Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,093 results · page 30 of 42
Sep 10, 2021merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-3645 · Other software · viking04 · reported by security@huntr.devCritical 9.8
merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- Product
- viking04/merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2021Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC).CVE-2021-32835 · Other software · eclipse · reported by GitHubCritical 9.9
Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a sandbox escape vulnerability may lead to post-authentication Remote Code execution. This vulnerability is known to exist in the latest commit at the time of writing this CVE (commit a1c8dbe). For more details see the referenced GHSL-2021-063.
- Product
- keti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritylab.github.comsecuritylab.github.com
Sep 8, 2021Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC).CVE-2021-32834 · Other software · eclipse · reported by GitHubHigh 8.2
Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can run arbitrary code by sending malicious Groovy scripts which will escape the configured Groovy sandbox. This vulnerability is known to exist in the latest commit at the time of writing this CVE (commit a1c8dbe). For more details see the referenced GHSL-2021-063.
- Product
- keti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritylab.github.comsecuritylab.github.com
Sep 7, 2021A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs_get_attribute_value, in NTFS-3G < 2021.8.22.CVE-2021-39263 · Other software · Tuxera · reported by MITREHigh 7.8
A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs_get_attribute_value, in NTFS-3G < 2021.8.22.
- Product
- Ntfs-3g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in ntfs_inode_lookup_by_name, in NTFS-3G < 2021.8.22.CVE-2021-39259 · Other software · Tuxera · reported by MITREHigh 7.8
A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in ntfs_inode_lookup_by_name, in NTFS-3G < 2021.8.22.
- Product
- Ntfs-3g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.CVE-2021-39258 · Other software · Tuxera · reported by MITREHigh 7.8
A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.
- Product
- Ntfs-3g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite), causing stack consumption CVE-2021-39257 · Other software · Tuxera · reported by MITREMedium 5.5
A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite), causing stack consumption in NTFS-3G < 2021.8.22.
- Product
- Ntfs-3g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22.CVE-2021-39255 · Other software · Tuxera · reported by MITREHigh 7.8
A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22.
- Product
- Ntfs-3g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resize, in NTFS-3G < 202CVE-2021-39254 · Other software · Tuxera · reported by MITREHigh 7.8
A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resize, in NTFS-3G < 2021.8.22.
- Product
- Ntfs-3g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur and allow fCVE-2021-33287 · Other software · Tuxera · reported by MITREHigh 7.8
In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application.
- Product
- Ntfs-3g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Sep 7, 2021NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buffer overflow can occCVE-2021-35269 · Other software · Tuxera · reported by MITREHigh 7.8
NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buffer overflow can occur allowing for code execution and escalation of privileges.
- Product
- Ntfs-3g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.debian.org
Sep 7, 2021In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur CVE-2021-33285 · Other software · Tuxera · reported by MITREHigh 7.8
In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the "bytes_in_use" field should be less than the "bytes_allocated" field. When it is not, the parsing of the records proceeds into the wild.
- Product
- Ntfs-3g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugs.debian.org
Sep 6, 2021objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-3766 · Other software · vincit · reported by security@huntr.devCritical 9.8
objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- Product
- vincit/objection.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2021immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-3757 · Other software · immerjs · reported by security@huntr.devCritical 9.8
immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- Product
- immerjs/immer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2021A memory corruption vulnerability exists in the XML-parsing CreateLabelOrAttrib functionality of AT&T Labs’ Xmill 0.7.CVE-2021-21811 · Other software · ATT · reported by talos-cna@cisco.comCritical 9.8
A memory corruption vulnerability exists in the XML-parsing CreateLabelOrAttrib functionality of AT&T Labs’ Xmill 0.7. A specially crafted XML file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Xmill
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 31, 2021In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie.CVE-2021-34563 · Other software · Phoenix Contact · reported by info@cert.vde.comLow 3.3
In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript.
- Product
- WHA-GW-F2D2-0-AS- Z2-ETH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 30, 2021WP Video Lightbox: Does not escape the attributes of its shortcodesCVE-2021-24665 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Video Lightbox WordPress plugin before 1.9.3 does not escape the attributes of its shortcodes, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- WP Video Lightbox
- Fixed in
- 1.9.3
- What to do
- Update WP Video Lightbox to 1.9.3 or newer.
