Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18,268 results · page 323 of 366
Apr 14, 2020The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Exposure of Sensitive Information to an Unauthorized ActoCVE-2020-7801 · Other software · Mysyngeryss · reported by MITREMedium 5.3
The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability. The affected product is vulnerable to information exposure over the SNMP protocol. This is a different issue than CVE-2019-16879, CVE-2019-20045, CVE-2019-20046, CVE-2020-7800, and CVE-2020-7802.
- Product
- Husky RTU 6049-e70 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Apr 14, 2020IBM QRadar SIEM 7.3.0 through 7.3.3 could allow an authenticated attacker to perform unauthorized actions due to improper input validation.CVE-2020-4151 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM QRadar SIEM 7.3.0 through 7.3.3 could allow an authenticated attacker to perform unauthorized actions due to improper input validation. IBM X-Force ID: 174201.
- Product
- QRadar SIEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 13, 2020The pc-kernel snap build process hardcoded the --allow-insecure-repositories and --allow-unauthenticated apt options when creating the build chroot environment.CVE-2019-11480 · Other software · Canonical · reported by security@ubuntu.comHigh 8.4
The pc-kernel snap build process hardcoded the --allow-insecure-repositories and --allow-unauthenticated apt options when creating the build chroot environment. This could allow an attacker who is able to perform a MITM attack between the build environment and the Ubuntu archive to install a malicious package within the build chroot. This issue affects pc-kernel versions prior to and including 2019-07-16
- Product
- pc-kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netcve.mitre.org
Apr 13, 2020Cisco Webex Business Suite before 39.1.0 contains a vulnerability that could allow an unauthenticated, remote attacker to affect the integrity of the applicatioCVE-2019-1866 · Network & remote access · Cisco · reported by psirt@cisco.comLow 3.1
Cisco Webex Business Suite before 39.1.0 contains a vulnerability that could allow an unauthenticated, remote attacker to affect the integrity of the application. The vulnerability is due to improper validation of host header values. An attacker with a privileged network position, either a man-in-the-middle or by intercepting wireless network traffic, could exploit this vulnerability to manipulate header values sent by a client to the affected application. The attacker could cause the application to use input from the header to redirect a user from the Cisco Webex Meetings Online site to an arbitrary site of the attacker's choosing.
- Product
- Cisco Webex Business Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordquickview.cloudapps.cisco.comquickview.cloudapps.cisco.com
Apr 9, 2020WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account.CVE-2020-10625 · Other software · Advantech · reported by ics-cert@hq.dhs.govCritical 9.8
WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account.
- Product
- Webaccess/nms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Apr 9, 2020There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive informatiCVE-2020-10617 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information.
- Product
- Webaccess/nms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Apr 8, 2020GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users.CVE-2020-10979 · Websites & servers · Gitlab · reported by MITREMedium 4.3
GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Apr 8, 2020GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page.CVE-2020-10975 · Websites & servers · Gitlab · reported by MITREMedium 4.3
GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Apr 8, 2020IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insufficiCVE-2020-4291 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insufficient timeout functionality in the Web UI. IBM X-Force ID: 176334.
- Product
- Security Information Queue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 8, 2020IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insufficiCVE-2020-4284 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insufficient timeout functionality in the Web UI. IBM X-Force ID: 176207.
- Product
- Security Information Queue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 8, 2020IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow an authenticated user to perform unauthorized actions by bypassinCVE-2020-4282 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow an authenticated user to perform unauthorized actions by bypassing illegal character restrictions. X-Force ID: 176205.
- Product
- Security Information Queue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 7, 2020The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the uCVE-2020-11515 · WordPress plugins & themes · reported by MITREMedium 6.1
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the attacker to create a new URI with an arbitrary name (e.g., the /exampleredirect URI).
- Product
- Rank Math
- Affected
- up to 1.0.40.2
- What to do
- Affects up to 1.0.40.2. Update Rank Math to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordrankmath.comwordpress.org
Apr 7, 2020The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escCVE-2020-11514 · WordPress plugins & themes · reported by MITRECritical 9.8
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.
