Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,620 results · page 36 of 73
Aug 20, 2021Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /add/ , /img/, /js/, and /mobile directorieCVE-2021-34218 · Other software · Totolink · reported by MITREMedium 5.3
Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /add/ , /img/, /js/, and /mobile directories via GET Parameter.
- Product
- A3002r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2021Cross Site Request Forgery (CSRF) vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=neCVE-2020-20642 · Other software · Eyoucms · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2021Cross Site Request Forgery (CSRF) vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=admin&c=Admin&a=admin_add&lang=cn.CVE-2020-19669 · Other software · Eyoucms · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=admin&c=Admin&a=admin_add&lang=cn.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2021SQL Injection in AiteCMS v1.0 allows remote attackers to execute arbitrary code via the component "aitecms/login/diy_list.php".CVE-2020-18746 · Other software · Aitecms · reported by MITREHigh 7.2
SQL Injection in AiteCMS v1.0 allows remote attackers to execute arbitrary code via the component "aitecms/login/diy_list.php".
- Product
- Aitecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2021Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in theCVE-2020-18698 · Other software · Talelin · reported by MITRECritical 9.8
Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component 'app/api/cms/user.py'.
- Product
- Lin-cms-flask
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Aug 16, 2021Custom Login Redirect: Does not have CSRF check in placeCVE-2021-24536 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or escape user input before outputting them back in the page, leading to a Stored Cross-Site Scripting issue
- Product
- Custom Login Redirect
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Custom Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2021The exporter/Login.aspx login form in the Exporter in Nuance Winscribe Dictation 4.1.0.99 is vulnerable to SQL injection that allows a remote, unauthenticated aCVE-2021-37599 · Other software · Nuance · reported by MITRECritical 9.8
The exporter/Login.aspx login form in the Exporter in Nuance Winscribe Dictation 4.1.0.99 is vulnerable to SQL injection that allows a remote, unauthenticated attacker to read the database (and execute code in some situations) via the txtPassword parameter.
- Product
- Winscribe Dictation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordslazarus.xyznuance.com
Aug 12, 2021A vulnerability in the authentication mechanism of Brocade Fabric OS versions before Brocade Fabric OS v.9.0.1a, v8.2.3a and v7.4.2h could allow a user to LoginCVE-2021-27794 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.8
A vulnerability in the authentication mechanism of Brocade Fabric OS versions before Brocade Fabric OS v.9.0.1a, v8.2.3a and v7.4.2h could allow a user to Login with empty password, and invalid password through telnet, ssh and REST.
- Product
- Fabric Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.combroadcom.com
Aug 12, 2021Reflected cross-site scripting (XSS) was possible on the login page in Acronis Cyber Protect 15 prior to build 27009.CVE-2021-38087 · Other software · Acronis · reported by MITREMedium 6.1
Reflected cross-site scripting (XSS) was possible on the login page in Acronis Cyber Protect 15 prior to build 27009.
- Product
- Cyber Protect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.acronis.comkb.acronis.com
Aug 11, 2021In SapphireIMS 4097_1, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login fCVE-2017-16629 · Network & remote access · Sapphireims · reported by MITREHigh 7.5
In SapphireIMS 4097_1, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login form. For "Incorrect User" - it gives an error "The application failed to identify the user. Please contact administrator for help." For "Correct User and Incorrect Password" - it gives an error "Authentication failed. Please login again."
- Product
- Sapphireims
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuln.shellcoder.partyvuln.shellcoder.party
Aug 9, 2021The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via aCVE-2020-23148 · Other software · Rconfig · reported by MITREHigh 7.5
The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request.
- Product
- Rconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Aug 9, 2021A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user.CVE-2021-33256 · Email & office · Zohocorp · reported by MITREHigh 8.8
A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Report" as CSV file. Note: The vendor disputes this vulnerability, claiming "This is not a valid vulnerability in our ADSSP product. We don't see this as a security issue at our side.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.unsafe-inline.comdocs.unsafe-inline.com
Aug 9, 2021The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/registCVE-2021-24522 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could be used in an XSS attack which could lead to wp-admin access. Further, the plugin in several places assigned $_POST as $_GET which meant that in some cases this could be replicated with just $_GET parameters and no need for $_POST values.
