Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,620 results · page 38 of 73
Dec 31, 2020The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/aCVE-2020-35934 · WordPress plugins & themes · reported by MITREMedium 4.3
The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/authenticate or aam/v2/authenticate). This is a security problem if this object stores information that the user is not supposed to have (e.g., custom metadata added by a different plugin).
- Product
- Advanced Access Manager
- Fixed in
- 6.6.2
- What to do
- Update Advanced Access Manager to 6.6.2 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Dec 31, 2020The REST/JSON project 7.x-1.x for Drupal allows blockage of user logins, aka SA-CONTRIB-2016-033.CVE-2016-20006 · Other software · Rest/json Project · reported by MITREHigh 7.5
The REST/JSON project 7.x-1.x for Drupal allows blockage of user logins, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.
- Product
- Rest/json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020HGiga MailSherlock does not validate user parameters on multiple login pages.CVE-2020-35741 · Other software · HGiga · reported by twcert@cert.org.twHigh 7
HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks.
- Product
- MailSherlock MSR45/SSR45
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 31, 2020includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP's serialization format when JSONCVE-2019-7725 · Other software · Nukeviet · reported by MITRECritical 9.8
includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP's serialization format when JSON can be used to eliminate the risk).
- Product
- Nukeviet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2020DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi.CVE-2020-19664 · Network & remote access · Draytek · reported by MITREHigh 8.8
DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi.
- Product
- Vigor2960 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2020EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Profile Page.CVE-2020-29231 · Other software · Egavilanmedia · reported by MITREMedium 5.4
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Profile Page. This vulnerability can result in the attacker injecting the XSS payload in Admin Full Name and each time admin visits the Profile page from the admin panel, the XSS triggers.
- Product
- User Registration And Login System With Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2020EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Panel - Manage User tab using the FCVE-2020-29230 · Other software · Egavilanmedia · reported by MITREMedium 6.1
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Panel - Manage User tab using the Full Name of the user. This vulnerability can result in the attacker injecting the XSS payload in the User Registration section and each time admin visits the manage user section from the admin panel, the XSS triggers and the attacker can steal the cookie according to the crafted payload.
- Product
- User Registration And Login System With Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2020EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by SQL injection in the User Login Page.CVE-2020-29228 · Other software · Egavilanmedia · reported by MITREHigh 7.5
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by SQL injection in the User Login Page.
- Product
- User Registration And Login System With Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2020Sentrifugo 3.2 allows Stored Cross-Site Scripting (XSS) vulnerability by inserting a payload within the X-Forwarded-For HTTP header during the login process.CVE-2020-28365 · Network & remote access · Sapplica · reported by MITREMedium 6.1
Sentrifugo 3.2 allows Stored Cross-Site Scripting (XSS) vulnerability by inserting a payload within the X-Forwarded-For HTTP header during the login process. When an administrator looks at logs, the payload is executed. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- Sentrifugo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwizlynxgroup.com
Dec 30, 2020Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login.CVE-2020-29594 · Other software · Rocket.chat · reported by MITRECritical 9.8
Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2020FOSCAM FHD X1 1.14.2.4 devices allow attackers (with physical UART access) to login via the ipc.fos~ password.CVE-2020-28096 · Other software · Foscammall · reported by MITREMedium 6.8
FOSCAM FHD X1 1.14.2.4 devices allow attackers (with physical UART access) to login via the ipc.fos~ password.
- Product
- Foscam X1 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2020Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank crCVE-2020-35710 · Other software · Parallels · reported by MITREMedium 5.3
Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker's client for use as a "host" value. In other words, after an attacker's web browser sent a request to the login form, it would automatically send a second request to a RASHTML5Gateway/socket.io URI with something like "host":"192.168.###.###" in the POST data.
- Product
- Remote Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwitter.comelladodelmal.com
Dec 23, 2020Cross Site Scripting (XSS) vulnerability via the 'Full Name' parameter in the User Registration section of User Registration & Login System with Admin Panel 1.0CVE-2020-35252 · Other software · Egavilanmedia · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability via the 'Full Name' parameter in the User Registration section of User Registration & Login System with Admin Panel 1.0.
