Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

2,323 results · page 33 of 47

Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25149 · Other software · Observium · reported by MITREHigh 8.8
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /device/device=345/?tab=health&metric=../ because of device/health.inc.php.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25148 · Other software · Observium · reported by MITREMedium 6.1
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. this can occur via /iftype/type= because of pages/iftype.inc.php.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25147 · Other software · Observium · reported by MITRECritical 9.8
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. This can occur via username[0] to the default URI, because of includes/authenticate.inc.php.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25146 · Other software · Observium · reported by MITREMedium 6.1
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via la_id to the /syslog_rules URI for edit_syslog_rule.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25145 · Other software · Observium · reported by MITREHigh 8.8
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /device/device=345/?tab=ports&view=../ URIs because of device/port.inc.php.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25144 · Other software · Observium · reported by MITREHigh 8.8
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /apps/?app=../ URIs.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25143 · Other software · Observium · reported by MITREHigh 8.8
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. This can occur via /ajax/device_entities.php?entity_type=netscalervsvr&device_id[]= because of /ajax/device_entities.php.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25142 · Other software · Observium · reported by MITREMedium 6.5
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable if any links and forms lack an unpredictable CSRF token. Without such a token, attackers can forge malicious requests, such as for adding Device Settings via the /addsrv URI.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25141 · Other software · Observium · reported by MITREMedium 6.1
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via a /device/device=140/tab=wifi/view= URI.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25140 · Other software · Observium · reported by MITREMedium 6.1
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur in pages/contacts.inc.php.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.observium.org docs.observium.org
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25139 · Other software · Observium · reported by MITREMedium 6.1
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via la_id to the /syslog_rules URI for delete_syslog_rule, because of syslog_rules.inc.php.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25138 · Other software · Observium · reported by MITREMedium 6.1
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via /alert_check/action=delete_alert_checker/alert_test_id= because of pages/alert_check.inc.php.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25137 · Other software · Observium · reported by MITREMedium 6.1
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the alert_name or alert_message parameter to the /alert_check URI.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25136 · Other software · Observium · reported by MITREHigh 8.8
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /device/device=345/?tab=routing&proto=../ URIs to device/routing.inc.php.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25135 · Other software · Observium · reported by MITREMedium 6.1
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the graph_title parameter to the graphs/ URI.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25134 · Other software · Observium · reported by MITREHigh 8.8
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /settings/?format=../ URIs to pages/settings.inc.php.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25133 · Other software · Observium · reported by MITREHigh 8.8
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /ports/?format=../ URIs to pages/ports.inc.php.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25132 · Other software · Observium · reported by MITRECritical 9.8
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending the improper variable type Array allows a bypass of core SQL Injection sanitization. Users are able to inject malicious statements in multiple functions. This vulnerability leads to full authentication bypass: any unauthorized user with access to the application is able to exploit this vulnerability. This can occur via the Cookie header to the default URI, within includes/authenticate.inc.php.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server confiCVE-2020-5929 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 5.9
In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous (ADH) or Ephemeral (DHE) Diffie-Hellman key exchange and Single DH use option not enabled in the options list may be vulnerable to crafted SSL/TLS Handshakes that may result with a PMS (Pre-Master Secret) that starts in a 0 byte and may lead to a recovery of plaintext messages as BIG-IP TLS/SSL ADH/DHE sends different error messages acting as an oracle. Similar error messages when PMS starts with 0 byte coupled with very precise timing measurement observation may also expose this vulnerability.
Product
Big-ip Access Policy Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.f5.com support.f5.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25131 · Other software · Observium · reported by MITREMedium 6.1
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the role_name or role_descr parameter to the roles/ URI.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 25, 2020An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.CVE-2020-25130 · Other software · Observium · reported by MITREMedium 6.5
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending an improper variable type of Array allows a bypass of core SQL Injection sanitization. Authenticated users are able to inject malicious SQL queries. This vulnerability leads to full database leak including ckeys that can be used in the authentication process without knowing the username and cleartext password. This can occur via the ajax/actions.php group_id field.
