Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
209 results · page 3 of 5
Aug 10, 2022WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 api.cgi has no filtering on parameter ufconf, and this is a hidden parameter which doesn't appear in POST bCVE-2022-35520 · Other software · Wavlink · reported by MITRECritical 9.8
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 api.cgi has no filtering on parameter ufconf, and this is a hidden parameter which doesn't appear in POST body, but exist in cgi binary. This leads to command injection in page /ledonoff.shtml.
- Product
- Wn572hp3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022In Toll Tax Management System 1.0, the id parameter appears to be vulnerable to SQL injection attacks.CVE-2022-30053 · Other software · Oretnom23 · reported by MITRECritical 9.8
In Toll Tax Management System 1.0, the id parameter appears to be vulnerable to SQL injection attacks.
- Product
- Toll TAX Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022pearweb < 1.32 suffers from Deserialization of Untrusted Data.CVE-2022-27158 · Websites & servers · PHP · reported by MITRECritical 9.8
pearweb < 1.32 suffers from Deserialization of Untrusted Data.
- Product
- Pearweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022pearweb < 1.32 is suffers from a Weak Password Recovery Mechanism via include/users/passwordmanage.php.CVE-2022-27157 · Websites & servers · PHP · reported by MITRECritical 9.8
pearweb < 1.32 is suffers from a Weak Password Recovery Mechanism via include/users/passwordmanage.php.
- Product
- Pearweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2022A Cross Site Scripting (XSS) vulnerability exists in pearadmin pear-admin-think <=5.0.6, which allows a login account to access arbitrary functions and cause stCVE-2022-23903 · Other software · Pearadmin · reported by MITREMedium 5.4
A Cross Site Scripting (XSS) vulnerability exists in pearadmin pear-admin-think <=5.0.6, which allows a login account to access arbitrary functions and cause stored XSS through a fake User-Agent.
- Product
- Pear Admin Think
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2022The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.CVE-2022-24953 · Other software · Pear · reported by MITREMedium 5.3
The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.
- Product
- Crypt GPG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2022cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags.CVE-2022-23773 · Other software · Golang · reported by MITREHigh 7.5
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
- Product
- GO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgroups.google.comsecurity.gentoo.org
Jan 5, 2022Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a codeCVE-2021-22567 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 4.6
Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a code review by appearing benign. An attacker could embed a source that is invisible to a code reviewer that modifies the behavior of a program in unexpected ways.
- Product
- Dart SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2021The password parameter on Simple Online Mens Salon Management System (MSMS) 1.0 appears to be vulnerable to SQL injection attacks through the password parameterCVE-2021-44600 · Other software · Oretnom23 · reported by MITREHigh 7.5
The password parameter on Simple Online Mens Salon Management System (MSMS) 1.0 appears to be vulnerable to SQL injection attacks through the password parameter. The predictive tests of this application interacted with that domain, indicating that the injected SQL query was executed. The attacker can retrieve all authentication and information about the users of this system.
- Product
- Simple Online Men's Salon Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2021The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks.CVE-2021-44599 · Other software · Online Enrollment Management System Project · reported by MITREHigh 7.5
The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks. A crafted payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed. The attacker can retrieve sensitive information for all users of this system.
- Product
- Online Enrollment Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2021The email parameter from ajax.php of Video Sharing Website 1.0 appears to be vulnerable to SQL injection attacks.CVE-2021-45255 · Other software · Video Sharing Website Project · reported by MITRECritical 9.8
The email parameter from ajax.php of Video Sharing Website 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed.
- Product
- Video Sharing Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2021The id parameter in view_storage.php from Simple Cold Storage Management System 1.0 appears to be vulnerable to SQL injection attacks.CVE-2021-45253 · Other software · Simple Cold Storage Management System Project · reported by MITRECritical 9.8
The id parameter in view_storage.php from Simple Cold Storage Management System 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed.
- Product
- Simple Cold Storage Managment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021The Company's Recruitment Management System in id=2 of the parameter from view_vacancy app on-page appears to be vulnerable to SQL injection.CVE-2021-41931 · Other software · Recruitment Management System Project · reported by MITRECritical 9.8
The Company's Recruitment Management System in id=2 of the parameter from view_vacancy app on-page appears to be vulnerable to SQL injection. The payloads 19424269' or '1309'='1309 and 39476597' or '2917'='2923 were each submitted in the id parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
- Product
- Recruitment Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2021It is possible for an attacker to manipulate documents to appear to be signed by a trusted source.CVE-2021-41832 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25635 for the LibreOffice advisory.
