Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

38added in the last 30 days

561new WordPress flaws this week

398,769entries in the database

15,425 results · page 270 of 309

Jan 18, 2012Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote authenticated users to affect inCVE-2011-2271 · Other software · Oracle · reported by secalert_us@oracle.comLow 3.5
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote authenticated users to affect integrity via unknown vectors related to Attachments / File Upload.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Jan 18, 2012The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted iCVE-2012-0781 · Websites & servers · PHP · reported by MITREMedium 5
The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that attempts to perform Tidy::diagnose operations on invalid objects, a different vulnerability than CVE-2011-4153.
Product
PHP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com cxsecurity.com
Jan 14, 2012The SibRaRecoverableSiXaResource class in the Default Messaging Component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 does not properly handleCVE-2011-5066 · Other software · IBM · reported by MITRELow 2.1
The SibRaRecoverableSiXaResource class in the Default Messaging Component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 does not properly handle a Service Integration Bus (SIB) dump operation involving the First Failure Data Capture (FFDC) introspection code, which allows local users to obtain sensitive information by reading the FFDC log file.
Product
Websphere Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com www-01.ibm.com
Jan 14, 2012Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 allows remote attackers to inject arbitrary web script orCVE-2011-5065 · Other software · IBM · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 allows remote attackers to inject arbitrary web script or HTML via vectors related to web messaging.
Product
Websphere Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com www-01.ibm.com
Jan 14, 2012The Web Services Security component in the Web Services Feature Pack before 6.1.0.41 for IBM WebSphere Application Server (WAS) 6.1 does not properly handle theCVE-2011-1377 · Other software · IBM · reported by MITREHigh 10
The Web Services Security component in the Web Services Feature Pack before 6.1.0.41 for IBM WebSphere Application Server (WAS) 6.1 does not properly handle the enabling of WS-Security for a JAX-WS application, which has unspecified impact and attack vectors.
Product
Websphere Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com www-01.ibm.com
Jan 14, 2012Cross-site scripting (XSS) vulnerability in the Installation Verification Test (IVT) application in the Install component in IBM WebSphere Application Server (WCVE-2011-1362 · Other software · IBM · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Installation Verification Test (IVT) application in the Install component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 and 7.0 before 7.0.0.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1308.
Product
Websphere Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com www-01.ibm.com
Dec 30, 2011TomatoSoft Free Mp3 Player 1.0 allows remote attackers to cause a denial of service (application crash) via a long string in an MP3 file, possibly a buffer overCVE-2011-5043 · Other software · Tomatosoft · reported by MITREMedium 4.3
TomatoSoft Free Mp3 Player 1.0 allows remote attackers to cause a denial of service (application crash) via a long string in an MP3 file, possibly a buffer overflow.
Product
Free Mp3 Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exchange.xforce.ibmcloud.com
Dec 29, 2011Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, comCVE-2011-5035 · Other software · Oracle · reported by MITREMedium 5
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.
Product
Glassfish Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com lists.opensuse.org
Dec 29, 2011Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via (1) tCVE-2011-5025 · Other software · Yaws · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via (1) the tag parameter to editTag.yaws, (2) the index parameter to showOldPage.yaws, (3) the node parameter to allRefsToMe.yaws, or (4) the text parameter to editPage.yaws.
Product
Yaws
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com sitewat.ch
Dec 24, 2011Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5CVE-2011-4862 · Other software · GNU · reported by secteam@freebsd.orgHigh 10
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
Product
Inetutils
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com git.savannah.gnu.org
Dec 20, 2011Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (application crash) oCVE-2011-3665 · Computers, phones & browsers · Mozilla · reported by MITREHigh 7.5
Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an Ogg VIDEO element that is not properly handled after scaling.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Dec 16, 2011Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deploCVE-2011-4760 · Other software · Parallels · reported by MITREMedium 5
Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by smb/email-address/list and certain other files.
Product
Parallels Plesk Small Business Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record xss.cx exchange.xforce.ibmcloud.com
Dec 14, 2011The GetInstalledPackages function in the configuration tool in HP Application Lifestyle Management (ALM) 11 on AIX, HP-UX, and Solaris allows local users to gaiCVE-2011-4834 · Other software · HP · reported by MITREMedium 4.6
The GetInstalledPackages function in the configuration tool in HP Application Lifestyle Management (ALM) 11 on AIX, HP-UX, and Solaris allows local users to gain privileges via (1) a Trojan horse /tmp/tmp.txt FIFO or (2) a symlink attack on /tmp/tmp.txt.