- Product
- User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar)
- Fixed in
- 3.1.11
- What to do
- Update User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) to 3.1.11 or newer.
Aug 7, 2021Roxy-WI through 5.2.2.0 allows SQL Injection via check_login.CVE-2021-38167 · Other software · Roxy-wi · reported by MITRECritical 9.8
Roxy-WI through 5.2.2.0 allows SQL Injection via check_login. An unauthenticated attacker can extract a valid uuid to bypass authentication.
- Product
- Roxy-wi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2021In ProLink PRC2402M V1.0.18 and older, the set_sys_init function in the login.cgi binary allows an attacker to reset the password to the administrative interfacCVE-2021-36708 · Other software · Prolink · reported by MITREHigh 7.5
In ProLink PRC2402M V1.0.18 and older, the set_sys_init function in the login.cgi binary allows an attacker to reset the password to the administrative interface of the router.
- Product
- Prc2402m Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2021A vulnerability in TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to start the Telnet service, then login with the default credentials viCVE-2021-35327 · Other software · Totolink · reported by MITRECritical 9.8
A vulnerability in TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to start the Telnet service, then login with the default credentials via a crafted POST request.
- Product
- A720r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2021A stack overflow in the checkLoginUser function of TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to cause a denial of service (DOS).CVE-2021-35325 · Other software · Totolink · reported by MITREHigh 7.5
A stack overflow in the checkLoginUser function of TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to cause a denial of service (DOS).
- Product
- A720r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2021A vulnerability in the Form_Login function of TOTOLINK A720R A720R_Firmware V4.1.5cu.470_B20200911 allows attackers to bypass authentication.CVE-2021-35324 · Other software · Totolink · reported by MITRECritical 9.8
A vulnerability in the Form_Login function of TOTOLINK A720R A720R_Firmware V4.1.5cu.470_B20200911 allows attackers to bypass authentication.
- Product
- A720r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2021An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 CVE-2021-22124 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.5
An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6; and FortiAuthenticator before 6.0.6 may allow an unauthenticated attacker to bring the device into an unresponsive state via specifically-crafted long request parameters.
- Product
- Fortinet FortiSandbox, FortiAuthenticator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Aug 2, 2021Admin Custom Login: Cross-Site Request ForgeryCVE-2021-34628 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the ~/includes/Login-form-setting/Login-form-background.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.7.
- Product
- Admin Custom Login
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update Admin Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 2, 2021The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known (i.e., no other authenticCVE-2021-37843 · Websites & servers · Atlassian · reported by MITRECritical 9.8
The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known (i.e., no other authentication is provided). The fixed versions are for Jira: 3.6.6.1, 4.0.12, 5.0.5; for Confluence 3.6.6, 4.0.12, 5.0.5; for Bitbucket 2.5.9, 3.6.6, 4.0.12, 5.0.5; for Bamboo 2.5.9, 3.6.6, 4.0.12, 5.0.5; and for Fisheye 2.5.9.
- Product
- Saml Single Sign ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.resolution.dewiki.resolution.de
Aug 2, 2021User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar): Did not sanitise or escape some of its settings before saving them and outputting them back in the pageCVE-2021-24450 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar)
- Fixed in
- 3.1.8
- What to do
- Update User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) to 3.1.8 or newer.
Jul 31, 2021Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because theCVE-2021-33617 · Email & office · Zohocorp · reported by MITREMedium 5.3
Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response (to a failed login request) is null only when the username is invalid.
- Product
- Manageengine Password Manager Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.demanageengine.com
Jul 25, 2021NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configuration files.CVE-2021-37452 · Other software · NCH · reported by MITREMedium 5.5
NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configuration files.