- Product
- User Registration And Login System With Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Dec 21, 2020EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery (CSRF) to remotely gain privileges in the User ProCVE-2020-35273 · Other software · Egavilanmedia · reported by MITREHigh 8
EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery (CSRF) to remotely gain privileges in the User Profile panel. An attacker can update any user's account.
- Product
- User Registration & Login System With Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Dec 21, 2020LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-ForCVE-2020-35590 · WordPress plugins & themes · reported by MITRECritical 9.8
LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.
- Product
- LimitLoginAttempts.php in the limit-login-attempts-reloaded
- Fixed in
- 2.17.4
- What to do
- Update LimitLoginAttempts.php in the limit-login-attempts-reloaded to 2.17.4 or newer.
Full record and what to do →NVD recordn4nj0.github.iowordpress.org
Dec 21, 2020The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS.CVE-2020-35589 · WordPress plugins & themes · reported by MITREMedium 5.4
The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims.
- Product
- limit-login-attempts-reloaded
- Fixed in
- 2.17.4
- What to do
- Update limit-login-attempts-reloaded to 2.17.4 or newer.
Full record and what to do →NVD recordn4nj0.github.iowordpress.org
Dec 18, 2020There is a XSS in the user login page in zzcms 2019.CVE-2020-20285 · Other software · Zzcms · reported by MITREMedium 5.4
There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active.CVE-2020-26172 · Other software · Tangro · reported by MITREMedium 4.2
Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The JWT token does not contain an expiration timestamp.
- Product
- Business Workflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 returns the product version and release information on the login dialog.CVE-2020-4908 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 returns the product version and release information on the login dialog. This information could be used in further attacks against the system.
- Product
- Financial Transaction Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 15, 2020Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage (with different request CVE-2020-35416 · Other software · Onlineonly · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage (with different request parameters), allows remote attackers to inject arbitrary web script or HTML.
- Product
- Phpjabbers Appointment Scheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Dec 14, 2020SQL Injection in the login page in Online Bus Ticket Reservation 1.0 allows attackers to execute arbitrary SQL commands and bypass authentication via the usernaCVE-2020-35378 · Other software · Online BUS Ticket Reservation Project · reported by MITRECritical 9.8
SQL Injection in the login page in Online Bus Ticket Reservation 1.0 allows attackers to execute arbitrary SQL commands and bypass authentication via the username and password fields.
- Product
- Online BUS Ticket Reservation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Dec 8, 2020Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated.CVE-2020-26962 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have been used in clickjacking attacks, as well as be read across partitions in dynamic first party isolation. This vulnerability affects Firefox < 83.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 8, 2020Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page.CVE-2020-25889 · Other software · Online BUS Booking System Project · reported by MITRECritical 9.8
Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page. By placing SQL injection payload on the login page attackers can bypass the authentication and can gain the admin privilege.
- Product
- Online BUS Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 1, 2020OAuthenticator is an OAuth login mechanism for JupyterHub.CVE-2020-26250 · Other software · jupyterhub · reported by GitHubMedium 6.3
OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated (in jupyterhub 1.2) configuration `Authenticator.whitelist`, which should be transparently mapped to `Authenticator.allowed_users` with a warning, is instead ignored by OAuthenticator classes, resulting in the same behavior as if this configuration has not been set. If this is the only mechanism of authorization restriction (i.e. no group or team restrictions in configuration) then all authenticated users will be allowed. Provider-based restrictions, including deprecated values such as `GitHubOAuthenticator.org_whitelist` are **not** affected. All users of OAuthenticator 0.12.0 and 0.12.1 with JupyterHub 1.2 (JupyterHub Helm chart 0.10.0-0.10.5) who use the `admin.whitelist.users` configuration in the jupyterhub helm chart or the `c.Authenticator.whitelist` configuration directly. Users of other deprecated configuration, e.g. `c.GitHubOAuthenticator.team_whitelist` are **not** affected. If you see a log line like this and expect a specific list of allowed usernames: "[I 2020-11-27 16:51:54.528 JupyterHub app:1717] Not using allowed_users. Any authentica
- Product
- oauthenticator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2020HCL Domino is susceptible to a Login CSRF vulnerability.CVE-2020-4127 · Other software · Hcltech · reported by psirt@hcl.comMedium 6.5
HCL Domino is susceptible to a Login CSRF vulnerability. With a valid credential, an attacker could trick a user into accessing a system under another ID or use an intranet user's system to access internal systems from the internet. Fixes are available in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 FP6 and 11.0.1 FP1 and later.
