Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,620 results · page 35 of 73
Dec 6, 2021WPS Hide Login: Has a bugCVE-2021-24917 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user.
- Product
- WPS Hide Login
- Fixed in
- 1.9.1
- What to do
- Update WPS Hide Login to 1.9.1 or newer.
Full record and what to do →NVD recordwordpress.orgwpscan.com
Dec 6, 2021In Canon LBP223 printers, the System Manager Mode login does not require an account password or PIN.CVE-2021-43471 · Other software · Canon · reported by MITREHigh 7.5
In Canon LBP223 printers, the System Manager Mode login does not require an account password or PIN. An attacker can remotely shut down the device after entering the background, creating a denial of service vulnerability.
- Product
- Lbp223dw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2021Missing Rate Limiting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on the Login Form allows an unauthenticCVE-2021-42544 · Other software · Business-DNA Solutions GmbH · reported by vulnerability@ncsc.chHigh 7.5
Missing Rate Limiting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on the Login Form allows an unauthenticated remote attacker to perform multiple login attempts, which facilitates gaining privileges.
- Product
- TopEase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconfluence.topease.chconfluence.topease.ch
Nov 22, 2021OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call.CVE-2021-38376 · Other software · Open-xchange · reported by MITREMedium 5.3
OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 19, 2021The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (aCVE-2021-43409 · WordPress plugins & themes · reported by info@appcheck-ng.comCritical 9.3
The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data without proper handling of dangerous content. This type of XSS vulnerability is exploited by submitting malicious script content to the application which is then retrieved and executed by other application users. The attacker could exploit this to conduct a range of attacks against users of the affected application such as session hijacking, account take over and accessing sensitive data. In this case, the XSS payload can be submitted by any anonymous user, the payload then renders and executes when a WordPress administrator authenticates and accesses the WordPress Dashboard. The injected payload can carry out actions on behalf of the administrator including adding other administrative users and changing application settings. This flaw could be exploited to ultimately provide full control of the affected system to the attacker.
- Affected
- up to 15.3
- What to do
- Affects up to 15.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordappcheck-ng.comwpo365.com
Nov 19, 20214MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in CVE-2021-42338 · Other software · 4MOSAn · reported by twcert@cert.org.twCritical 9.8
4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in cookie, and arbitrarily manipulate the system or interrupt services by upload and execution of arbitrary files.
- Product
- GCB Doctor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 17, 2021Simple JWT Login: Does not have nonce checksCVE-2021-24804 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover.
- Product
- Simple JWT Login
- Fixed in
- 3.2.1
- What to do
- Update Simple JWT Login to 3.2.1 or newer.
Nov 11, 2021The login routine of the web console in the Zoom On-Premise Meeting Connector before version 4.6.239.20200613, Zoom On-Premise Meeting Connector MMR before versCVE-2021-34418 · Other software · Zoom Video Communications Inc · reported by security@zoom.usMedium 4
The login routine of the web console in the Zoom On-Premise Meeting Connector before version 4.6.239.20200613, Zoom On-Premise Meeting Connector MMR before version 4.6.239.20200613, Zoom On-Premise Recording Connector before version 3.8.42.20200905, Zoom On-Premise Virtual Room Connector before version 4.4.6344.20200612, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5492.20200616 fails to validate that a NULL byte was sent while authenticating. This could lead to a crash of the login service.
- Product
- Zoom On-Premise Meeting Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Nov 11, 2021An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version tCVE-2021-43350 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.
- Product
- Apache Traffic Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Nov 8, 2021Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes: Does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpCVE-2021-24731 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.
- Product
- Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
- Fixed in
- 3.7.1.6
- What to do
- Update Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes to 3.7.1.6 or newer.
Nov 8, 2021Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes: Has a flaw in the social login implementationCVE-2021-24647 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username
- Product
- Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
- Fixed in
- 3.1.7.6
- What to do
- Update Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes to 3.1.7.6 or newer.
