Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,620 results · page 34 of 73
Feb 15, 2022An issue in SOA2Login::commented of ScratchOAuth2 before commit a91879bd58fa83b09283c0708a1864cdf067c64a allows attackers to authenticate as other users on downCVE-2021-46250 · Other software · Scratchoauth2 Project · reported by MITRECritical 10
An issue in SOA2Login::commented of ScratchOAuth2 before commit a91879bd58fa83b09283c0708a1864cdf067c64a allows attackers to authenticate as other users on downstream components that rely on ScratchOAuth2.
- Product
- Scratchoauth2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSRFCVE-2021-46366 · Other software · Magnolia-cms · reported by MITREHigh 8.8
An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSRF) in order to brute force and exfiltrate users' credentials.
- Product
- Magnolia CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.magnolia-cms.comgithub.com
Feb 11, 2022A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause Sensitive data such as login credentials being exposed when a Network is sCVE-2021-22798 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.5
A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause Sensitive data such as login credentials being exposed when a Network is sniffed. Affected Product: Conext� ComBox (All Versions)
- Product
- Conext Combox Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server login and perform furtheCVE-2022-22987 · Other software · Advantech · reported by ics-cert@hq.dhs.govCritical 9.8
The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server login and perform further actions.
- Product
- ADAM-3600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "referuCVE-2021-45408 · Other software · Seeddms · reported by MITREMedium 6.1
Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "referuri" parameter.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsunil-singh.notion.sitesunil-singh.notion.site
Feb 4, 2022Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote local usCVE-2021-29397 · Other software · Globalnorthstar · reported by MITREHigh 7.5
Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote local user to intercept users credentials transmitted in cleartext over HTTP.
- Product
- Northstar Club Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordardent-security.comardent-security.com
Feb 3, 2022TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function.CVE-2021-45739 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the flag parameter.
- Product
- A720r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function.CVE-2021-45737 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the Host parameter.
- Product
- A720r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2022AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.CVE-2022-24223 · Other software · Thedigitalcraft · reported by MITRECritical 9.8
AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.
- Product
- Atomcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 1, 2022Custom Dashboard & Login Page: Does not sanitise some of its settingsCVE-2021-24944 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Custom Dashboard & Login Page
- Fixed in
- 7.0
- What to do
- Update Custom Dashboard & Login Page to 7.0 or newer.
Jan 29, 2022Adenza AxiomSL ControllerView through 10.8.1 allows redirection for SSO login URLs.CVE-2022-22919 · Other software · Adenza · reported by MITREMedium 6.1
Adenza AxiomSL ControllerView through 10.8.1 allows redirection for SSO login URLs.
- Product
- Axiomsl Controllerview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136_20121102.CVE-2021-40404 · Other software · Reolink · reported by talos-cna@cisco.comMedium 6.5
An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to authentication bypass. An attacker can send an HTTP request to trigger this vulnerability.
- Product
- Rlc-410w Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 28, 2022Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password.CVE-2022-23863 · Email & office · Zohocorp · reported by MITREMedium 6.5
Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jan 28, 2022Online Motorcycle (Bike) Rental System 1.0 is vulnerable to a Blind Time-Based SQL Injection attack within the login portal.CVE-2021-44249 · Other software · Online Motorcycle (bike) Rental System Project · reported by MITRECritical 9.8
Online Motorcycle (Bike) Rental System 1.0 is vulnerable to a Blind Time-Based SQL Injection attack within the login portal. This can lead attackers to remotely dump MySQL database credentials.
- Product
- Online Motorcycle (bike) Rental System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoctorzorka.github.ioexploit-db.com
Jan 21, 2022HMS v1.0 was discovered to contain a SQL injection vulnerability via patientlogin.php.CVE-2022-23366 · Other software · HMS Project · reported by MITRECritical 9.8
HMS v1.0 was discovered to contain a SQL injection vulnerability via patientlogin.php.
- Product
- HMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 21, 2022HMS v1.0 was discovered to contain a SQL injection vulnerability via doctorlogin.php.CVE-2022-23365 · Other software · HMS Project · reported by MITRECritical 9.8
HMS v1.0 was discovered to contain a SQL injection vulnerability via doctorlogin.php.
- Product
- HMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2022HMS v1.0 was discovered to contain a SQL injection vulnerability via adminlogin.php.CVE-2022-23364 · Other software · HMS Project · reported by MITRECritical 9.8
HMS v1.0 was discovered to contain a SQL injection vulnerability via adminlogin.php.
