Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

578new WordPress flaws this week

391,397entries in the database

2,994 results · page 35 of 60

Sep 30, 2020An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security dashboard.CVE-2020-13320 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security dashboard.
Product
GitLab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com gitlab.com
Sep 17, 2020In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check.CVE-2020-0431 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-144161459
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Sep 15, 2020Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected dashboard data via imCVE-2020-7297 · Other software · McAfee · reported by trellixpsirt@trellix.comMedium 5.7
Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected dashboard data via improper access control in the user interface.
Product
McAfee Web Gateway (MWG)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kc.mcafee.com kc.mcafee.com
Sep 14, 2020Codoforum 4.8.3 allows HTML Injection in the 'admin dashboard Manage users Section.'CVE-2020-21845 · Other software · Codoforum · reported by MITREMedium 6.1
Codoforum 4.8.3 allows HTML Injection in the 'admin dashboard Manage users Section.'
Product
Codoforum
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codoforum.com vyshnavvizz.blogspot.com
Aug 31, 2020The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.CVE-2020-24699 · WordPress plugins & themes · reported by MITREMedium 6.1
The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.
Affected
3.2.8 to 3.2.8
What to do
Affects 3.2.8 to 3.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record l0l.xyz wordpress.org
Aug 31, 2020Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS.CVE-2020-17465 · Other software · Forgerock · reported by MITREMedium 6.1
Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. The vulnerability affects versions 6.5.0.4, 6.0.0.6.
Product
Identity Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com nccgroup.com
Aug 27, 2020Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.CVE-2020-23576 · Other software · Laborator · reported by MITREMedium 5.4
Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.
Product
Neon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vimeo.com vimeo.com
Aug 13, 2020Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentiallCVE-2020-8720 · Other software · Intel · reported by secure@intel.comMedium 5.5
Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable denial of service via local access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 13, 2020Uncontrolled search path in the installer for Intel(R) RSTe Software RAID Driver for the Intel(R) Server Board M10JNP2SB before version 4.7.0.1119 may allow an CVE-2020-8687 · Other software · Intel · reported by secure@intel.comHigh 7.8
Uncontrolled search path in the installer for Intel(R) RSTe Software RAID Driver for the Intel(R) Server Board M10JNP2SB before version 4.7.0.1119 may allow an authenticated user to potentially enable escalation of privilege via local access.
Product
Rste Software Raid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Aug 13, 2020Improper initialization in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable escalCVE-2020-12301 · Other software · Intel · reported by secure@intel.comHigh 8.2
Improper initialization in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable escalation of privilege via local access.
Product
S2600wftr Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 13, 2020Uninitialized pointer in BIOS firmware for Intel(R) Server Board Families S2600CW, S2600KP, S2600TP, and S2600WT may allow a privileged user to potentially enabCVE-2020-12300 · Other software · Intel · reported by secure@intel.comHigh 8.2
Uninitialized pointer in BIOS firmware for Intel(R) Server Board Families S2600CW, S2600KP, S2600TP, and S2600WT may allow a privileged user to potentially enable escalation of privilege via local access.
Product
S2600cw2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 13, 2020Improper input validation in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable escCVE-2020-12299 · Other software · Intel · reported by secure@intel.comHigh 8.2
Improper input validation in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable escalation of privilege via local access.
Product
S2600stqr Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Improper buffer restrictions in the firmware for Intel(R) Server Board M10JNP2SB before version 7.210 may allow a privileged user to potentially enable escalatiCVE-2020-8733 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper buffer restrictions in the firmware for Intel(R) Server Board M10JNP2SB before version 7.210 may allow a privileged user to potentially enable escalation of privilege via local access.