Nov 8, 2021Unauthorized system access in the login form in ServiceTonic Helpdesk software version < 9.0.35937 allows attacker to login without using a password.CVE-2021-28024 · Other software · Servicetonic · reported by MITRECritical 9.8
Unauthorized system access in the login form in ServiceTonic Helpdesk software version < 9.0.35937 allows attacker to login without using a password.
- Product
- Servicetonic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicetonic.comsrlabs.de
Nov 8, 2021Blind SQL injection in the login form in ServiceTonic Helpdesk software < 9.0.35937 allows attacker to exfiltrate information via specially crafted HQL-compatibCVE-2021-28022 · Other software · Servicetonic · reported by MITREHigh 7.5
Blind SQL injection in the login form in ServiceTonic Helpdesk software < 9.0.35937 allows attacker to exfiltrate information via specially crafted HQL-compatible time-based SQL queries.
- Product
- Servicetonic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicetonic.comsrlabs.de
Nov 8, 2021Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation iCVE-2021-25979 · Other software · Apostrophe · reported by vulnerabilitylab@mend.ioCritical 9.8
Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.
- Product
- Apostrophe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2021SQL Injection vulnerability in 188Jianzhan v2.1.0, allows attackers to execute arbitrary code and gain escalated privileges, via the username parameter to loginCVE-2020-23685 · Other software · Vtimecn · reported by MITRECritical 9.8
SQL Injection vulnerability in 188Jianzhan v2.1.0, allows attackers to execute arbitrary code and gain escalated privileges, via the username parameter to login.php.
- Product
- 188jianzhan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2021An SQL Injection vulnerabilty exists in the oretnom23 Pharmacy Point of Sale System 1.0 in the login function in actions.php.CVE-2021-41676 · Other software · Pharmacy Point Of Sale System Project · reported by MITRECritical 9.8
An SQL Injection vulnerabilty exists in the oretnom23 Pharmacy Point of Sale System 1.0 in the login function in actions.php.
- Product
- Pharmacy Point Of Sale System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2021FirstUseAuthenticator is a JupyterHub authenticator that helps new users set their password on their first login to JupyterHub.CVE-2021-41194 · Other software · jupyterhub · reported by GitHubCritical 9.1
FirstUseAuthenticator is a JupyterHub authenticator that helps new users set their password on their first login to JupyterHub. When JupyterHub is used with FirstUseAuthenticator, a vulnerability in versions prior to 1.0.0 allows unauthorized access to any user's account if `create_users=True` and the username is known or guessed. One may upgrade to version 1.0.0 or apply a patch manually to mitigate the vulnerability. For those who cannot upgrade, there is no complete workaround, but a partial mitigation exists. One can disable user creation with `c.FirstUseAuthenticator.create_users = False`, which will only allow login with fully normalized usernames for already existing users prior to jupyterhub-firstuserauthenticator 1.0.0. If any users have never logged in with their normalized username (i.e. lowercase), they will still be vulnerable until a patch or upgrade occurs.
- Product
- firstuseauthenticator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2021Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login.php.CVE-2021-37371 · Other software · Online Student Admission System Project · reported by MITRECritical 9.8
Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login.php.
- Product
- Online Student Admission System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 22, 2021The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlCVE-2021-31682 · Other software · Automatedlogic · reported by MITREMedium 6.1
The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization.
- Product
- Webctrl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 19, 2021Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login.CVE-2021-35323 · Other software · Bludit · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login.
- Product
- Bludit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 19, 2021InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the product.CVE-2021-38474 · Other software · InHand Networks · reported by ics-cert@hq.dhs.govMedium 6.3
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the product. This may allow an attacker to execute a brute-force password attack with no time limitation and without harming the normal operation of the user. This could allow an attacker to gain valid credentials for the product interface.
- Product
- IR615 Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 14, 2021An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDACVE-2021-37933 · Other software · Huntflow · reported by MITREHigh 7.5
An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication. The vulnerability is due to insufficient server-side validation of the email parameter before using it to construct LDAP queries. An attacker could bypass authentication exploiting this vulnerability by sending login attempts in which there is a valid password but a wildcard character in email parameter.