- Product
- HMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2022Cross site scripting (XSS) vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page.CVE-2021-33966 · Other software · Spotweb Project · reported by MITREMedium 5.4
Cross site scripting (XSS) vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page.
- Product
- Spotweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jan 18, 2022User Registration, Login & Landing Pages: Stored Cross-Site ScriptingCVE-2022-0232 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the loader_text parameter found in the ~/includes/templates/landing-page.php file which allows attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.2.7. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- User Registration, Login & Landing Pages
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update User Registration, Login & Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jan 18, 2022The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-SiCVE-2022-0215 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in the ~/includes/xoo-framework/admin/class-xoo-admin-settings.php file which makes it possible for attackers to update arbitrary options on a site that can be used to create an administrative user account and grant full privileged access to a compromised site. This affects versions <= 2.2 in Login/Signup Popup, versions <= 2.5.1 in Waitlist Woocommerce ( Back in stock notifier ), and versions <= 2.0 in Side Cart Woocommerce (Ajax).
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 14, 2022ASUS RT-AX56U’s login function contains a path traversal vulnerability due to its inadequate filtering for special characters in URL parameters, which allows anCVE-2022-22054 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 6.5
ASUS RT-AX56U’s login function contains a path traversal vulnerability due to its inadequate filtering for special characters in URL parameters, which allows an unauthenticated local area network attacker to access restricted system paths and download arbitrary files.
- Product
- RT-AX56U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 12, 2022Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login.CVE-2021-45449 · Other software · Docker · reported by MITREMedium 5.5
Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged in while on 4.3.0, 4.3.1. Gaining access to this data would require having access to the user’s local files.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comdocs.docker.com
Jan 12, 2022MartDevelopers Inc iResturant v1.0 allows Stored XSS by placing a payload in the username field during a login attempt.CVE-2021-43436 · Other software · Iresturant Project · reported by MITREMedium 5.4
MartDevelopers Inc iResturant v1.0 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.
- Product
- Iresturant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service List Section in login panel.CVE-2021-46072 · Other software · Vehicle Service Management System Project · reported by MITREMedium 4.8
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service List Section in login panel.
- Product
- Vehicle Service Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Category List Section in login panel.CVE-2021-46071 · Other software · Vehicle Service Management System Project · reported by MITREMedium 4.8
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Category List Section in login panel.
- Product
- Vehicle Service Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service Requests Section in login panel.CVE-2021-46070 · Other software · Vehicle Service Management System Project · reported by MITREMedium 4.8
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service Requests Section in login panel.
- Product
- Vehicle Service Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Mechanic List Section in login panel.CVE-2021-46069 · Other software · Vehicle Service Management System Project · reported by MITREMedium 4.8
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Mechanic List Section in login panel.
- Product
- Vehicle Service Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel.CVE-2021-46068 · Other software · Vehicle Service Management System Project · reported by MITREMedium 4.8
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel.
- Product
- Vehicle Service Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022A Stored Cross Site Scripting (XSS) vulnerability exists in Bludit 3.13.1 via the About Plugin in login panel.CVE-2021-45745 · Other software · Bludit · reported by MITREMedium 5.4
A Stored Cross Site Scripting (XSS) vulnerability exists in Bludit 3.13.1 via the About Plugin in login panel.
- Product
- Bludit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022A Stored Cross Site Scripting (XSS) vulnerability exists in bludit 3.13.1 via the TAGS section in login panel.CVE-2021-45744 · Other software · Bludit · reported by MITREMedium 5.4
A Stored Cross Site Scripting (XSS) vulnerability exists in bludit 3.13.1 via the TAGS section in login panel.
- Product
- Bludit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2021Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on tCVE-2021-36722 · Other software · Emuse · reported by cna@cyber.gov.ilHigh 7.1
Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on the affected endpoints. The SQLi caused by CWE-209: Generation of Error Message Containig Sensetive Information, showing parts of the aspx code and the webroot location , information an attacker can leverage to further compromise the host.
- Product
- eServices / eNvoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2021Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s privilege by modifyingCVE-2021-44160 · Other software · Carinal Tien Hospital · reported by twcert@cert.org.twHigh 7.3
Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s privilege by modifying the cookie parameter without authentication. The attacker can then perform limited operations on the system or modify data, making the service partially unavailable to the user.
- Product
- Health Report System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 27, 2021An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.CVE-2020-21238 · Other software · Chshcms · reported by MITRECritical 9.8
An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.
- Product
- Cscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2021An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks.CVE-2020-21237 · Other software · 8cms · reported by MITRECritical 9.8
An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks.