Product
Observium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 11, 2020<p>A remote code execution vulnerability exists in the way that the IEToEdge Browser Helper Object (BHO) plugin on Internet Explorer handles objects in memory.CVE-2020-16884 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.2
<p>A remote code execution vulnerability exists in the way that the IEToEdge Browser Helper Object (BHO) plugin on Internet Explorer handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit this vulnerability and then convince a user to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full us
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Sep 9, 2020Ingenico Telium 2 POS terminals have an insecure NTPT3 protocol.CVE-2018-17774 · Other software · Ingenico · reported by MITREMedium 6.8
Ingenico Telium 2 POS terminals have an insecure NTPT3 protocol. This is fixed in Telium 2 SDK v9.32.03 patch N.
Product
Telium 2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ingenico.us ptsecurity.com
Sep 9, 2020Ingenico Telium 2 POS terminals have a buffer overflow via SOCKET_TASK in the NTPT3 protocol.CVE-2018-17773 · Other software · Ingenico · reported by MITREMedium 6.8
Ingenico Telium 2 POS terminals have a buffer overflow via SOCKET_TASK in the NTPT3 protocol. This is fixed in Telium 2 SDK v9.32.03 patch N.
Product
Telium 2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ingenico.us ptsecurity.com
Sep 9, 2020Ingenico Telium 2 POS terminals allow arbitrary code execution via the TRACE protocol.CVE-2018-17772 · Other software · Ingenico · reported by MITREMedium 6.8
Ingenico Telium 2 POS terminals allow arbitrary code execution via the TRACE protocol. This is fixed in Telium 2 SDK v9.32.03 patch N.
Product
Telium 2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ingenico.us ptsecurity.com
Sep 9, 2020Ingenico Telium 2 POS terminals have hardcoded FTP credentials.CVE-2018-17771 · Other software · Ingenico · reported by MITREMedium 6.6
Ingenico Telium 2 POS terminals have hardcoded FTP credentials. This is fixed in Telium 2 SDK v9.32.03 patch N.
Product
Telium 2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ingenico.us ptsecurity.com
Sep 9, 2020Ingenico Telium 2 POS terminals have a buffer overflow via the RemotePutFile command of the NTPT3 protocol.CVE-2018-17770 · Other software · Ingenico · reported by MITREMedium 6.6
Ingenico Telium 2 POS terminals have a buffer overflow via the RemotePutFile command of the NTPT3 protocol. This is fixed in Telium 2 SDK v9.32.03 patch N.
Product
Telium 2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ingenico.us ptsecurity.com
Sep 9, 2020Ingenico Telium 2 POS terminals have a buffer overflow via the 0x26 command of the NTPT3 protocol.CVE-2018-17769 · Other software · Ingenico · reported by MITREMedium 6.6
Ingenico Telium 2 POS terminals have a buffer overflow via the 0x26 command of the NTPT3 protocol. This is fixed in Telium 2 SDK v9.32.03 patch N.
Product
Telium 2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ingenico.us ptsecurity.com
Sep 9, 2020Ingenico Telium 2 POS terminals have an insecure TRACE protocol.CVE-2018-17768 · Other software · Ingenico · reported by MITREMedium 6.8
Ingenico Telium 2 POS terminals have an insecure TRACE protocol. This is fixed in Telium 2 SDK v9.32.03 patch N.
Product
Telium 2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ingenico.us ptsecurity.com
Sep 9, 2020Ingenico Telium 2 POS terminals have hardcoded PPP credentials.CVE-2018-17767 · Other software · Ingenico · reported by MITREMedium 6.8
Ingenico Telium 2 POS terminals have hardcoded PPP credentials. This is fixed in Telium 2 SDK v9.32.03 patch N.
Product
Telium 2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ingenico.us ptsecurity.com
Sep 9, 2020Ingenico Telium 2 POS Telium2 OS allow bypass of file-reading restrictions via the NTPT3 protocol.CVE-2018-17766 · Other software · Ingenico · reported by MITREMedium 4.6
Ingenico Telium 2 POS Telium2 OS allow bypass of file-reading restrictions via the NTPT3 protocol. This is fixed in Telium 2 SDK v9.32.03 patch N.