Product
Application Lifestyle Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record 0a29.blogspot.com secunia.com
Dec 13, 2011Buffer overflow in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS) in Microsoft Windows CVE-2011-3406 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Buffer overflow in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote authenticated users to execute arbitrary code via a crafted query that leverages incorrect memory initialization, aka "Active Directory Buffer Overflow Vulnerability."
Product
Windows 7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov docs.microsoft.com
Dec 7, 2011Unspecified vulnerability in the Web Workers implementation in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via uCVE-2011-4686 · Computers, phones & browsers · Opera · reported by MITREMedium 5
Unspecified vulnerability in the Web Workers implementation in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via unknown vectors.
Product
Opera Browser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record opera.com opera.com
Dec 7, 2011Dragonfly in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via unspecified content on a web page, as demonstrated CVE-2011-4685 · Computers, phones & browsers · Opera · reported by MITREMedium 5
Dragonfly in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via unspecified content on a web page, as demonstrated by forbes.com.
Product
Opera Browser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record opera.com opera.com
Nov 11, 2011org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application,CVE-2011-3376 · Websites & servers · Apache · reported by Red HatMedium 4.4
org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality.
Product
Tomcat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record svn.apache.org svn.apache.org
Nov 8, 2011The LDAP over SSL (aka LDAPS) implementation in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (CVE-2011-2014 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 9
The LDAP over SSL (aka LDAPS) implementation in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not examine Certificate Revocation Lists (CRLs), which allows remote authenticated users to bypass intended certificate restrictions and access Active Directory resources by leveraging a revoked X.509 certificate for a domain account, aka "LDAPS Authentication Bypass Vulnerability."
Product
Windows 7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com docs.microsoft.com
Nov 2, 2011Multiple stack-based buffer overflows in GE Intelligent Platforms Proficy Applications before 4.4.1 SIM 101 and 5.x before 5.0 SIM 43 allow remote attackers to CVE-2011-1919 · Other software · GE · reported by cret@cert.orgHigh 10
Multiple stack-based buffer overflows in GE Intelligent Platforms Proficy Applications before 4.4.1 SIM 101 and 5.x before 5.0 SIM 43 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted TCP message traffic to (1) PRProficyMgr.exe in Proficy Server Manager, (2) PRGateway.exe in Proficy Server Gateway, (3) PRRDS.exe in Proficy Remote Data Service, or (4) PRLicenseMgr.exe in Proficy Server License Manager.
Product
Intelligent Platforms Proficy Historian
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com us-cert.gov
Nov 1, 2011Unspecified vulnerability in Investintech.com Absolute PDF Server allows remote attackers to cause a denial of service (application crash) or possibly execute aCVE-2011-4223 · Other software · Investintech · reported by MITREHigh 9.3
Unspecified vulnerability in Investintech.com Absolute PDF Server allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
Product
Absolute PDF Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org exchange.xforce.ibmcloud.com
Nov 1, 2011Unspecified vulnerability in Investintech.com Able2Extract and Able2Extract Server allows remote attackers to cause a denial of service (application crash) or pCVE-2011-4222 · Other software · Investintech · reported by MITREHigh 9.3
Unspecified vulnerability in Investintech.com Able2Extract and Able2Extract Server allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document.
Product
Able2extract
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org exchange.xforce.ibmcloud.com
Nov 1, 2011Unspecified vulnerability in Investintech.com Able2Doc and Able2Doc Professional allows remote attackers to cause a denial of service (application crash) or posCVE-2011-4221 · Other software · Investintech · reported by MITREHigh 9.3
Unspecified vulnerability in Investintech.com Able2Doc and Able2Doc Professional allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document.