- Product
- Apache OpenOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Oct 11, 2021It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source.CVE-2021-41830 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25633 for the LibreOffice advisory.
- Product
- Apache OpenOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Aug 12, 2021Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers to execute arbitrary code remotely.CVE-2021-29377 · Other software · Pearadmin · reported by MITRECritical 9.8
Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers to execute arbitrary code remotely. A .php file can be uploaded via admin.php/index/upload because app/common/service/UploadService.php mishandles fileExt.
- Product
- Pearadmin Think
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2021Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNICVE-2021-38165 · Other software · Lynx Project · reported by MITREMedium 5.3
Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jun 30, 2021IBM Cognos Analytics 10.0 and 11.1 is susceptible to a weakness in the implementation of the System Appearance configuration setting.CVE-2021-20461 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Cognos Analytics 10.0 and 11.1 is susceptible to a weakness in the implementation of the System Appearance configuration setting. An attacker could potentially bypass business logic to modify the appearance and behavior of the application. IBM X-Force ID: 196770.
- Product
- Cognos Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comsecurity.netapp.com
Jun 2, 2021It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enterprise Application Platform - Continuous Delivery (CVE-2020-14317 · Other software · Redhat · reported by Red HatMedium 5.5
It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enterprise Application Platform - Continuous Delivery (EAP-CD) introducing regression. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root.
- Product
- Jboss Enterprise Application Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Jan 18, 2021PEAR Archive_Tar Improper Link Resolution VulnerabilityCVE-2020-36193 · Other software · PEAR · reported by MITREExploitedHigh 7.5
PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.
- Product
- Archive_Tar
- On CISA’s list since
- Aug 25, 2022 (federal fix deadline Sep 15, 2022)
- What to do
- Attackers are using this now. Install PEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comlists.debian.org
Jan 4, 2021The Application Wrapper in Pearson VUE VTS Installer 2.3.1911 has Full Control permissions for Everyone in the "%SYSTEMDRIVE%\Pearson VUE" directory, which alloCVE-2020-36154 · Other software · Pearson · reported by MITREHigh 7.8
The Application Wrapper in Pearson VUE VTS Installer 2.3.1911 has Full Control permissions for Everyone in the "%SYSTEMDRIVE%\Pearson VUE" directory, which allows local users to obtain administrative privileges via a Trojan horse application.
- Product
- VUE Testing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 17, 2020A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to send requests that appear to come from the localhost CVE-2020-8464 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.5
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to send requests that appear to come from the localhost which could expose the product's admin interface to users who would not normally have access.
- Product
- Trend Micro InterScan Web Security Virtual Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec-consult.comsuccess.trendmicro.com
Nov 30, 2020In certain situations, an attacker with regular user credentials and local access to an ASE cockpit installation can access sensitive information which appears CVE-2020-6317 · Network & remote access · SAP SE · reported by cna@sap.comLow 3.5
In certain situations, an attacker with regular user credentials and local access to an ASE cockpit installation can access sensitive information which appears in the installation log files. This information although sensitive is of limited utility and cannot be used to further access, modify or render unavailable any other information in the cockpit or system. This affects SAP Adaptive Server Enterprise, Versions - 15.7, 16.0.
- Product
- SAP Adaptive Server Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Nov 19, 2020PEAR Archive_Tar Deserialization of Untrusted Data VulnerabilityCVE-2020-28949 · Other software · PEAR · reported by MITREExploitedHigh 7.8
PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.
- Product
- Archive_Tar
- On CISA’s list since
- Aug 25, 2022 (federal fix deadline Sep 15, 2022)
- What to do
- Attackers are using this now. Install PEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comgithub.com
Nov 18, 2020A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to join a Webex session without appearinCVE-2020-3419 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to join a Webex session without appearing on the participant list. This vulnerability is due to improper handling of authentication tokens by a vulnerable Webex site. An attacker could exploit this vulnerability by sending crafted requests to a vulnerable Cisco Webex Meetings or Cisco Webex Meetings Server site. A successful exploit requires the attacker to have access to join a Webex meeting, including applicable meeting join links and passwords. The attacker could then exploit this vulnerability to join meetings, without appearing in the participant list, while having full access to audio, video, chat, and screen sharing capabilities.
