Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,716 results · page 33 of 55
Jun 24, 2021Directory Traversal vulnerability in WebPort <=1.19.1 in tags of system settings.CVE-2020-18665 · Other software · Webport · reported by MITREMedium 5.3
Directory Traversal vulnerability in WebPort <=1.19.1 in tags of system settings.
- Product
- Web Port
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021An issue was discovered in the stripTags and unescapeHTML components in Prototype 1.7.3 where an attacker can cause a Regular Expression Denial of Service (ReDOCVE-2020-27511 · Other software · Prototypejs · reported by MITREHigh 7.5
An issue was discovered in the stripTags and unescapeHTML components in Prototype 1.7.3 where an attacker can cause a Regular Expression Denial of Service (ReDOS) through stripping crafted HTML tags.
- Product
- Prototype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprototypejs.orggithub.com
Jun 18, 2021The npm package "striptags" is an implementation of PHP's strip_tags in Typescript.CVE-2021-32696 · Other software · ericnorris · reported by GitHubLow 3.7
The npm package "striptags" is an implementation of PHP's strip_tags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function. This can lead to a XSS.
- Product
- striptags
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2021In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack.CVE-2020-35373 · Other software · Fiyo · reported by MITREMedium 6.1
In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordloganclaw.comloganclaw.com
Jun 16, 2021Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the productCVE-2021-34801 · Other software · Valine.js · reported by MITREMedium 5.3
Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version.
- Product
- Valine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2021SINAMICS medium voltage routable products are affected by a vulnerability in the Sm@rtServer component for remote access that could allow an unauthenticated attCVE-2021-27388 · Other software · Siemens · reported by productcert@siemens.comCritical 9.8
SINAMICS medium voltage routable products are affected by a vulnerability in the Sm@rtServer component for remote access that could allow an unauthenticated attacker to cause a denial-of-service condition, and/or execution of limited configuration modifications and/or execution of limited control commands on the SINAMICS Medium Voltage Products, Remote Access (SINAMICS SL150: All versions, SINAMICS SM150: All versions, SINAMICS SM150i: All versions).
- Product
- Sinamics Sl150 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Jun 6, 2021On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write operation (aka conduct a "tear off" attack) over RFID to bypass a Monotonic Counter pCVE-2021-33881 · Other software · NXP · reported by MITREMedium 4.2
On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write operation (aka conduct a "tear off" attack) over RFID to bypass a Monotonic Counter protection mechanism. The impact depends on how the anti tear-off feature is used in specific applications such as public transportation, physical access control, etc.
- Product
- Mifare Ultralight Ev1 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.quarkslab.comnxp.com
Jun 3, 2021Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs.CVE-2021-32662 · Other software · backstage · reported by GitHubMedium 6.5
Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In `@backstage/techdocs-common` versions prior to 0.6.3, a malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for `docs_dir` in `mkdocs.yml`. These files would then be available over the TechDocs backend API. This vulnerability is mitigated by the fact that an attacker would need access to modify the `mkdocs.yml` in the documentation source code, and would also need access to the TechDocs backend API. The vulnerability is patched in the `0.6.3` release of `@backstage/techdocs-common`.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2021Backstage is an open platform for building developer portals.CVE-2021-32661 · Other software · backstage · reported by GitHubMedium 6.8
Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an `object` element. This may give access to sensitive data when other users visit that same documentation page. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store. The vulnerability is patched in the `0.9.5` release of `@backstage/plugin-techdocs`.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2021Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs.CVE-2021-32660 · Other software · backstage · reported by GitHubMedium 6.8
Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of `@backstage/tehdocs-common` prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed. If the TechDocs API is hosted on the same origin as the Backstage app or other backend plugins, this may give access to sensitive data. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store. The vulnerability is patched in the `0.6.4` release of `@backstage/techdocs-common`.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2021GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.CVE-2021-3522 · Other software · Gstreamer · reported by Red HatMedium 5.5
GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.
- Product
- Gstreamer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comsecurity.gentoo.org
Jun 1, 2021Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server.CVE-2021-30180 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.
- Product
- Apache Dubbo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jun 1, 2021Database Backup for: Did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tagCVE-2021-24322 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tag, leading to a Stored Cross-Site Scripting issue.
- Product
- Database Backup for
- Fixed in
- 2.4
- What to do
- Update Database Backup for to 2.4 or newer.
May 28, 2021A flaw was found in pki-core 10.9.0.CVE-2020-25715 · Other software · Dogtagpki · reported by Red HatMedium 6.1
A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity.