- Product
- Rank Math
- Affected
- up to 1.0.40.2
- What to do
- Affects up to 1.0.40.2. Update Rank Math to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordrankmath.comwordpress.org
Apr 7, 2020Classic buffer overflow in SolarWinds Dameware allows a remote, unauthenticated attacker to cause a denial of service by sending a large 'SigPubkeyLen' during ECVE-2020-5734 · Other software · Solarwinds · reported by vulnreport@tenable.comHigh 7.5
Classic buffer overflow in SolarWinds Dameware allows a remote, unauthenticated attacker to cause a denial of service by sending a large 'SigPubkeyLen' during ECDH key exchange.
- Product
- Dameware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Apr 6, 2020Project Worlds Official Car Rental System 1 is vulnerable to multiple SQL injection issues, as demonstrated by the email and parameters (account.php), uname andCVE-2020-11545 · Other software · Projectworlds · reported by MITRECritical 9.8
Project Worlds Official Car Rental System 1 is vulnerable to multiple SQL injection issues, as demonstrated by the email and parameters (account.php), uname and pass parameters (login.php), and id parameter (book_car.php) This allows an attacker to dump the MySQL database and to bypass the login authentication prompt.
- Product
- Official CAR Rental System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfrostylabs.netfrostylabs.net
Apr 4, 2020PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memCVE-2020-11547 · Other software · Paessler · reported by MITREMedium 5.3
PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or index.htm.
- Product
- Prtg Network Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2020In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.CVE-2020-11527 · Email & office · Zohocorp · reported by MITREHigh 7.5
In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.
- Product
- Manageengine Opmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Apr 4, 2020Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution.CVE-2020-11518 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.compitstop.manageengine.com
Apr 3, 2020VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow an unauthenticated attacker to discover the cryptographic key from the web server and CVE-2020-7000 · Other software · VISAM · reported by ics-cert@hq.dhs.govHigh 7.5
VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow an unauthenticated attacker to discover the cryptographic key from the web server and gain information about the login and the encryption/decryption mechanism, which may be exploited to bypass authentication of the HTML5 HMI web interface.
- Product
- VBASE Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Apr 3, 2020includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.CVE-2019-17230 · WordPress plugins & themes · reported by MITREMedium 5.3
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.
- Product
- includes/theme-functions.php in the OneTone
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update includes/theme-functions.php in the OneTone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Apr 1, 2020LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.CVE-2020-6009 · WordPress plugins & themes · reported by cve@checkpoint.comCritical 9.8
LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.
- Fixed in
- 3.1.6
- What to do
- Update the plugin to 3.1.6 or newer.
Full record and what to do →NVD recordlearndash.releasenotes.iolearndash.releasenotes.io
Apr 1, 2020Parrot ANAFI is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flightCVE-2019-3944 · Other software · Parrot · reported by vulnreport@tenable.comHigh 7.5
Parrot ANAFI is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flight.
- Product
- Anafi Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Apr 1, 2020Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files.CVE-2019-3942 · Other software · Advantech · reported by vulnreport@tenable.comHigh 7.5
Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files. An attacker can use this vulnerability to recover the administrator password.
- Product
- Webaccess
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 31, 2020IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorizCVE-2020-4238 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 175411.
- Product
- Tivoli Netcool Impact
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 31, 2020IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorizCVE-2020-4237 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 175410.
- Product
- Tivoli Netcool Impact
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 30, 2020A webserver component in Paessler PRTG Network Monitor 19.2.50 to PRTG 20.1.56 allows unauthenticated remote command execution via a crafted POST request or theCVE-2020-10374 · Other software · Paessler · reported by MITRECritical 9.8
A webserver component in Paessler PRTG Network Monitor 19.2.50 to PRTG 20.1.56 allows unauthenticated remote command execution via a crafted POST request or the what parameter of the screenshot function in the Contact Support form.