Product
Able2doc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org exchange.xforce.ibmcloud.com
Nov 1, 2011Investintech.com SlimPDF Reader does not properly restrict write operations, which allows remote attackers to cause a denial of service (application crash) or pCVE-2011-4216 · Other software · Investintech · reported by MITREHigh 9.3
Investintech.com SlimPDF Reader does not properly restrict write operations, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
Product
Slimpdf Reader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org exchange.xforce.ibmcloud.com
Oct 30, 2011Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.29 and 7.1 before 7.0.0.7 alloCVE-2009-2748 · Other software · IBM · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.29 and 7.1 before 7.0.0.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Websphere Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com ibm.com
Oct 30, 2011The Java Naming and Directory Interface (JNDI) implementation in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 beforeCVE-2009-2747 · Other software · IBM · reported by MITREMedium 5
The Java Naming and Directory Interface (JNDI) implementation in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 does not properly restrict access to UserRegistry object methods, which allows remote attackers to obtain sensitive information via a crafted method call.
Product
Websphere Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com ibm.com
Oct 29, 2011The JavaServer Faces (JSF) application functionality in IBM WebSphere Application Server 8.x before 8.0.0.1 does not properly handle requests, which allows remoCVE-2011-1368 · Other software · IBM · reported by MITREMedium 5
The JavaServer Faces (JSF) application functionality in IBM WebSphere Application Server 8.x before 8.0.0.1 does not properly handle requests, which allows remote attackers to read unspecified files via unknown vectors.
Product
Websphere Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com ibm.com
Oct 27, 2011Apple QuickTime before 7.7.1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash)CVE-2011-3251 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 9.3
Apple QuickTime before 7.7.1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted TKHD atoms in a QuickTime movie file.
Product
Quicktime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com oval.cisecurity.org
Oct 27, 2011Integer overflow in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafteCVE-2011-3250 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 9.3
Integer overflow in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with JPEG2000 encoding.
Product
Quicktime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com support.apple.com
Oct 27, 2011Buffer overflow in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a craftedCVE-2011-3249 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 9.3
Buffer overflow in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with FLC encoding.
Product
Quicktime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com support.apple.com
Oct 27, 2011Integer signedness error in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via CVE-2011-3248 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 9.3
Integer signedness error in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted font table in a QuickTime movie file.
Product
Quicktime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com support.apple.com
Oct 27, 2011Integer overflow in Apple QuickTime before 7.7.1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) vCVE-2011-3247 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 9.3
Integer overflow in Apple QuickTime before 7.7.1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT file.
Product
Quicktime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com oval.cisecurity.org
Oct 27, 2011Multiple cross-site scripting (XSS) vulnerabilities in IBM HTTP Server 2.0.47 and earlier, as used in WebSphere Application Server and other products, allow remCVE-2011-1360 · Websites & servers · IBM · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in IBM HTTP Server 2.0.47 and earlier, as used in WebSphere Application Server and other products, allow remote attackers to inject arbitrary web script or HTML via vectors involving unspecified documentation files in (1) manual/ibm/ and (2) htdocs/*/manual/ibm/.
Product
Http Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com ibm.com
Oct 19, 2011Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE, and 7 allows remote untrusted Java Web Start applications andCVE-2011-3555 · Other software · SUN · reported by secalert_us@oracle.comMedium 6.1
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE, and 7 allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity and availability via unknown vectors.
Product
JDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info marc.info
Oct 18, 2011Unspecified vulnerability in the Health Sciences - Oracle Thesaurus Management System component in Oracle Industry Applications 4.6.1 and 4.6.2 allows remote atCVE-2011-2323 · Other software · Oracle · reported by secalert_us@oracle.comMedium 4.3
Unspecified vulnerability in the Health Sciences - Oracle Thesaurus Management System component in Oracle Industry Applications 4.6.1 and 4.6.2 allows remote attackers to affect integrity, related to TMS Help.
Product
Industry Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com oracle.com
Oct 18, 2011Unspecified vulnerability in the Application Express component in Oracle Database Server 3.2 and 4.0 allows remote authenticated users to affect confidentialityCVE-2011-3525 · Other software · Oracle · reported by secalert_us@oracle.comMedium 6.5
Unspecified vulnerability in the Application Express component in Oracle Database Server 3.2 and 4.0 allows remote authenticated users to affect confidentiality, integrity, and availability, related to APEX developer user.