- Product
- Quorum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021Vulnerability in the Siebel Core - Server Framework product of Oracle Siebel CRM (component: Loging).CVE-2021-2353 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.4
Vulnerability in the Siebel Core - Server Framework product of Oracle Siebel CRM (component: Loging). Supported versions that are affected are 21.5 and Prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel Core - Server Framework executes to compromise Siebel Core - Server Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Core - Server Framework accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
- Product
- Siebel Core - Server Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021A vulnerability in /Login.html of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to bypass login and obtain a partially authorized tokeCVE-2020-21932 · Other software · Motorola · reported by MITREMedium 5.3
A vulnerability in /Login.html of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to bypass login and obtain a partially authorized token and uid.
- Product
- Cx2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2021Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin.CVE-2020-22251 · Websites & servers · Phplist · reported by MITREMedium 4.8
Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2021wpForo Forum: Did not validate the redirect_to parameter in the login form of the forumCVE-2021-24406 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control and being a replica of the legitimate one, asking them to re-enter their credentials (which will then in the attacker hands)
- Product
- wpForo Forum
- Fixed in
- 1.9.7
- What to do
- Update wpForo Forum to 1.9.7 or newer.
Jun 30, 2021Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phCVE-2021-21673 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.
- Product
- Jenkins CAS Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jun 30, 2021Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login.CVE-2021-21671 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jun 25, 2021NVIDIA GeForce Experience, all versions prior to 3.23, contains a vulnerability in the login flow when a user tries to log in by using a browser, while, at the CVE-2021-1073 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.3
NVIDIA GeForce Experience, all versions prior to 3.23, contains a vulnerability in the login flow when a user tries to log in by using a browser, while, at the same time, any other web page is loaded in other tabs of the same browser. In this situation, the web page can get access to the token of the user login session, leading to the possibility that the user’s account is compromised. This may lead to the targeted user’s data being accessed, altered, or lost.
- Product
- NVIDIA GeForce Experience Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jun 24, 2021Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.CVE-2020-18661 · Other software · SIR · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.
- Product
- Gnuboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php.CVE-2020-21517 · Other software · Metinfo · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2021CheckSec Canopy before 3.5.2 allows XSS attacks against the login page via the LOGIN_PAGE_DISCLAIMER parameter.CVE-2021-34815 · Other software · Checksec · reported by MITREMedium 4.8
CheckSec Canopy before 3.5.2 allows XSS attacks against the login page via the LOGIN_PAGE_DISCLAIMER parameter.
- Product
- Canopy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchecksec.comcompass-security.com
Jun 18, 2021The login page in the MCUsystem does not filter with special characters, which allows remote attackers can inject JavaScript without privilege and thus perform CVE-2021-32536 · Other software · MCU Technologies · reported by twcert@cert.org.twMedium 6.1
The login page in the MCUsystem does not filter with special characters, which allows remote attackers can inject JavaScript without privilege and thus perform reflected XSS attacks.
- Product
- MCUsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 17, 2021An authenticated Stored XSS (Cross-site Scripting) exists in the "captive.cgi" Captive Portal via the "Title of Login Page" text box or "TITLE" parameter in IPFCVE-2020-19202 · Other software · Ipfire · reported by MITREMedium 5.4
An authenticated Stored XSS (Cross-site Scripting) exists in the "captive.cgi" Captive Portal via the "Title of Login Page" text box or "TITLE" parameter in IPFire 2.21 (x86_64) - Core Update 130. It allows an authenticated WebGUI user with privileges to execute Stored Cross-site Scripting in the Captive Portal page.
- Product
- Ipfire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.ipfire.orggist.github.com
Jun 16, 2021Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET parameter in '/shared/view_CVE-2020-20444 · Other software · Openclinic Project · reported by MITREHigh 7.2
Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET parameter in '/shared/view_source.php' which "could" lead to RCE vulnerability .
