Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,994 results · page 32 of 60
Oct 8, 2021Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and uCVE-2021-41568 · Other software · Tad · reported by twcert@cert.org.twMedium 5.3
Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and uploading files in the system.
- Product
- Tad Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 6, 2021An issue was discovered in the Mentor dashboard in the GrowthExperiments extension in MediaWiki through 1.36.2.CVE-2021-42044 · Other software · Mediawiki · reported by MITREMedium 4.8
An issue was discovered in the Mentor dashboard in the GrowthExperiments extension in MediaWiki through 1.36.2. The Growthexperiments-mentor-dashboard-mentee-overview-add-filter-total-edits-headline, growthexperiments-mentor-dashboard-mentee-overview-add-filter-starred-headline, growthexperiments-mentor-dashboard-mentee-overview-info-text, growthexperiments-mentor-dashboard-mentee-overview-info-legend-headline, and growthexperiments-mentor-dashboard-mentee-overview-active-ago MediaWiki messages were not being properly sanitized and allowed for the injection and execution of HTML and JavaScript.
- Product
- Mediawiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Oct 6, 2021IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to obtain sensitive information from the dashboard that tCVE-2021-29761 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to obtain sensitive information from the dashboard that they should not have access to. IBM X-Force ID: 202265.
- Product
- Sterling B2B Integrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 6, 2021IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to download unauthorized files through the dashboard userCVE-2021-29760 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to download unauthorized files through the dashboard user interface. IBM X-Force ID: 202213.
- Product
- Sterling B2B Integrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 27, 2021Recipe Card Blocks by WPZOOM: Does not escape the message parameter before outputting it back in the admin dashboardCVE-2021-24632 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- Recipe Card Blocks by WPZOOM
- Fixed in
- 2.8.1
- What to do
- Update Recipe Card Blocks by WPZOOM to 2.8.1 or newer.
Sep 22, 2021Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product dCVE-2021-37860 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.7
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Sep 20, 2021Support Board: Does not escape multiple POST parameters (suchCVE-2021-24741 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.
- Product
- Support Board
- Fixed in
- 3.3.4
- What to do
- Update Support Board to 3.3.4 or newer.
Full record and what to do →NVD recordboard.supportmedium.com
Sep 20, 2021Splash Header: Doesn't sanitise and escape some of its settings while outputting them in the admin dashboardCVE-2021-24587 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.
- Product
- Splash Header
- Fixed in
- 1.20.8
- What to do
- Update Splash Header to 1.20.8 or newer.
Sep 20, 2021options.php file of the WP-Board: Beta accepts a postid parameterCVE-2021-24404 · WordPress plugins & themes · reported by WPScanHigh 8.8
The options.php file of the WP-Board WordPress plugin through 1.1 beta accepts a postid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 seconds it takes 10 seconds to return since the query ran twice.
- Product
- options.php file of the WP-Board
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update options.php file of the WP-Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 15, 2021In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.CVE-2021-38156 · Other software · Nagios · reported by MITREMedium 5.4
In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2021StopBadBots: Did not validate or escape the order and orderby GET parameter in some of its admin dashboard pagesCVE-2021-24727 · WordPress plugins & themes · reported by WPScanHigh 8.8
The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Authenticated SQL Injections
- Product
- StopBadBots
- Fixed in
- 6.60
- What to do
- Update StopBadBots to 6.60 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Sep 13, 2021Software License Manager: Does not sanitise or escape the edit_record parameter before outputting it back in the page in the admin dashboardCVE-2021-24560 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Software License Manager WordPress plugin before 4.4.8 does not sanitise or escape the edit_record parameter before outputting it back in the page in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- Software License Manager
- Fixed in
- 4.4.8
- What to do
- Update Software License Manager to 4.4.8 or newer.
Sep 13, 2021MF Gig Calendar: Does not sanitise and escape the id GET parameter before outputting back in the admin dashboardCVE-2021-24510 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue
- Product
- MF Gig Calendar
- Fixed in
- 1.2
- What to do
- Update MF Gig Calendar to 1.2 or newer.
Sep 2, 2021A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13.CVE-2021-40490 · Other software · Netapp · reported by MITREHigh 7
A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13.
- Product
- Solidfire Baseboard Management Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orglists.debian.org
Sep 1, 2021The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerabilityCVE-2021-39109 · Websites & servers · Atlassian · reported by security@atlassian.comHigh 7.5
The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerability.
- Product
- Atlasboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbitbucket.org
Aug 30, 2021Side Menu Lite: Does not sanitise user input from the List page in the admin dashboard before using it in SQL statementCVE-2021-24580 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue
- Product
- Side Menu Lite
- Fixed in
- 2.2.6
- What to do
- Update Side Menu Lite to 2.2.6 or newer.