Product
M10jnp2sb Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Heap-based buffer overflow in the firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated CVE-2020-8732 · Other software · Intel · reported by secure@intel.comHigh 8.8
Heap-based buffer overflow in the firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Incorrect execution-assigned permissions in the file system for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow anCVE-2020-8731 · Other software · Intel · reported by secure@intel.comHigh 8.8
Incorrect execution-assigned permissions in the file system for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of privilege via local access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Heap-based overflow for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enablCVE-2020-8730 · Other software · Intel · reported by secure@intel.comHigh 8.8
Heap-based overflow for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of privilege via local access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Buffer copy without checking size of input for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated usCVE-2020-8729 · Other software · Intel · reported by secure@intel.comHigh 7.8
Buffer copy without checking size of input for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of privilege via local access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Cross-site scripting for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enCVE-2020-8723 · Other software · Intel · reported by secure@intel.comMedium 6.3
Cross-site scripting for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentiallCVE-2020-8722 · Other software · Intel · reported by secure@intel.comHigh 8.2
Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable escalation of privilege via local access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Improper input validation for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enaCVE-2020-8721 · Other software · Intel · reported by secure@intel.comHigh 8.2
Improper input validation for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable escalation of privilege via local access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Buffer overflow in subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially CVE-2020-8719 · Other software · Intel · reported by secure@intel.comHigh 8.2
Buffer overflow in subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable escalation of privilege via local access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentCVE-2020-8718 · Other software · Intel · reported by secure@intel.comHigh 8.8
Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of privilege via local access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Improper input validation in a subsystem for some Intel Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user toCVE-2020-8717 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper input validation in a subsystem for some Intel Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable denial of service via local access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Improper access control for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially eCVE-2020-8716 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper access control for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable denial of service via local access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Invalid pointer for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable CVE-2020-8715 · Other software · Intel · reported by secure@intel.comMedium 5.5
Invalid pointer for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable denial of service via local access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially eCVE-2020-8714 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of privilege via local access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentiallyCVE-2020-8713 · Other software · Intel · reported by secure@intel.comHigh 8.8
Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Buffer overflow in a verification process for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow an authenticated useCVE-2020-8712 · Other software · Intel · reported by secure@intel.comHigh 7.8
Buffer overflow in a verification process for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow an authenticated user to potentially enable escalation of privilege via local access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Improper access control in the bootloader for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow a privileged user toCVE-2020-8711 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper access control in the bootloader for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow a privileged user to potentially enable escalation of privilege via local access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Buffer overflow in the bootloader for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow a privileged user to potentiCVE-2020-8710 · Other software · Intel · reported by secure@intel.comMedium 6.7
Buffer overflow in the bootloader for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow a privileged user to potentially enable escalation of privilege via local access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Improper authentication in socket services for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow an unauthenticated CVE-2020-8709 · Other software · Intel · reported by secure@intel.comHigh 8.8
Improper authentication in socket services for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentiallyCVE-2020-8708 · Other software · Intel · reported by secure@intel.comHigh 8.8
Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Buffer overflow in daemon for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentialCVE-2020-8707 · Other software · Intel · reported by secure@intel.comHigh 8.8
Buffer overflow in daemon for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 12, 2020Buffer overflow in a daemon for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentiCVE-2020-8706 · Other software · Intel · reported by secure@intel.comHigh 8.8
Buffer overflow in a daemon for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Product
Server Board S2600wt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com intel.com
Aug 10, 2020TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert cCVE-2020-17480 · Other software · Tiny · reported by MITREMedium 6.1
TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.
Product
Tinymce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com tiny.cloud
Aug 7, 2020Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix DashboaCVE-2020-5412 · Other software · Spring by VMware · reported by security@pivotal.ioMedium 6.5
Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.
Product
Spring Cloud Netflix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tanzu.vmware.com tanzu.vmware.com
Jul 21, 2020In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration.CVE-2020-15102 · Websites & servers · PrestaShop · reported by GitHubMedium 6.5
In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration. The problem is fixed in 2.1.0.
