Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,994 results · page 37 of 60
Jan 8, 2020When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters.CVE-2019-17022 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jan 8, 2020When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of the keyboard.CVE-2019-17018 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of the keyboard. This vulnerability affects Firefox < 72.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jan 8, 2020When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule.CVE-2019-17016 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jan 8, 2020Pearson eSIS (Enterprise Student Information System) message board has stored XSS due to improper validation of user inputCVE-2014-1454 · Other software · Pearson · reported by MITREMedium 4.8
Pearson eSIS (Enterprise Student Information System) message board has stored XSS due to improper validation of user input
- Product
- Esis Enterprise Student Information System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comsecurityfocus.com
Jan 7, 2020Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.CVE-2020-5843 · Other software · Codologic · reported by MITREMedium 4.8
Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodologic.comvyshnavvizz.blogspot.com
Jan 6, 2020DTEN D5 and D7 before 1.3.2 devices allows remote attackers to read saved whiteboard image PDF documents via storage/emulated/0/Notes/PDF on TCP port 8080 withoCVE-2019-16271 · Other software · Dten · reported by MITREMedium 5.3
DTEN D5 and D7 before 1.3.2 devices allows remote attackers to read saved whiteboard image PDF documents via storage/emulated/0/Notes/PDF on TCP port 8080 without authentication.
- Product
- D5 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforescout.comforescout.com
Jan 5, 2020Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen.CVE-2020-5305 · Other software · Codologic · reported by MITREMedium 4.8
Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodologic.comvyshnavvizz.blogspot.com
Jan 2, 2020Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before 3.15 (SMT_X9_315)CVE-2013-3620 · Other software · Supermicro · reported by cret@cert.orgHigh 7.5
Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before 3.15 (SMT_X9_315) and firmware for Supermicro X8 generation motherboards before SMT X8 312.
- Product
- IPMI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comcommunity.rapid7.com
Jan 2, 2020Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 generaCVE-2013-3619 · Other software · Supermicro · reported by cret@cert.orgHigh 8.1
Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 generation motherboards before SMT X8 312 contain harcoded private encryption keys for the (1) Lighttpd web server SSL interface and the (2) Dropbear SSH daemon.
- Product
- IPMI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comcommunity.rapid7.com
Dec 30, 2019Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin passwordCVE-2012-5476 · Other software · openstack-dashboard · reported by Red HatMedium 5.5
Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin password and token value.
- Product
- openstack-dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Dec 30, 2019The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) isCVE-2012-5474 · Other software · python-django-horizon · reported by Red HatMedium 5.5
The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) is world readable and exposes the secret key value.
- Product
- python-django-horizon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgaccess.redhat.com
Dec 27, 2019ReviewBoard 1.6.17 allows code execution by attaching PHP scripts to review requestCVE-2013-4796 · Other software · Reviewboard · reported by MITREHigh 8.8
ReviewBoard 1.6.17 allows code execution by attaching PHP scripts to review request
- Product
- Reviewboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtripwire.comexchange.xforce.ibmcloud.com
Dec 10, 2019The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.CVE-2019-19708 · Other software · Mediawiki · reported by MITREMedium 6.1
The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.
- Product
- Visual Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Dec 10, 2019The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.CVE-2019-19702 · Other software · Modoboa · reported by MITREHigh 7.5
The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the /dev/random file within XML documents that are emailed to the address in the rua field of the DMARC records of a domain.
- Product
- Modoboa-dmarc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2019On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who CVE-2019-19642 · Other software · Supermicro · reported by MITREHigh 8.8
On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or ShareName. The attacker can achieve a persistent backdoor.
- Product
- X8sti-f Bios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddark-sec.netdark-sec.net
Dec 3, 2019Review Board: URL processing gives unauthorized users access to review listsCVE-2013-4411 · Other software · Review Board · reported by Red HatMedium 4.3
Review Board: URL processing gives unauthorized users access to review lists
- Product
- Review Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Dec 2, 2019ReviewBoard: has an access-control problem in REST APICVE-2013-4410 · Other software · ReviewBoard · reported by Red HatHigh 7.5
ReviewBoard: has an access-control problem in REST API
- Product
- ReviewBoard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Nov 18, 2019The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication ServCVE-2018-13257 · Other software · Blackboard · reported by MITREMedium 6.1
The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service (CAS) service ticket validation, enabling a phishing attack from the CAS server login page.