- Product
- Dogtagpki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
May 26, 2021Buffer Overflow vulnerability in FFmpeg 4.2 in mov_write_video_tag due to the out of bounds in libavformat/movenc.c, which could let a remote malicious user obtCVE-2020-22015 · Other software · Ffmpeg · reported by MITREHigh 8.8
Buffer Overflow vulnerability in FFmpeg 4.2 in mov_write_video_tag due to the out of bounds in libavformat/movenc.c, which could let a remote malicious user obtain sensitive information, cause a Denial of Service, or execute arbitrary code.
- Product
- Ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgtrac.ffmpeg.org
Apr 30, 2021A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery CVE-2020-1721 · Other software · Dogtagpki · reported by Red HatMedium 6.1
A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
- Product
- Dogtagpki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Apr 20, 2021OMICRON StationGuard before 1.10 allows remote attackers to cause a denial of service (connectivity outage) via crafted tcp/20499 packets to the CTRL Ethernet pCVE-2021-30464 · Other software · Omicronenergy · reported by MITREHigh 7.5
OMICRON StationGuard before 1.10 allows remote attackers to cause a denial of service (connectivity outage) via crafted tcp/20499 packets to the CTRL Ethernet port.
- Product
- Stationguard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordomicronenergy.comomicronenergy.com
Apr 13, 2021htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php.CVE-2021-30637 · Other software · Htmly · reported by MITREMedium 5.4
htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 12, 2021Advanced Booking Calendar: Did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tagCVE-2021-24225 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue
- Product
- Advanced Booking Calendar
- Fixed in
- 1.6.7
- What to do
- Update Advanced Booking Calendar to 1.6.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter.CVE-2021-24204 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
- Product
- Elementor Website Builder
- Fixed in
- 3.1.4
- What to do
- Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter.CVE-2021-24203 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘text’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.
- Product
- Elementor Website Builder
- Fixed in
- 3.1.4
- What to do
- Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter.CVE-2021-24201 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
- Product
- Elementor Website Builder
- Fixed in
- 3.1.4
- What to do
- Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Mar 30, 2021Potential for arbitrary code execution in npm package @thi.ng/egf `#gpg`-tagged property values (only if `decrypt: true` option is enabled).CVE-2021-21412 · Other software · thi-ng · reported by GitHubMedium 6.4
Potential for arbitrary code execution in npm package @thi.ng/egf `#gpg`-tagged property values (only if `decrypt: true` option is enabled). PR with patch has been submitted and will has been released as of v0.4.0 By default the EGF parse functions do NOT attempt to decrypt values (since GPG only available in non-browser env). However, if GPG encrypted values are used/required: 1. Perform a regex search for `#gpg`-tagged values in the EGF source file/string and check for backtick (\`) chars in the encrypted value string 2. Replace/remove them or skip parsing if present.
- Product
- egf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2021Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases pageCVE-2021-22172 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2021Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inCVE-2021-22886 · Other software · Rocket.chat · reported by support@hackerone.comMedium 6.1
Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rocket.chatgithub.com
Mar 23, 2021Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execuCVE-2020-24994 · Other software · Libass Project · reported by MITREHigh 8.8
Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.
- Product
- Libass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2021rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array.CVE-2021-28660 · Computers, phones & browsers · Linux · reported by MITREHigh 8.8
rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org releases, CVE IDs are not normally used for drivers/staging/* (unfinished work); however, system integrators may have situations in which a drivers/staging issue is relevant to their own customer base.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Mar 15, 2021A flaw was found in pki-core.CVE-2021-20179 · Other software · Dogtagpki · reported by Red HatHigh 8.1
A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerability is to data confidentiality and integrity.
- Product
- Dogtagpki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Mar 10, 2021In qtaguid_untag of xt_qtaguid.c, there is a possible memory corruption due to a use after free.CVE-2021-0399 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In qtaguid_untag of xt_qtaguid.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-176919394References: Upstream kernel
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 9, 2021When a user opens manipulated Tag Image File Format (.TIFF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the appliCVE-2021-27590 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
When a user opens manipulated Tag Image File Format (.TIFF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Mar 5, 2021The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.CVE-2021-27581 · Other software · Kentico · reported by MITRECritical 9.8
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.
- Product
- Kentico CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comkontent.ai
Feb 22, 2021MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode).CVE-2021-27279 · Other software · Mybb · reported by MITREMedium 5.4
MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode).