- Product
- Huntflow Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 7, 2021In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py UserCVE-2021-42071 · Other software · Visual-tools · reported by MITRECritical 9.8
In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header.
- Product
- DVR Vx16 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvisual-tools.comexploit-db.com
Oct 7, 2021Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file.CVE-2021-3834 · Other software · Ártica · reported by cve-coordination@incibe.esMedium 5.4
Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file. An attacker could exploit this vulnerability in order to perform a cross-site scripting attack (XSS).
- Product
- Integria IMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordintegriaims.comincibe.es
Oct 7, 2021Integria IMS login check uses a loose comparator ("==") to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database.CVE-2021-3833 · Other software · Ártica · reported by cve-coordination@incibe.esCritical 9.8
Integria IMS login check uses a loose comparator ("==") to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. An attacker with a specific formatted password could exploit this vulnerability in order to login in the system with different passwords.
- Product
- Integria IMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordintegriaims.comincibe.es
Oct 6, 2021Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login crCVE-2021-34757 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.9
Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or reconfigure the passwords on the user account. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco Small Business 220 Series Smart Plus Switches
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Oct 6, 2021Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login crCVE-2021-34744 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.9
Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or reconfigure the passwords on the user account. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco Small Business 220 Series Smart Plus Switches
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Oct 5, 2021waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?&m=Public&a=login.CVE-2020-21504 · Other software · Waimai Super CMS Project · reported by MITREMedium 6.1
waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?&m=Public&a=login.
- Product
- Waimai Super CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2021In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session token that could be already in use by anoCVE-2021-41553 · Other software · Archibus · reported by MITRECritical 9.8
In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session token that could be already in use by another user. It was therefore possible to access the application through a user whose credentials were not known, without any attempt by the testers to modify the application logic. It is also possible to set the value of the session token, client-side, simply by making an unauthenticated GET Request to the Home Page and adding an arbitrary value to the JSESSIONID field. The application, following the login, does not assign a new token, continuing to keep the inserted one, as the identifier of the entire session. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020
- Product
- Web Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Oct 4, 2021In GFOS Workforce Management 4.8.272.1, the login page of application is prone to authentication bypass, allowing anyone (who knows a user's credentials except CVE-2021-38618 · Other software · Gfos · reported by MITREHigh 7.4
In GFOS Workforce Management 4.8.272.1, the login page of application is prone to authentication bypass, allowing anyone (who knows a user's credentials except the password) to get access to an account. This occurs because of JSESSIONID mismanagement.
- Product
- Workforce Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcds.thalesgroup.comexcellium-services.com
Oct 4, 2021Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password.CVE-2021-23857 · Other software · Rexroth · reported by psirt@bosch.comCritical 10
Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CVE-2021-23858, this allows an attacker to subsequently login to the system.
- Product
- IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22, XM41 and XM42 IndraMotion XLC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Oct 4, 2021The username and password field of login in Lodging Reservation Management System V1 can give access to any user by using SQL injection to bypass authenticationCVE-2021-41511 · Other software · Lodging Reservation Management System Project · reported by MITRECritical 9.8
The username and password field of login in Lodging Reservation Management System V1 can give access to any user by using SQL injection to bypass authentication.
- Product
- Lodging Reservation Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 1, 2021There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenCVE-2021-29108 · Other software · Esri · reported by psirt@esri.comHigh 8.8
There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account (XML Signature Wrapping Attack). In addition patching, Esri also strongly recommends as best practice for SAML assertions to be signed and encrypted.
- Product
- Portal for ArcGIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloads.esri.comesri.com
Sep 23, 2021OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.CVE-2021-3824 · Other software · Openvpn · reported by security@openvpn.netMedium 6.1
OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.
- Product
- Openvpn Access Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenvpn.netopenvpn.net
Sep 21, 2021In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.CVE-2021-40868 · Other software · Cloudron · reported by MITREMedium 6.1
In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.