- Product
- Cisco WebEx Meetings Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Sep 16, 2020The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400.CVE-2020-1710 · Other software · Redhat · reported by Red HatMedium 5.3
The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400.
- Product
- Jboss Data Grid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Jul 14, 2020In iPear, the manual execution of the eval() function can lead to command injection.CVE-2020-11084 · Other software · yaBobJonez · reported by GitHubMedium 6.4
In iPear, the manual execution of the eval() function can lead to command injection. Only PCs where commands are manually executed via "For Developers" are affected. This function allows executing any PHP code within iPear which may change, damage, or steal data (files) from the PC.
- Product
- iPear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2020IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to create keywords through the REST API and have them appear as if they wereCVE-2019-4603 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to create keywords through the REST API and have them appear as if they were created by another user. IBM X-Force ID: 168295.
- Product
- Rational Quality Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 8, 2020Pearson eSIS (Enterprise Student Information System) message board has stored XSS due to improper validation of user inputCVE-2014-1454 · Other software · Pearson · reported by MITREMedium 4.8
Pearson eSIS (Enterprise Student Information System) message board has stored XSS due to improper validation of user input
- Product
- Esis Enterprise Student Information System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comsecurityfocus.com
Dec 18, 2019The contents of locked notes sometimes appeared in search results.CVE-2019-8730 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
The contents of locked notes sometimes appeared in search results. This issue was addressed with improved data cleanup. This issue is fixed in macOS Catalina 10.15. A local user may be able to view a user’s locked notes.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 5, 2019An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory.CVE-2012-1105 · Other software · Jasig Project · reported by Red HatMedium 5.5
An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client library archives the debug logging file in an insecure manner.
- Product
- php-pear-CAS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.redhat.com
Aug 7, 2019cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137).CVE-2016-10799 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 2, 2019In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).CVE-2017-18413 · Websites & servers · Cpanel · reported by MITREHigh 7.8
In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Jan 22, 2019In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library.CVE-2019-6338 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 8
In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details
- Product
- Drupal core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comlists.debian.org
Dec 28, 2018PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class.CVE-2018-1000888 · Websites & servers · PHP · reported by MITREHigh 8.8
PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called without a specific prefix path, we can trigger unserialization by crafting a tar file with `phar://[path_to_malicious_phar_file]` as path. Object injection can be used to trigger destruct in the loaded PHP classes, e.g. the Archive_Tar class itself. With Archive_Tar object injection, arbitrary file deletion can occur because `@unlink($this->_temp_tarname)` is called. If another class with useful gadget is loaded, it may possible to cause remote code execution that can result in files being deleted or possibly modified. This vulnerability appears to have been fixed in 1.4.4.
- Product
- Pear Archive TAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.ripstech.comcdn2.hubspot.net
Dec 10, 2018Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attachCVE-2018-3988 · Other software · Signal · reported by talos-cna@cisco.comMedium 4.7
Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then Signal will leave the picture in its own cache directory, which is available to any application on the system.
- Product
- Private Messenger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtalosintelligence.com
Nov 29, 2018Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear inCVE-2018-16859 · Other software · Red Hat · reported by Red HatMedium 4.2
Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.
- Product
- ansible
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Aug 3, 2018The report-viewing feature in Pearson VUE Certiport Console 8 and IQSystem 7 before 2018-06-26 mishandles child processes and consequently launches Internet ExpCVE-2018-12989 · Other software · Pearsonvue · reported by MITREMedium 6.7
The report-viewing feature in Pearson VUE Certiport Console 8 and IQSystem 7 before 2018-06-26 mishandles child processes and consequently launches Internet Explorer or Microsoft Edge as Administrator, which allows local users to gain privileges.
- Product
- Console 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertiport.pearsonvue.comcomputeco.de
Jul 23, 2018PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate methodCVE-2018-1999022 · Other software · Html Quickform Project · reported by MITRECritical 9.8
PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method, HTML_QuickForm_hierselect's _setOptions method, HTML_QuickForm_element's _findValue method, HTML_QuickForm_element's _prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/add_practice_type_id[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears to have been fixed in 3.2.15.