Full record and what to do →NVD recordwpscan.comfortiguard.com
Aug 30, 2021ShareThis Dashboard for Google Analytics: Does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attributeCVE-2021-24438 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
- Product
- ShareThis Dashboard for Google Analytics
- Fixed in
- 2.5.2
- What to do
- Update ShareThis Dashboard for Google Analytics to 2.5.2 or newer.
Aug 27, 2021inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status.CVE-2021-28699 · Other software · Xen · reported by security@xen.orgMedium 5.5
inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is, when operating in this mode, a guest has two tables. As a result, guests also need to be able to retrieve the addresses that the new status tracking table can be accessed through. For 32-bit guests on x86, translation of requests has to occur because the interface structure layouts commonly differ between 32- and 64-bit. The translation of the request to obtain the frame numbers of the grant status table involves translating the resulting array of frame numbers. Since the space used to carry out the translation is limited, the translation layer tells the core function the capacity of the array within translation space. Unfortunately the core function then only enforces array bounds to be below 8 times the specified value, and would write past the available space if enough frame numbers needed storing.
- Product
- xen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Aug 24, 2021EARCLINK ESPCMS-P8 was discovered to contain a SQL injection vulnerability in the espcms_web/Search.php component via the attr_array parameter.CVE-2020-18913 · Other software · Ecisp · reported by MITREHigh 7.5
EARCLINK ESPCMS-P8 was discovered to contain a SQL injection vulnerability in the espcms_web/Search.php component via the attr_array parameter. This vulnerability allows attackers to access sensitive database information.
- Product
- Espcms-p8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2021HD Quiz: Does not escape some of its Answers before outputting them in attributeCVE-2021-24571 · WordPress plugins & themes · reported by WPScanMedium 5.4
The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz, which could lead to Stored Cross-Site Scripting issues
- Product
- HD Quiz
- Fixed in
- 1.8.4
- What to do
- Update HD Quiz to 1.8.4 or newer.
Aug 23, 2021WPFront Scroll Top: Does not sanitise or escape its Image ALT setting before outputting it attributesCVE-2021-24564 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributes, leading to an Authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
- Product
- WPFront Scroll Top
- Fixed in
- 2.0.6.07225
- What to do
- Update WPFront Scroll Top to 2.0.6.07225 or newer.
Aug 23, 2021Slider Hero with Animation, Video Background & Intro Maker: Does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statementCVE-2021-24506 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users with a role as low as Contributor to perform SQL injection.
- Product
- Slider Hero with Animation, Video Background & Intro Maker
- Fixed in
- 8.2.7
- What to do
- Update Slider Hero with Animation, Video Background & Intro Maker to 8.2.7 or newer.
Aug 17, 2021A memory corruption vulnerability exists in the XML-parsing ParseAttribs functionality of AT&T Labs’ Xmill 0.7.CVE-2021-21810 · Other software · ATT · reported by talos-cna@cisco.comCritical 9.8
A memory corruption vulnerability exists in the XML-parsing ParseAttribs functionality of AT&T Labs’ Xmill 0.7. A specially crafted XML file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Xmill
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 16, 2021SP Project & Document Manager: Attribute-based Reflected Cross-Site ScriptingCVE-2021-38315 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25.
- Product
- SP Project & Document Manager
- Affected
- up to 4.25
- What to do
- Affects up to 4.25. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 16, 2021PhoneTrack Meu Site Manager: Does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the pageCVE-2021-24534 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the page, leading to a stored Cross-Site Scripting issue.
- Product
- PhoneTrack Meu Site Manager
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update PhoneTrack Meu Site Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2021Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Does not escape its Form Title before outputting it in an attributeCVE-2021-24526 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- Fixed in
- 1.13.60
- What to do
- Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to 1.13.60 or newer.
Aug 12, 2021Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field.CVE-2021-35955 · Other software · Contao · reported by MITREMedium 4.8
Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7.
- Product
- Contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021A stored cross site scripting (XSS) vulnerability in the web_attr_2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HCVE-2020-21930 · Other software · Eyoucms · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in the web_attr_2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2021Leaflet Map: Does not escape some shortcode attributes before they are used in JavaScript code or HTMLCVE-2021-24468 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues
- Product
- Leaflet Map
- Fixed in
- 3.0.0
- What to do
- Update Leaflet Map to 3.0.0 or newer.