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2021All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags.CVE-2020-28463 · Other software · Reportlab · reported by report@snyk.ioMedium 6.5
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
- Product
- Reportlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Feb 11, 2021Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development.CVE-2021-21307 · Other software · lucee · reported by GitHubHigh 8.6
Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator.
- Product
- Lucee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordciacfug.orgpacketstormsecurity.com
Feb 8, 2021A vulnerability in web UI input field of GateManager allows authenticated attacker to enter script tags that could cause XSS.CVE-2020-29021 · Other software · Secomea · reported by VulnerabilityReporting@secomea.comLow 3.5
A vulnerability in web UI input field of GateManager allows authenticated attacker to enter script tags that could cause XSS. This issue affects: GateManager all versions prior to 9.3.
- Product
- GateManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecomea.comsecomea.com
Feb 8, 2021When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information.CVE-2020-1779 · Other software · OTRS AG · reported by security@otrs.comMedium 4.3
When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information. This issue affects: OTRS AG OTRSTicketForms 6.0.x version 6.0.40 and prior versions; 7.0.x version 7.0.29 and prior versions; 8.0.x version 8.0.3 and prior versions.
- Product
- OTRSTicketForms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI.CVE-2021-3165 · Other software · Missionlabs · reported by MITREHigh 8.8
SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI.
- Product
- Smartagent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordorionhridoy.mepacketstormsecurity.com
Jan 26, 2021The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag.CVE-2021-3190 · Other software · Async-git Project · reported by MITRECritical 9.8
The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag.
- Product
- Async-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.checkmarx.netgithub.com
Jan 13, 2021OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input.CVE-2021-23899 · Other software · Owasp · reported by MITRECritical 9.8
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.
- Product
- Json-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2021Windows NT Lan Manager Datagram Receiver Driver Information Disclosure VulnerabilityCVE-2021-1676 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 20H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 2, 2021In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag.CVE-2020-28852 · Other software · Golang · reported by MITREHigh 7.5
In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)
- Product
- Text
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Dec 28, 2020dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.CVE-2020-29245 · Other software · TAG Project · reported by MITREMedium 6.5
dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.
- Product
- TAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2020dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readTextWithDescrFrame.CVE-2020-29244 · Other software · TAG Project · reported by MITREMedium 6.5
dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readTextWithDescrFrame.
- Product
- TAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2020dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readAPICFrame.CVE-2020-29243 · Other software · TAG Project · reported by MITREMedium 6.5
dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readAPICFrame.
- Product
- TAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2020dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readPICFrame.CVE-2020-29242 · Other software · TAG Project · reported by MITREMedium 6.5
dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readPICFrame.
- Product
- TAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2020srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS address.CVE-2020-35573 · Other software · Postsrsd Project · reported by MITREHigh 7.5
srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS address.
- Product
- Postsrsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Dec 14, 2020Envoy before 1.16.1 mishandles dropped and truncated datagrams, as demonstrated by a segmentation fault for a UDP packet size larger than 1500.CVE-2020-35471 · Other software · Envoyproxy · reported by MITREHigh 7.5
Envoy before 1.16.1 mishandles dropped and truncated datagrams, as demonstrated by a segmentation fault for a UDP packet size larger than 1500.
- Product
- Envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2020Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, python/tarfile.cc, aka GHSL-2020-170.CVE-2020-27351 · Other software · Canonical · reported by security@ubuntu.comLow 2
Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, python/tarfile.cc, aka GHSL-2020-170. This issue affects: python-apt 1.1.0~beta1 versions prior to 1.1.0~beta1ubuntu0.16.04.10; 1.6.5ubuntu0 versions prior to 1.6.5ubuntu0.4; 2.0.0ubuntu0 versions prior to 2.0.0ubuntu0.20.04.2; 2.1.3ubuntu1 versions prior to 2.1.3ubuntu1.1;
- Product
- python-apt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netusn.ubuntu.com
Dec 8, 2020In ParseMetaGeometry() of MagickCore/geometry.c, image height and width calculations can lead to divide-by-zero conditions which also lead to undefined behaviorCVE-2020-27756 · Other software · Imagemagick · reported by Red HatMedium 5.5
In ParseMetaGeometry() of MagickCore/geometry.c, image height and width calculations can lead to divide-by-zero conditions which also lead to undefined behavior. This flaw can be triggered by a crafted input file processed by ImageMagick and could impact application availability. The patch uses multiplication in addition to the function `PerceptibleReciprocal()` in order to prevent such divide-by-zero conditions. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 7, 2020The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk.CVE-2020-25628 · Other software · Moodle · reported by Red HatMedium 6.1
The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgmoodle.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.