Product
dashproducts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 17, 2020"HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for users in Dashboard, potentially giving aCVE-2019-4091 · Other software · Hcltech · reported by psirt@hcl.comMedium 5.4
"HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for users in Dashboard, potentially giving an attacker ability to inject malicious code into the system. "
Product
Marketing Campaign
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jul 2, 2020In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables.CVE-2020-15082 · Websites & servers · PrestaShop · reported by GitHubHigh 7.1
In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables. The problem is fixed in 1.7.6.6
Product
PrestaShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 29, 2020The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers (BMC) are shipped with a documented default account and password that should be changed dCVE-2020-8573 · Other software · NetApp · reported by security-alert@netapp.comMedium 6.5
The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers (BMC) are shipped with a documented default account and password that should be changed during the initial node setup. During upgrades to Element 11.8 and 12.0 or the Compute Firmware Bundle 12.2.92 the BMC account password on the H610C, H615C and H610S platforms is reset to the default documented value which could allow remote attackers to cause a Denial of Service (DoS).
Product
NetApp HCI Baseboard Management Controller (BMC) HCI H610C, NetApp HCI Baseboard Management Controller (BMC) HCI H615C, NetApp HCI Baseboard Management Controll
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com security.netapp.com
Jun 29, 2020Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerabiCVE-2019-20411 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.3
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.
Product
Jira Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Jun 24, 2020The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF issuCVE-2020-15046 · Other software · Supermicro · reported by MITREHigh 8.8
The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88.
Product
X10drh-it Bios
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com totalpentest.com
Jun 24, 2020The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings such as boot order.CVE-2020-10278 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comMedium 4.6
The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings such as boot order. This can be leveraged by a Malicious operator to boot from a Live Image.
Product
MiR100
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 24, 2020The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard CVE-2020-10274 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comHigh 7.1
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database.
Product
MiR100
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 24, 2020Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardcodCVE-2020-10270 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comCritical 9.8
Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardcoded IP address. Credentials to such wireless interface default to well known and widely spread users (omitted) and passwords (omitted). This information is also available in past User Guides and manuals which the vendor distributed. This flaw allows cyber attackers to take control of the robot remotely and make use of the default user interfaces MiR has created, lowering the complexity of attacks and making them available to entry-level attackers. More elaborated attacks can also be established by clearing authentication and sending network requests directly. We have confirmed this flaw in MiR100 and MiR200 but according to the vendor, it might also apply to MiR250, MiR500 and MiR1000.
Product
MiR100
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 16, 2020On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow.CVE-2019-18614 · Other software · Cypress · reported by MITREHigh 7.8
On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow. This is because the maximum BLOC buffer size for sending and receiving data is set to 384 bytes, but everything else is still configured to the usual size of 1092 (which was used for everything in the previous CYW20719 and later CYW20819 evaluation board). To trigger the overflow, an attacker can either send packets over the air or as unprivileged local user. Over the air, the minimal PoC is sending "l2ping -s 600" to the target address prior to any pairing. Locally, the buffer overflow is immediately triggered by opening an ACL or SCO connection to a headset. This occurs because, in WICED Studio 6.2 and 6.4, BT_ACL_HOST_TO_DEVICE_DEFAULT_SIZE and BT_ACL_DEVICE_TO_HOST_DEFAULT_SIZE are set to 384.
Product
Cyw20735 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 15, 2020The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php.CVE-2019-19112 · WordPress plugins & themes · reported by MITREMedium 6.1
The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php.
Affected
1.6.5 to 1.6.5
What to do
Affects 1.6.5 to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record twitter.com twitter.com
Jun 11, 2020In onCreate of SliceDeepLinkSpringBoard.java there is a possible insecure Intent.CVE-2020-0219 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onCreate of SliceDeepLinkSpringBoard.java there is a possible insecure Intent. This could lead to local elevation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-122836081
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Jun 10, 2020A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1CVE-2020-13267 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.1
A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1
Product
GitLab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com gitlab.com
Jun 8, 2020The dashboard in WhiteSource Application Vulnerability Management (AVM) before version 20.4.1 allows Log Injection via a %0A%0D substring in the idp parameter tCVE-2020-5304 · Other software · Whitesourcesoftware · reported by MITREHigh 7.5
The dashboard in WhiteSource Application Vulnerability Management (AVM) before version 20.4.1 allows Log Injection via a %0A%0D substring in the idp parameter to the /saml/login URI. This closes the current log and creates a new log with one line of data. The attacker can also insert malicious data and false entries.
Product
Whitesource
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com whitesourcesoftware.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.