Aug 2, 2021The get_portfolios() and get_portfolio_attributes() functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-atCVE-2021-24457 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_portfolios() and get_portfolio_attributes() functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-attributes-list-table.php files of the Portfolio Responsive Gallery WordPress plugin before 1.1.8 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Fixed in
- 1.1.8
- What to do
- Update the plugin to 1.1.8 or newer.
Aug 2, 2021Tutor LMS – eLearning and online course solution: Did not escape the Summary field of Announcements (when outputting it in an attribute)CVE-2021-24455 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.
- Product
- Tutor LMS – eLearning and online course solution
- Fixed in
- 1.9.2
- What to do
- Update Tutor LMS – eLearning and online course solution to 1.9.2 or newer.
Jul 26, 2021IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) does not set the secure attribute on authorization tokens or session cookies.CVE-2021-29769 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 202769.
- Product
- i2 Analyze
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 23, 2021All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be execuCVE-2021-23412 · Other software · Gitlogplus Project · reported by report@snyk.ioHigh 8.1
All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization.
- Product
- Gitlogplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2021OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected).CVE-2021-35043 · Other software · Antisamy Project · reported by MITREMedium 6.1
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
- Product
- Antisamy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Prismatic: Does not escape the 'tab' GET parameter before outputting it back in an attributeCVE-2021-24409 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
- Product
- Prismatic
- Fixed in
- 2.8
- What to do
- Update Prismatic to 2.8 or newer.
Jun 28, 2021Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute.CVE-2021-35303 · Other software · Zammad · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute.
- Product
- Zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021WP Hardening – Fix Your WordPress Security: Did not sanitise or escape the $_SERVER['REQUEST_URI'] before outputting it in an attributeCVE-2021-24372 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the $_SERVER['REQUEST_URI'] before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue.
- Product
- WP Hardening – Fix Your WordPress Security
- Fixed in
- 1.2.2
- What to do
- Update WP Hardening – Fix Your WordPress Security to 1.2.2 or newer.
Jun 9, 2021Out of bound read will happen if EAPOL Key length is less than expected while processing NAN shared key descriptor attribute in Snapdragon Auto, Snapdragon CompCVE-2020-11241 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Out of bound read will happen if EAPOL Key length is less than expected while processing NAN shared key descriptor attribute in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 9, 2021Possible stack out of bound write might happen due to time bitmap length and bit duration fields of the attributes like NAN ranging setup attribute inside a NANCVE-2020-11134 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Possible stack out of bound write might happen due to time bitmap length and bit duration fields of the attributes like NAN ranging setup attribute inside a NAN management frame are not Properly validated in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 1, 2021Database Backup for: Did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tagCVE-2021-24322 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tag, leading to a Stored Cross-Site Scripting issue.
- Product
- Database Backup for
- Fixed in
- 2.4
- What to do
- Update Database Backup for to 2.4 or newer.
May 28, 2021The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.CVE-2021-33587 · Other software · Css-what Project · reported by MITREHigh 7.5
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
- Product
- Css-what
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
May 28, 2021A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API.CVE-2020-27826 · Other software · Redhat · reported by Red HatMedium 4.2
A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application.
- Product
- Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
May 26, 2021A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system, cCVE-2020-27815 · Computers, phones & browsers · Linux · reported by Red HatHigh 7.8
A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
May 25, 2021Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table.CVE-2021-33570 · Other software · Postbird Project · reported by MITREMedium 5.4
Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.
- Product
- Postbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
May 14, 2021The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.CVE-2021-24283 · WordPress plugins & themes · reported by WPScanMedium 5.4
The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.
- Fixed in
- 2.2.30
- What to do
- Update the plugin to 2.2.30 or newer.
May 11, 2021SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be diCVE-2021-27619 · Websites & servers · SAP SE · reported by cna@sap.comMedium 6.5
SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be displayed to them. Although the search results are masked, the user can iteratively enter one character at a time to search and determine the masked attribute value thereby leading to information disclosure.
- Product
- SAP Commerce (Backoffice Search)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
May 10, 2021In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3.CVE-2020-23369 · Other software · Yzmcms · reported by MITREMedium 6.1
In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3.
- Product
- Yzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2021Contact Form by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24276 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Contact Form by Supsystic
- Fixed in
- 1.7.15
- What to do
- Update Contact Form by Supsystic to 1.7.15 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 5, 2021Popup by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24275 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Popup by Supsystic
- Fixed in
- 1.10.5
- What to do
- Update Popup by Supsystic to 1.10.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.