Aug 30, 2021ShareThis Dashboard for Google Analytics: Does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attributeCVE-2021-24438 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
- Product
- ShareThis Dashboard for Google Analytics
- Fixed in
- 2.5.2
- What to do
- Update ShareThis Dashboard for Google Analytics to 2.5.2 or newer.
Aug 23, 2021Erident Custom Login and Dashboard: Did not properly sanitise its settingsCVE-2021-24658 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled)
- Product
- Erident Custom Login and Dashboard
- Fixed in
- 3.5.9
- What to do
- Update Erident Custom Login and Dashboard to 3.5.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Aug 17, 2021Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be placedCVE-2021-39250 · Other software · Invisioncommunity · reported by MITREMedium 5.4
Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be placed in an IFRAME element within user-generated content. For code execution, the attacker can rely on the ability of an admin to install widgets, disclosure of the admin session ID in a Referer header, and the ability of an admin to use the templating engine (e.g., Edit HTML).
- Product
- Invision Power Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinvisioncommunity.comssd-disclosure.com
Aug 17, 2021Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become predictable through CVE-2021-39249 · Other software · Invisioncommunity · reported by MITREMedium 6.1
Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become predictable through a brute-force attack against the PHP mt_rand function.
- Product
- Invision Power Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinvisioncommunity.comssd-disclosure.com
Aug 15, 2021TastyIgniter 3.0.7 allows XSS via /account, /reservation, /admin/dashboard, and /admin/system_logs.CVE-2021-38699 · Other software · Tastyigniter · reported by MITREMedium 5.4
TastyIgniter 3.0.7 allows XSS via /account, /reservation, /admin/dashboard, and /admin/system_logs.
- Product
- Tastyigniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 6, 2021In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions.CVE-2021-37554 · Other software · Jetbrains · reported by MITREMedium 4.3
In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 3, 2021The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability.CVE-2021-36703 · Other software · Htmly · reported by MITREMedium 6.1
The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send an authenticated post HTTP request to admin/config and inject arbitrary web script or HTML through a special website name.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerabilityCVE-2021-36702 · Other software · Htmly · reported by MITREMedium 6.1
The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send authenticated post-http requests to add / content and inject arbitrary web scripts or HTML through special content.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2021RSS for Yandex Turbo: Does not sanitise or escape some of its settings before saving and outputing them in the admin dashboardCVE-2021-24428 · WordPress plugins & themes · reported by WPScanMedium 4.8
The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving and outputing them in the admin dashboard, leading to an Authenticated Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed.
- Product
- RSS for Yandex Turbo
- Affected
- up to 1.30
- What to do
- Affects up to 1.30. Update RSS for Yandex Turbo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 20, 2021Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form.CVE-2021-36747 · Other software · Blackboard · reported by MITREMedium 5.4
Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form.
- Product
- Blackboard Learn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2021Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor.CVE-2021-36746 · Other software · Blackboard · reported by MITREMedium 5.4
Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor.
- Product
- Blackboard Learn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2021W3 Total Cache: Was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboardCVE-2021-24452 · WordPress plugins & themes · reported by WPScanMedium 6.1
The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
- Product
- W3 Total Cache
- Fixed in
- 2.1.5
- What to do
- Update W3 Total Cache to 2.1.5 or newer.
Jul 19, 2021W3 Total Cache: Was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboardCVE-2021-24436 · WordPress plugins & themes · reported by WPScanMedium 6.1
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
- Product
- W3 Total Cache
- Fixed in
- 2.1.4
- What to do
- Update W3 Total Cache to 2.1.4 or newer.
Jul 8, 2021Remote Code Execution vulnerability in PbootCMS 2.0.8 in the message board.CVE-2020-23580 · Other software · Pbootcms · reported by MITRECritical 9.8
Remote Code Execution vulnerability in PbootCMS 2.0.8 in the message board.
- Product
- Pbootcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2021WP Offload SES Lite: Did not escape some of the fields in the Activity page of the admin dashboardCVE-2021-24494 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Offload SES Lite WordPress plugin before 1.4.5 did not escape some of the fields in the Activity page of the admin dashboard, such as the email's id, subject and recipient, which could lead to Stored Cross-Site Scripting issues when an attacker can control any of these fields, like the subject when filling a contact form for example. The XSS will be executed in the context of a logged in admin viewing the Activity tab of the plugin.
- Product
- WP Offload SES Lite
- Fixed in
- 1.4.5
- What to do
- Update WP Offload SES Lite to 1.4.5 or newer.