Product
Telium 2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ingenico.us ptsecurity.com
Sep 9, 2020Ingenico Telium 2 POS terminals have undeclared TRACE protocol commands.CVE-2018-17765 · Other software · Ingenico · reported by MITREMedium 6.8
Ingenico Telium 2 POS terminals have undeclared TRACE protocol commands. This is fixed in Telium 2 SDK v9.32.03 patch N.
Product
Telium 2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ingenico.us ptsecurity.com
Sep 1, 2020IBM InfoSphere Guardium 7.0, 8.0, 8.01, and 8.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.CVE-2012-3341 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM InfoSphere Guardium 7.0, 8.0, 8.01, and 8.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 78294.
Product
InfoSphere Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com exchange.xforce.ibmcloud.com
Sep 1, 2020IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to XML external entity injection, caused by improper validation of user-supplied input.CVE-2012-3340 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to XML external entity injection, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 78291.
Product
InfoSphere Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com exchange.xforce.ibmcloud.com
Sep 1, 2020IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to bypass security restrictions, caused by improper restrictions on the create new userCVE-2012-3338 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to bypass security restrictions, caused by improper restrictions on the create new user account functionality. An attacker could exploit this vulnerability to create unprivileged user accounts. IBM X-Force ID: 78286.
Product
InfoSphere Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com exchange.xforce.ibmcloud.com
Sep 1, 2020IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to traverse directories on the system.CVE-2012-3337 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to download arbitrary files on the system. IBM X-Force ID: 78284.
Product
InfoSphere Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com exchange.xforce.ibmcloud.com
Sep 1, 2020IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to SQL injection.CVE-2012-3336 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to SQL injection. A remote authenticated attacker could send specially-crafted SQL statements to multiple scripts, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 78282.
Product
InfoSphere Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com exchange.xforce.ibmcloud.com
Aug 27, 2020On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string specifiers in a device name in the COMANCVE-2020-16142 · Other software · Mercedes-benz · reported by MITRELow 3.5
On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string specifiers in a device name in the COMAND infotainment software.
Product
Comand
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com medium.com
Aug 27, 2020IBM Security Guardium Insights 2.0.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or CVE-2020-4603 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.2
IBM Security Guardium Insights 2.0.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. IBM X-Force ID: 184880.
Product
Security Guardium Insights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 27, 2020IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict TranspoCVE-2020-4175 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 174684.
Product
Security Guardium Insights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 27, 2020IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.CVE-2020-4174 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 174683.
Product
Security Guardium Insights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 27, 2020IBM Security Guardium Insights 2.0.1 stores sensitive information in URL parameters.CVE-2020-4172 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Security Guardium Insights 2.0.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 174408.
Product
Security Guardium Insights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 27, 2020IBM Security Guardium Insights 2.0.1 allows web pages to be stored locally which can be read by another user on the system.CVE-2020-4171 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security Guardium Insights 2.0.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174407.
Product
Security Guardium Insights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 27, 2020IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.CVE-2020-4169 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 174405.
Product
Security Guardium Insights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 27, 2020IBM Security Guardium Insights 2.0.1 could allow an attacker to obtain sensitive information or perform unauthorized actions due to improper authenciation mechaCVE-2020-4167 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Security Guardium Insights 2.0.1 could allow an attacker to obtain sensitive information or perform unauthorized actions due to improper authenciation mechanisms. IBM X-Force ID: 174403.
Product
Security Guardium Insights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 27, 2020IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the brCVE-2020-4166 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 174402.
Product
Security Guardium Insights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 26, 2020IBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system.CVE-2019-4695 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 171926.
Product
Security Guardium Data Encryption
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 26, 2020IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote authenticated attacker to execute arbitrary commands on the system.CVE-2019-4713 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 172084.
Product
Security Guardium Data Encryption
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 26, 2020IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is deployed with active debugging code that can create unintended entry points.CVE-2019-4701 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is deployed with active debugging code that can create unintended entry points. IBM X-Force ID: 171936.
Product
Security Guardium Data Encryption
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 26, 2020IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated dCVE-2019-4699 · Other software · IBM · reported by psirt@us.ibm.comLow 2.7
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 171931.
Product
Security Guardium Data Encryption
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.