- Product
- Prtg Network Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.paessler.comtehtris.com
Mar 30, 2020Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading to sensitive information disclosure.CVE-2020-8509 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading to sensitive information disclosure.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Mar 30, 2020Toyota 2017 Model Year DCU (Display Control Unit) allows an unauthenticated attacker within Bluetooth range to cause a denial of service attack and/or execute aCVE-2020-5551 · Other software · TOYOTA MOTOR CORPORATION · reported by vultures@jpcert.or.jpHigh 8.8
Toyota 2017 Model Year DCU (Display Control Unit) allows an unauthenticated attacker within Bluetooth range to cause a denial of service attack and/or execute an arbitrary command. The affected DCUs are installed in Lexus (LC, LS, NX, RC, RC F), TOYOTA CAMRY, and TOYOTA SIENNA manufactured in the regions other than Japan from Oct. 2016 to Oct. 2019. An attacker with certain knowledge on the target vehicle control system may be able to send some diagnostic commands to ECUs with some limited availability impacts; the vendor states critical vehicle controls such as driving, turning, and stopping are not affected.
- Product
- DCU (Display Control Unit)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2020GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specifCVE-2020-10955 · Websites & servers · Gitlab · reported by MITREMedium 6.5
GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specific folders.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Mar 27, 2020In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts.CVE-2020-5863 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.6
In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which is created is only able to upload a new license to the system but cannot view or modify any other components of the system.
- Product
- Nginx Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsupport.f5.com
Mar 26, 2020A vulnerability in the SonicWall SMA1000 HTTP Extraweb server allows an unauthenticated remote attacker to cause HTTP server crash which leads to Denial of ServCVE-2020-5129 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 7.5
A vulnerability in the SonicWall SMA1000 HTTP Extraweb server allows an unauthenticated remote attacker to cause HTTP server crash which leads to Denial of Service. This vulnerability affected SMA1000 Version 12.1.0-06411 and earlier.
- Product
- SMA1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.compsirt.global.sonicwall.com
Mar 25, 2020Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password resets via login/resetadminpassword of the default admin accountCVE-2020-10965 · Other software · Teradici · reported by MITREHigh 8.1
Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password resets via login/resetadminpassword of the default admin account. This vulnerability only exists when the default admin account is not disabled. It is fixed in 20.01.1 and 19.11.2.
- Product
- Pcoip Management Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhealdb.techhelp.teradici.com
Mar 24, 2020IBM Content Navigator 3.0CD could disclose sensitive information to an unauthenticated user which could be used to aid in further attacks against the system.CVE-2020-4309 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Content Navigator 3.0CD could disclose sensitive information to an unauthenticated user which could be used to aid in further attacks against the system. IBM X-Force ID: 177080.
- Product
- Content Navigator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 23, 2020In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services.CVE-2020-10871 · Other software · Openwrt · reported by MITREMedium 5.3
In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance of this report because, for instances reachable by an unauthenticated actor, the same information is available in other (more complex) ways, and there is no plan to restrict the information further
- Product
- Luci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2020In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history.CVE-2020-8497 · Other software · Artica · reported by MITREMedium 5.3
In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordk4m1ll0.comk4m1ll0.com
Mar 18, 2020Aquaforest TIFF Server 4.0 allows Unauthenticated Arbitrary File Download.CVE-2020-9325 · Other software · Aquaforest · reported by MITREHigh 7.5
Aquaforest TIFF Server 4.0 allows Unauthenticated Arbitrary File Download.
- Product
- Tiff Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaquaforest.comcriticalstart.com
Mar 18, 2020Aquaforest TIFF Server 4.0 allows Unauthenticated SMB Hash Capture via UNC.CVE-2020-9324 · Other software · Aquaforest · reported by MITREHigh 7.5
Aquaforest TIFF Server 4.0 allows Unauthenticated SMB Hash Capture via UNC.
- Product
- Tiff Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaquaforest.comcriticalstart.com
Mar 18, 2020Aquaforest TIFF Server 4.0 allows Unauthenticated File and Directory Enumeration via tiffserver/tssp.aspx.CVE-2020-9323 · Other software · Aquaforest · reported by MITREMedium 5.3
Aquaforest TIFF Server 4.0 allows Unauthenticated File and Directory Enumeration via tiffserver/tssp.aspx.