Jun 24, 2021In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php.CVE-2020-21786 · Other software · Ibos · reported by MITRECritical 9.8
In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the act parameter in bbs/move_update.php.CVE-2020-18663 · Other software · SIR · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the act parameter in bbs/move_update.php.
- Product
- Gnuboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in install_db.php.CVE-2020-18662 · Other software · SIR · reported by MITRECritical 9.8
SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in install_db.php.
- Product
- Gnuboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.CVE-2020-18661 · Other software · SIR · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.
- Product
- Gnuboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021A potential vulnerability has been identified in HPE OneView Global Dashboard release 2.31 which could lead to a local disclosure of privileged information.CVE-2021-26585 · Other software · HPE · reported by security-alert@hpe.comMedium 5.5
A potential vulnerability has been identified in HPE OneView Global Dashboard release 2.31 which could lead to a local disclosure of privileged information. HPE has provided an update to OneView Global Dashboard. The issue is resolved in 2.32.
- Product
- Oneview Global Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Jun 23, 2021phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator.CVE-2021-35438 · Websites & servers · Phpipam · reported by MITREMedium 6.1
phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could allow an attacker to retCVE-2021-27485 · Other software · Zoll · reported by ics-cert@hq.dhs.govHigh 7.5
ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could allow an attacker to retrieve the credentials from the web browser.
- Product
- Defibrillator Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Jun 16, 2021ZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem permissions that could allow a lower privilege user to escalate pCVE-2021-27483 · Other software · Zoll · reported by ics-cert@hq.dhs.govHigh 7.8
ZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem permissions that could allow a lower privilege user to escalate privileges to an administrative level user.
- Product
- Defibrillator Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Jun 16, 2021ZOLL Defibrillator Dashboard, v prior to 2.2,The affected product’s web application could allow a low privilege user to inject parameters to contain malicious sCVE-2021-27479 · Other software · Zoll · reported by ics-cert@hq.dhs.govMedium 5.4
ZOLL Defibrillator Dashboard, v prior to 2.2,The affected product’s web application could allow a low privilege user to inject parameters to contain malicious scripts to be executed by higher privilege users.
- Product
- Defibrillator Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Jun 16, 2021ZOLL Defibrillator Dashboard, v prior to 2.2, The web application allows a non-administrative user to upload a malicious file.CVE-2021-27489 · Other software · Zoll · reported by ics-cert@hq.dhs.govHigh 8.8
ZOLL Defibrillator Dashboard, v prior to 2.2, The web application allows a non-administrative user to upload a malicious file. This file could allow an attacker to remotely execute arbitrary commands.
- Product
- Defibrillator Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Jun 16, 2021ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext.CVE-2021-27487 · Other software · Zoll · reported by ics-cert@hq.dhs.govMedium 5.5
ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could allow an attacker to gain access to sensitive information.
- Product
- Defibrillator Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Jun 16, 2021ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange process, which is hardcoded.CVE-2021-27481 · Other software · Zoll · reported by ics-cert@hq.dhs.govMedium 5.5
ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange process, which is hardcoded. This could allow an attacker to gain access to sensitive information.
- Product
- Defibrillator Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Jun 14, 2021Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject maliciouCVE-2021-27887 · Other software · Hitachiabb-powergrids · reported by MITREMedium 6.3
Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. This issue affects: Hitachi ABB Power Grids Ellipse APM 5.3 version 5.3.0.1 and prior versions; 5.2 version 5.2.0.3 and prior versions; 5.1 version 5.1.0.6 and prior versions.
- Product
- Ellipse Asset Performance Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jun 11, 2021Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard.CVE-2021-34540 · Other software · Advantech · reported by MITREMedium 6.1
Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard.
- Product
- Webaccess
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comadvantech.com
Jun 9, 2021Improper initialization in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenCVE-2020-24475 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper initialization in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Buffer overflow in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenticated CVE-2020-24474 · Other software · Intel · reported by secure@intel.comHigh 8
Buffer overflow in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenticated user to potentially enable escalation of privilege via adjacent access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Out of bounds write in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenticaCVE-2020-24473 · Other software · Intel · reported by secure@intel.comHigh 7.8
Out of bounds write in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Out of bounds write in the BMC firmware for Intel(R) Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to poCVE-2021-0113 · Other software · Intel · reported by secure@intel.comMedium 6.5
Out of bounds write in the BMC firmware for Intel(R) Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentially enable a denial of service via adjacent access.
- Product
- EFI Bios 7215
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Buffer overflow in the BMC firmware for Intel(R) Server BoardM10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentiCVE-2021-0101 · Other software · Intel · reported by secure@intel.comHigh 8.8
Buffer overflow in the BMC firmware for Intel(R) Server BoardM10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentially enable an escalation of privilege via adjacent access.
- Product
- EFI Bios 7215
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.