- Product
- Blackboard Learn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Memory corruption in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network accCVE-2019-11182 · Other software · Intel · reported by secure@intel.comHigh 7.5
Memory corruption in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Out of bound read in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable escalation of privilege via netwoCVE-2019-11181 · Other software · Intel · reported by secure@intel.comHigh 7.8
Out of bound read in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable escalation of privilege via network access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service viaCVE-2019-11180 · Other software · Intel · reported by secure@intel.comHigh 7.5
Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an authenticated user to potentially enable information disclosure CVE-2019-11179 · Other software · Intel · reported by secure@intel.comMedium 6.5
Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an authenticated user to potentially enable information disclosure via network access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Stack overflow in Intel(R) Baseboard Management Controller firmware may allow an authenticated user to potentially enable information disclosure and/or denial oCVE-2019-11178 · Other software · Intel · reported by secure@intel.comHigh 8.1
Stack overflow in Intel(R) Baseboard Management Controller firmware may allow an authenticated user to potentially enable information disclosure and/or denial of service via network access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Unhandled exception in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network aCVE-2019-11177 · Other software · Intel · reported by secure@intel.comHigh 7.5
Unhandled exception in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service viaCVE-2019-11175 · Other software · Intel · reported by secure@intel.comHigh 7.5
Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Insufficient access control in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure CVE-2019-11174 · Other software · Intel · reported by secure@intel.comMedium 5.3
Insufficient access control in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure via network access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Insufficient session validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosCVE-2019-11173 · Other software · Intel · reported by secure@intel.comHigh 7.1
Insufficient session validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure and/or denial of service via local access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Out of bound read in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure via networCVE-2019-11172 · Other software · Intel · reported by secure@intel.comMedium 5.3
Out of bound read in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure via network access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Heap corruption in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure, escalation CVE-2019-11171 · Other software · Intel · reported by secure@intel.comCritical 9.8
Heap corruption in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure, escalation of privilege and/or denial of service via network access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Authentication bypass in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure, escalCVE-2019-11170 · Other software · Intel · reported by secure@intel.comHigh 7.8
Authentication bypass in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure, escalation of privilege and/or denial of service via local access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Insufficient session validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosCVE-2019-11168 · Other software · Intel · reported by secure@intel.comCritical 9.1
Insufficient session validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure and/or denial of service via network access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comintel.com
Nov 11, 2019WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.CVE-2019-18881 · Other software · Wso2 · reported by MITREMedium 6.1
WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.
- Product
- Identity Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.wso2.comdocs.wso2.com
Nov 7, 2019GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board tail contents" parameter, aka the adm/board_form_upCVE-2018-18674 · Other software · SIR · reported by MITREMedium 6.1
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board tail contents" parameter, aka the adm/board_form_update.php bo_content_tail parameter.
- Product
- Gnuboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2019An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.CVE-2013-4409 · Other software · Python Software Foundation; Beanbag · reported by Red HatCritical 9.8
An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.
- Product
- Djblets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Oct 30, 2019GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board group extra contents" parameter, aka the admCVE-2018-18678 · Other software · SIR · reported by MITREMedium 6.1
GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board group extra contents" parameter, aka the adm/boardgroup_form_update.php gr_1~10 parameter.
- Product
- Gnuboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2019An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices.CVE-2019-18201 · Other software · Fujitsu · reported by MITREHigh 7.5
An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, an attacker is able to eavesdrop on sensitive data such as passwords.
- Product
- Lx390 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsyss.de
Oct 24, 2019An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices.CVE-2019-18200 · Other software · Fujitsu · reported by MITRECritical 9.8
An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, they are prone to keystroke injection attacks.
- Product
- Lx390 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsyss.de
Oct 24, 2019An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices.CVE-2019-18199 · Other software · Fujitsu · reported by MITREMedium 6.6
An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, and because of password-based authentication, they are vulnerable to replay attacks.
- Product
- Lx390 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsyss.de
Oct 11, 2019Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.CVE-2018-21028 · Other software · BOA · reported by MITREHigh 7.5
Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.
- Product
- BOA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2019Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.CVE-2018-21027 · Other software · BOA · reported by MITRECritical 9.8
Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.
- Product
- BOA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2019An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4.CVE-2019-17382 · Other software · Zabbix · reported by MITRECritical 9.1
An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgexploit-db.com
Oct 8, 2019It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.CVE-2019-10756 · Other software · Nodered · reported by report@snyk.ioMedium 5.4
It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.
- Product
- Node-red-dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2019includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated storCVE-2019-17239 · WordPress plugins & themes · reported by MITREMedium 6.1
includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues.
- Product
- includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Oct 1, 2019PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a session to be affected by malicious clipboard content.CVE-2019-17068 · Other software · Putty · reported by MITREHigh 7.5
PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a session to be affected by malicious clipboard content.
- Product
- Putty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Sep 30, 2019Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle CVE-2019-13467 · Other software · Sandisk · reported by MITREMedium 5.9
Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute downloaded resources with arbitrary files.
- Product
- SSD Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.wdc.comwesterndigital.com
Sep 30, 2019Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control.CVE-2019-13466 · Other software · Sandisk · reported by MITREHigh 7.5
Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” archive is protected with a hard-coded password. An application update that addresses the protection of archive encryption is available.
- Product
- SSD Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.wdc.comwesterndigital.com
Sep 25, 2019SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS.CVE-2019-12205 · Other software · Silverstripe · reported by MITREMedium 6.1
SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS.
- Product
- Silverstripe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.silverstripe.orgsilverstripe.org
Sep 20, 2019The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.CVE-2015-9399 · WordPress plugins & themes · reported by MITREHigh 7.2
The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.
- Product
- wp-stats-dashboard
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update wp-stats-dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2019Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able toCVE-2019-10396 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able to change build descriptions.
- Product
- Jenkins Dashboard View Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Sep 11, 2019WordPress before 5.2.3 allows reflected XSS in the dashboard.CVE-2019-16221 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.3 allows reflected XSS in the dashboard.
- Fixed in
- 5.2.3
- What to do
- Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD recordlists.debian.orgseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.