Product
Database Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org oracle.com
Oct 18, 2011Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.1.2 and 12.1.3 allows remote authenticated users to affecCVE-2011-3519 · Other software · Oracle · reported by secalert_us@oracle.comLow 3.5
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.1.2 and 12.1.3 allows remote authenticated users to affect confidentiality, related to REST Services.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com oracle.com
Oct 18, 2011Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.2, and 12.1.3 allows remote attaCVE-2011-3513 · Other software · Oracle · reported by secalert_us@oracle.comMedium 4.3
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.2, and 12.1.3 allows remote attackers to affect integrity, related to HTML Pages.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com oracle.com
Oct 18, 2011Unspecified vulnerability in the Health Sciences - Oracle Clinical, Remote Data Capture component in Oracle Industry Applications 4.6 and 4.6.2 allows remote atCVE-2011-2309 · Other software · Oracle · reported by secalert_us@oracle.comMedium 4.3
Unspecified vulnerability in the Health Sciences - Oracle Clinical, Remote Data Capture component in Oracle Industry Applications 4.6 and 4.6.2 allows remote attackers to affect integrity, related to RDC Help.
Product
Industry Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com oracle.com
Oct 18, 2011Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6, 12.1.2, and 12.1.3 allows remote attackers to afCVE-2011-2308 · Other software · Oracle · reported by secalert_us@oracle.comMedium 4.3
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Online Help.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com oracle.com
Oct 18, 2011Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.2, and 12.1.3 allows remote authCVE-2011-2303 · Other software · Oracle · reported by secalert_us@oracle.comLow 3.5
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.2, and 12.1.3 allows remote authenticated users to affect integrity via unknown vectors related to Attachments / File Upload.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com oracle.com
Oct 18, 2011Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.2, and 12.1.3 allows remote attaCVE-2011-2302 · Other software · Oracle · reported by secalert_us@oracle.comMedium 4.3
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Single Sign On.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com oracle.com
Oct 14, 2011The Home screen component in Apple iOS before 5 does not properly support a certain application-switching gesture, which might allow physically proximate attackCVE-2011-3431 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 2.1
The Home screen component in Apple iOS before 5 does not properly support a certain application-switching gesture, which might allow physically proximate attackers to obtain sensitive state information by watching the device's screen.
Product
Iphone OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com osvdb.org
Oct 14, 2011Double free vulnerability in OfficeImport in Apple iOS before 5 allows remote attackers to execute arbitrary code or cause a denial of service (application crasCVE-2011-3261 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.8
Double free vulnerability in OfficeImport in Apple iOS before 5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Excel spreadsheet.
Product
Iphone OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com support.apple.com
Oct 14, 2011Buffer overflow in OfficeImport in Apple iOS before 5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a cCVE-2011-3260 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.8
Buffer overflow in OfficeImport in Apple iOS before 5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word document.
Product
Iphone OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com support.apple.com
Oct 14, 2011QuickTime in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crasCVE-2011-3228 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.8
QuickTime in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file.
Product
MAC OS X
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com osvdb.org
Oct 14, 2011Buffer overflow in QuickTime in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) CVE-2011-3223 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.8
Buffer overflow in QuickTime in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FLIC movie file.
Product
MAC OS X
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com osvdb.org
Oct 14, 2011Buffer overflow in QuickTime in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) CVE-2011-3222 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.8
Buffer overflow in QuickTime in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FlashPix file.
Product
MAC OS X
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com osvdb.org
Oct 14, 2011MediaKit in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crasCVE-2011-3217 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.8
MediaKit in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted disk image.
Product
MAC OS X
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com support.apple.com
Oct 14, 2011Format string vulnerability in the debug-logging feature in Application Firewall in Apple Mac OS X before 10.7.2 allows local users to gain privileges via a craCVE-2011-0185 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.4
Format string vulnerability in the debug-logging feature in Application Firewall in Apple Mac OS X before 10.7.2 allows local users to gain privileges via a crafted name of an executable file.
Product
MAC OS X
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com support.apple.com
Oct 12, 2011Buffer overflow in CoreAudio, as used in Apple iTunes before 10.5, allows remote attackers to execute arbitrary code or cause a denial of service (application cCVE-2011-3252 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 9.3
Buffer overflow in CoreAudio, as used in Apple iTunes before 10.5, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Advanced Audio Coding (AAC) stream.
Product
Itunes
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com lists.apple.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.