- Product
- Cloudron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Sep 20, 2021Limit Login Attempts: Does not escape the IP addresses (which can be controlled by attacker via headers suchCVE-2021-24657 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.
- Product
- Limit Login Attempts
- Fixed in
- 4.0.50
- What to do
- Update Limit Login Attempts to 4.0.50 or newer.
Sep 15, 2021SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the victim without knowinCVE-2021-33700 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the victim without knowing his/her password. The attacker could so obtain highly sensitive information which the attacker could use to take substantial control of the vulnerable application.
- Product
- SAP Business One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Sep 9, 2021A stored cross-site scripting (XSS) vulnerability in the /manage/loginusername component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTCVE-2020-19281 · Other software · Jeesns · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the /manage/loginusername component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username field.
- Product
- Jeesns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/SecurityModule in a bruteCVE-2021-28909 · Other software · Bab-technologie · reported by MITRECritical 9.8
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/SecurityModule in a brute force attack. The password could be weak and default username is known as 'admin'. This is usable and part of an attack chain to gain SSH root access.
- Product
- Eibport Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsytester.github.iopsytester.github.io
Sep 9, 2021Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.phpCVE-2021-38725 · Other software · Thedaylightstudio · reported by MITREMedium 5.3
Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerabilityCVE-2021-38721 · Other software · Thedaylightstudio · reported by MITREMedium 6.5
FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2021Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component "autumn-cms/user/getAllUsCVE-2020-19137 · Other software · Autumn Project · reported by MITREHigh 7.5
Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component "autumn-cms/user/getAllUser/?page=1&limit=10".
- Product
- Autumn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021SQL Injection can occur in Simple Water Refilling Station Management System 1.0 via the water_refilling/classes/Login.php username parameter.CVE-2021-38840 · Other software · Simple Water Refilling Station Management System Project · reported by MITRECritical 9.8
SQL Injection can occur in Simple Water Refilling Station Management System 1.0 via the water_refilling/classes/Login.php username parameter.
- Product
- Simple Water Refilling Station Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Sep 6, 2021Malicious attacker is able to find out valid user logins by using the "lost password" feature.CVE-2021-36095 · Other software · OTRS AG · reported by security@otrs.comMedium 5.3
Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions.
- Product
- ((OTRS)) Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2021VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443.CVE-2021-22003 · Other software · VMware · reported by security@vmware.comHigh 7.5
VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and password complexity for the target account.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2021The Serv-U File Server allows for events such as user login failures to be audited by executing a command.CVE-2021-35223 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.5
The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution.
- Product
- Serv-U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsupport.solarwinds.com
Aug 26, 2021Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name CVE-2020-18468 · Other software · Qdpm · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name by doing an authenticated POST HTTP request to /qdPM_9.1/index.php/configuration.
- Product
- Qdpm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021A vulnerability in the implementation of the system login block-for command for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a CVE-2021-1590 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the implementation of the system login block-for command for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a login process to unexpectedly restart, causing a denial of service (DoS) condition. This vulnerability is due to a logic error in the implementation of the system login block-for command when an attack is detected and acted upon. An attacker could exploit this vulnerability by performing a brute-force login attack on an affected device. A successful exploit could allow the attacker to cause a login process to reload, which could result in a delay during authentication to the affected device.
- Product
- Cisco NX-OS Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Aug 24, 2021This issue was addressed by adding a new Remote Login option for opting into Full Disk Access for Secure Shell sessions.CVE-2021-30856 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.1
This issue was addressed by adding a new Remote Login option for opting into Full Disk Access for Secure Shell sessions. This issue is fixed in macOS Big Sur 11.3. A malicious unsandboxed app on a system with Remote Login enabled may bypass Privacy preferences.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Aug 23, 2021Erident Custom Login and Dashboard: Did not properly sanitise its settingsCVE-2021-24658 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled)
- Product
- Erident Custom Login and Dashboard
- Fixed in
- 3.5.9
- What to do
- Update Erident Custom Login and Dashboard to 3.5.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.