- Product
- Html Quickform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.pear.php.netcivicrm.org
Jun 11, 2018The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed.CVE-2018-5173 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscure the file extension of potentially executable files from user view in the panel. Note: the dialog to open the file will show the full, correct filename and whether it is executable or not. This vulnerability affects Firefox < 60.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jun 4, 2018Morris.js creates an svg graph, with labels that appear when hovering over a point.CVE-2017-16022 · Other software · HackerOne · reported by support@hackerone.comMedium 6.1
Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If control over the labels is obtained, script can be injected. The script will run on the client side whenever that specific graph is loaded.
- Product
- Morris.js node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
Apr 17, 2018On Appear TV XC5000 and XC5100 devices with firmware 3.26.217, it is possible to read OS files with a specially crafted HTTP request (such as GET /../../../../.CVE-2018-7539 · Other software · Appeartv · reported by MITRECritical 9.8
On Appear TV XC5000 and XC5100 devices with firmware 3.26.217, it is possible to read OS files with a specially crafted HTTP request (such as GET /../../../../../../../../../../../../etc/passwd) to the web server (fuzzd/0.1.1) running the Maintenance Center on port TCP/8088. This can lead to full compromise of the device.
- Product
- Xc5000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jan 25, 2018Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearingCVE-2017-1000391 · Websites & servers · Jenkins · reported by MITREHigh 7.3
Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comjenkins.io
Feb 6, 2017PEAR HTML_AJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer.CVE-2017-5677 · Other software · Pear · reported by MITRECritical 9.8
PEAR HTML_AJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. It allows remote code execution. In one viewpoint, the root cause is an incorrect regular expression.
- Product
- Html Ajax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.pear.php.netkarmainsecurity.com
Feb 1, 2017PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remoteCVE-2017-5630 · Websites & servers · PHP · reported by MITREHigh 7.5
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
- Product
- Pear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpear.php.netsecurityfocus.com
Nov 10, 2016Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticatedCVE-2016-9268 · Other software · Dotclear · reported by MITREHigh 7.2
Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified vectors.
- Product
- Dotclear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev.dotclear.orgdev.dotclear.org
Oct 21, 2015SQL injection vulnerability in Runtime/Runtime/AjaxCall.ashx in K2 blackpearl, smartforms, and K2 for SharePoint 4.6.7 allows remote attackers to execute arbitrCVE-2015-7299 · Other software · Nintex · reported by MITREHigh 7.5
SQL injection vulnerability in Runtime/Runtime/AjaxCall.ashx in K2 blackpearl, smartforms, and K2 for SharePoint 4.6.7 allows remote attackers to execute arbitrary SQL commands via the xml parameter.
- Product
- K2 Blackpearl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Jun 23, 2015Pearson ProctorCache before 2015.1.17 uses the same hardcoded password across different customers' installations, which allows remote attackers to modify test mCVE-2015-0972 · Other software · Pearson · reported by cret@cert.orgMedium 5
Pearson ProctorCache before 2015.1.17 uses the same hardcoded password across different customers' installations, which allows remote attackers to modify test metadata or cause a denial of service (test disruption) by leveraging knowledge of this password.
- Product
- Proctorcache
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Dec 19, 2014The XML_RPC_cd function in lib/pear/XML/RPC.php in Revive Adserver before 3.0.6 allows remote attackers to cause a denial of service (CPU and memory consumptionCVE-2014-8875 · Other software · Revive-adserver · reported by MITREMedium 5
The XML_RPC_cd function in lib/pear/XML/RPC.php in Revive Adserver before 3.0.6 allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted XML-RPC request, aka an XML Entity Expansion (XEE) attack.
- Product
- Revive Adserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comrevive-adserver.com
Oct 19, 2014The Magic Balloonman Marty Boone (aka com.app_martyboone.layout) application 1.400 for Android does not verify X.509 certificates from SSL servers, which allowsCVE-2014-7371 · Other software · Appearingbusiness · reported by cret@cert.orgMedium 5.4
The Magic Balloonman Marty Boone (aka com.app_martyboone.layout) application 1.400 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Magic Balloonman Marty Boone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.