- Product
- Tiff Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaquaforest.comcriticalstart.com
Mar 18, 2020IBM Tivoli Netcool/OMNIbus 8.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmiCVE-2020-4199 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Tivoli Netcool/OMNIbus 8.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 174910.
- Product
- Tivoli Netcool/OMNIbus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 15, 2020An Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below may allow an unauthenticated attacker to perform aCVE-2019-17654 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.8
An Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below may allow an unauthenticated attacker to perform a Cross-Site WebSocket Hijacking (CSWSH) attack.
- Product
- Fortinet FortiManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Mar 15, 2020A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitableCVE-2020-9290 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.3
A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
- Product
- FortiClientWindows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.comfortiguard.com
Mar 15, 2020A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitableCVE-2020-9287 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.7
A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
- Product
- FortiClientEMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.comfortiguard.com
Mar 13, 2020The web application of some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was vulnerable to path traversal, allowing an unauthenticated user tCVE-2019-13195 · Other software · Kyocera · reported by MITREHigh 7.5
The web application of some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was vulnerable to path traversal, allowing an unauthenticated user to retrieve arbitrary files, or check if files or folders existed within the file system.
- Product
- Ecosys M5526cdw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnccgroup.trustnccgroup.trust
Mar 13, 2020All configuration parameters of certain Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were accessible by unauthenticated users.CVE-2019-13205 · Other software · Kyocera · reported by MITREHigh 7.5
All configuration parameters of certain Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were accessible by unauthenticated users. This information was only presented in the menus when authenticated, and the pages that loaded this information were also protected. However, all files that contained the configuration parameters were accessible. These files contained sensitive information, such as users, community strings, and other passwords configured in the printer.
- Product
- Ecosys M5526cdw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnccgroup.trustnccgroup.trust
Mar 13, 2020Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servleCVE-2019-19799 · Email & office · Zohocorp · reported by MITREMedium 5.3
Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servlet.
- Product
- Manageengine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.commanageengine.com
Mar 13, 2020Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the administrative API.CVE-2019-12182 · Other software · Safescan · reported by MITRECritical 9.8
Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the administrative API.
- Product
- Ta-8010 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comprocheckup.com
Mar 13, 2020StorageGRID (formerly StorageGRID Webscale) versions 10.0.0 through 11.3 prior to 11.2.0.8 and 11.3.0.4 are susceptible to a vulnerability which allows an unautCVE-2020-8571 · Other software · NetApp · reported by security-alert@netapp.comHigh 7.5
StorageGRID (formerly StorageGRID Webscale) versions 10.0.0 through 11.3 prior to 11.2.0.8 and 11.3.0.4 are susceptible to a vulnerability which allows an unauthenticated remote attacker to cause a Denial of Service (DoS).
- Product
- StorageGRID (formerly StorageGRID Webscale)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsecurity.netapp.com
Mar 12, 2020A Cross-Site Request Forgery (CSRF) vulnerability in the user interface of Fortinet FortiSIEM 5.2.5 could allow a remote, unauthenticated attacker to perform arCVE-2019-17653 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.8
A Cross-Site Request Forgery (CSRF) vulnerability in the user interface of Fortinet FortiSIEM 5.2.5 could allow a remote, unauthenticated attacker to perform arbitrary actions using an authenticated user's session by persuading the victim to follow a malicious link.
- Product
- Fortinet FortiSIEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Mar 12, 2020An Improper Neutralization of Input vulnerability in the Anomaly Detection Parameter Name in Fortinet FortiWeb 6.0.5, 6.2.0, and 6.1.1 may allow a remote unauthCVE-2019-16156 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 6.1
An Improper Neutralization of Input vulnerability in the Anomaly Detection Parameter Name in Fortinet FortiWeb 6.0.5, 6.2.0, and 6.1.1 may allow a remote unauthenticated attacker to perform a Cross Site Scripting attack (XSS).
- Product
- Fortinet FortiWeb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Mar 12, 2020Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial ofCVE-2020-0556 · Other software · Intel · reported by secure@intel.comHigh 7.1
Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial of service via adjacent access
- Product
- BlueZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.