- Product
- Ljcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2021Nokia FastMile 3TG00118ABAD52 devices allow privilege escalation by an authenticated user via is_ctc_admin=1 to login_web_app.cgi and use of Import Config File.CVE-2021-45896 · Other software · Nokia · reported by MITREHigh 8.8
Nokia FastMile 3TG00118ABAD52 devices allow privilege escalation by an authenticated user via is_ctc_admin=1 to login_web_app.cgi and use of Import Config File.
- Product
- Fastmile Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeddiez.megist.github.com
Dec 27, 2021The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details.CVE-2021-4161 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an attacker admin rights through the HTTP web server.
- Product
- MGate MB3180 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2021Simple JWT Login: Can be used to create new WordPress user accounts with a randomly generated passwordCVE-2021-24998 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation.
- Product
- Simple JWT Login
- Fixed in
- 3.3.0
- What to do
- Update Simple JWT Login to 3.3.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 22, 2021An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exCVE-2021-20050 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 7.5
An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data.
- Product
- SonicWall SMA100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.compsirt.global.sonicwall.com
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attributeCVE-2021-24955 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- User Registration, Login Form, User Profile & Membership
- Fixed in
- 3.2.3
- What to do
- Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard pageCVE-2021-24954 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard page, leading to a Reflected Cross-Site Scripting issue
- Product
- User Registration, Login Form, User Profile & Membership
- Fixed in
- 3.2.3
- What to do
- Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 13, 2021Temporary Login Without Password: Does not have authorisation and CSRF checksCVE-2021-24836 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them
- Product
- Temporary Login Without Password
- Fixed in
- 1.7.1
- What to do
- Update Temporary Login Without Password to 1.7.1 or newer.
Dec 12, 2021An issue was discovered in /goform/login_process in Reprise RLM 14.2.CVE-2021-44155 · Other software · Reprisesoftware · reported by MITREMedium 5.3
An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Failed, but does not include this string if the username is invalid. This allows an attacker to enumerate valid users.
- Product
- Reprise License Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comreprisesoftware.com
Dec 10, 2021Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform.CVE-2021-31745 · Other software · Pluck-cms · reported by MITREHigh 7.5
Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not invalidate prior sessions after a password change, access can be sustained even after an administrator performs regular remediation attempts such as resetting their password.
- Product
- Pluck
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2021An information disclosure vulnerability in the login page of Huntflow Enterprise before 3.10.4 could allow an unauthenticated, remote user to get information abCVE-2021-37935 · Other software · Huntflow · reported by MITREHigh 7.5
An information disclosure vulnerability in the login page of Huntflow Enterprise before 3.10.4 could allow an unauthenticated, remote user to get information about the domain name of the configured LDAP server. An attacker could exploit this vulnerability by requesting the login page and searching for the "isLdap" JavaScript parameter in the HTML source code.
- Product
- Huntflow Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 10, 2021Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 could allow an unauthenCVE-2021-37934 · Other software · Huntflow · reported by MITRECritical 9.8
Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 could allow an unauthenticated, remote user to perform multiple login attempts for brute-force password guessing.
- Product
- Huntflow Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 9, 2021A improper authentication in Fortinet FortiAuthenticator version 6.4.0 allows user to bypass the second factor of authentication via a RADIUS login portal.CVE-2021-43068 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.4
A improper authentication in Fortinet FortiAuthenticator version 6.4.0 allows user to bypass the second factor of authentication via a RADIUS login portal.
- Product
- Fortinet FortiAuthenticator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Dec 7, 2021KNIME Server before 4.13.4 allows XSS via the old WebPortal login page.CVE-2021-44726 · Other software · Knime · reported by MITREHigh 8.8
KNIME Server before 4.13.4 allows XSS via the old WebPortal login page.
- Product
- Knime Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.knime.comzigrin.com
Dec 6, 2021b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the User login section.CVE-2021-31632 · Other software · B2evolution · reported by MITRECritical 9.8
b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the User login section. This vulnerability allows attackers to execute arbitrary code via a crafted input.
- Product
- B2evolution CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 6, 2021b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the User login page.CVE-2021-31631 · Other software · B2evolution · reported by MITREHigh 8.8
b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the User login page. This vulnerability allows attackers to escalate privileges.
- Product
- B2evolution CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 6, 2021LoginWP (Formerly Peter's Login Redirect): Does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin pageCVE-2021-24939 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting issue
- Product
- LoginWP (Formerly Peter's Login Redirect)
- Fixed in
- 3.0.0.5
- What to do
- Update LoginWP (Formerly Peter's Login Redirect) to 3.0.0.5 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.