicyManagerService.java, there is a possible enabling of disabled profiles due to a missing permission check.CVE-2021-0568 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onReceive of DevicePolicyManagerService.java, there is a possible enabling of disabled profiles due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-170121238
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Jun 10, 2021An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switch button within the CVE-2021-34546 · Other software · Netsetman · reported by MITREMedium 6.8
An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switch button within the Windows logon screen enabled, is able to drop to an administrative shell and execute arbitrary commands as SYSTEM via the "save log to file" feature. To accomplish this, the attacker can navigate to cmd.exe.
Product
Netsetman
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 9, 2021Insecure inherited permissions in the installer for the Intel(R) VTune(TM) Profiler before version 2021.1.1 may allow an authenticated user to potentially enablCVE-2021-0077 · Other software · Intel · reported by secure@intel.comHigh 7.8
Insecure inherited permissions in the installer for the Intel(R) VTune(TM) Profiler before version 2021.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Product
Vtune Profiler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.