- Product
- Openclinic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Jun 8, 2021Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS.CVE-2021-31738 · Other software · Adiscon · reported by MITREMedium 6.1
Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS.
- Product
- Loganalyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2021FDCMS (aka Fangfa Content Management System) 4.0 contains a front-end SQL injection via Admin/Lib/Action/FloginAction.class.php.CVE-2020-35441 · Other software · Fangfa · reported by MITRECritical 9.8
FDCMS (aka Fangfa Content Management System) 4.0 contains a front-end SQL injection via Admin/Lib/Action/FloginAction.class.php.
- Product
- Fdcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2021WP Login Security and History: Did not have CSRF checkCVE-2021-24328 · WordPress plugins & themes · reported by WPScanMedium 6.2
The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values, and set XSS payloads on them as well
- Product
- WP Login Security and History
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Login Security and History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 28, 2021A cross-site scripting (XSS) vulnerability has been discovered in the login page of SeaCMS version 11 which allows an attacker to inject arbitrary web script orCVE-2020-26642 · Other software · Seacms · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability has been discovered in the login page of SeaCMS version 11 which allows an attacker to inject arbitrary web script or HTML.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchinapyg.comchinapyg.com
May 28, 2021Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command.CVE-2021-21734 · Other software · ZTE · reported by psirt@zte.com.cnMedium 6.5
Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command. This affects: ZTE PON MDU device ZXA10 F821 V1.7.0P3T22, ZXA10 F822 V1.4.3T6, ZXA10 F819 V1.2.1T5, ZXA10 F832 V1.1.1T7, ZXA10 F839 V1.1.0T8, ZXA10 F809 V3.2.1T1, ZXA10 F822P V1.1.1T7, ZXA10 F832 V2.00.00.01
- Product
- Zxa10 F821 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zte.com.cnsupport.zte.com.cn
May 26, 2021A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF.CVE-2019-14836 · Other software · Redhat · reported by Red HatHigh 8.8
A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF. An attacker could use this flaw to access unauthorized information or conduct further attacks.
- Product
- 3scale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
May 24, 2021Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username.CVE-2021-33563 · Other software · Koel · reported by MITREHigh 7.5
Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier.
- Product
- Koel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2021Ultimate Member – User Profile, User Registration, Login & Membership: Did not properly sanitiseCVE-2021-24306 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link to edit user's own profile, leading to an authenticated reflected Cross-Site Scripting issue. Knowledge of the targeted username is required to exploit this, and attackers would then need to make the related logged in user open a malicious link.
- Product
- Ultimate Member – User Profile, User Registration, Login & Membership
- Fixed in
- 2.1.20
- What to do
- Update Ultimate Member – User Profile, User Registration, Login & Membership to 2.1.20 or newer.
May 20, 2021IBM Security Identity Manager 7.0.2 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts.CVE-2021-29687 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Security Identity Manager 7.0.2 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 200018
- Product
- Security Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin beforeCVE-2021-24195 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- Login as User or Customer (User Switching)
- Fixed in
- 1.8
- What to do
- Update Login as User or Customer (User Switching) to 1.8 or newer.
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin beCVE-2021-24194 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- Login Protection - Limit Failed Login Attempts
- Fixed in
- 2.9
- What to do
- Update Login Protection - Limit Failed Login Attempts to 2.9 or newer.
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress pluginCVE-2021-24189 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugin before 2.4, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- Captchinoo, Google recaptcha for admin login page
- Fixed in
- 2.4
- What to do
- Update Captchinoo, Google recaptcha for admin login page to 2.4 or newer.
May 7, 2021LivingLogic XIST4C before 0.107.8 allows XSS via login.htm, login.wihtm, or login-form.htm.CVE-2021-26123 · Other software · Livinglogic · reported by MITREMedium 6.1
LivingLogic XIST4C before 0.107.8 allows XSS via login.htm, login.wihtm, or login-form.htm.
- Product
- Xist4c
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.