- Product
- HCL Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Nov 23, 2020When OTRS uses multiple backends for user authentication (with LDAP), agents are able to login even if the account is set to invalid.CVE-2020-1778 · Other software · OTRS AG · reported by security@otrs.comMedium 4.1
When OTRS uses multiple backends for user authentication (with LDAP), agents are able to login even if the account is set to invalid. This issue affects OTRS; 8.0.9 and prior versions.
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2020The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly theCVE-2020-26168 · Other software · Hazelcast · reported by MITRECritical 9.8
The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some system-user-dn scenarios. As a result, users (clients/members) can be authenticated even if they provide invalid passwords.
- Product
- Hazelcast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.hazelcast.orghazelcast.zendesk.com
Oct 22, 2020A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php.CVE-2020-18129 · Other software · Eyoucms · reported by MITREHigh 8.8
A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbaike.baidu.combaike.baidu.com
Oct 22, 2020tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.CVE-2020-15906 · Other software · Tiki · reported by MITRECritical 9.8
tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.
- Product
- Tiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.cominfo.tiki.org
Oct 21, 2020The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.CVE-2020-27615 · WordPress plugins & themes · reported by MITRECritical 9.8
The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.
- Product
- Loginizer
- Fixed in
- 1.6.4
- What to do
- Update Loginizer to 1.6.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpdeeply.com
Oct 21, 2020Vulnerability in the Oracle FLEXCUBE Direct Banking product of Oracle Financial Services Applications (component: Pre Login).CVE-2020-14897 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle FLEXCUBE Direct Banking product of Oracle Financial Services Applications (component: Pre Login). Supported versions that are affected are 12.0.1, 12.0.2 and 12.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Direct Banking. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Direct Banking accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
- Product
- FLEXCUBE Direct Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2020Vulnerability in the Oracle FLEXCUBE Direct Banking product of Oracle Financial Services Applications (component: Pre Login).CVE-2020-14890 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle FLEXCUBE Direct Banking product of Oracle Financial Services Applications (component: Pre Login). Supported versions that are affected are 12.0.1, 12.0.2 and 12.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Direct Banking. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Direct Banking accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
- Product
- FLEXCUBE Direct Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2020phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter.CVE-2020-27163 · Websites & servers · Phpredisadmin Project · reported by MITREMedium 6.1
phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter.
- Product
- Phpredisadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2020Veritas APTARE versions prior to 10.5 included code that bypassed the normal login process when specific authentication credentials were provided to the server.CVE-2020-27157 · Other software · Veritas · reported by MITREHigh 8.1
Veritas APTARE versions prior to 10.5 included code that bypassed the normal login process when specific authentication credentials were provided to the server. An unauthenticated user could login to the application and gain access to the data and functionality accessible to the targeted user account.
- Product
- Aptare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordveritas.comveritas.com
Oct 14, 2020IProom MMC+ Server login page does not validate specific parameters properly.CVE-2020-24551 · Other software · IProom · reported by twcert@cert.org.twMedium 6.1
IProom MMC+ Server login page does not validate specific parameters properly. Attackers can use the vulnerability to redirect to any malicious site and steal the victim's login credentials.
- Product
- MMC+ Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 12, 2020SonicOS SSLVPN login page allows a remote unauthenticated attacker to perform firewall management administrator username enumeration based on the server responsCVE-2020-5143 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comMedium 5.3
SonicOS SSLVPN login page allows a remote unauthenticated attacker to perform firewall management administrator username enumeration based on the server responses. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0.
- Product
- SonicOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.compsirt.global.sonicwall.com
Oct 2, 2020The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token.CVE-2020-26511 · WordPress plugins & themes · reported by MITREHigh 7.5
The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass.
- Product
- wpo365-login
- Fixed in
- 11.7
- What to do
- Update wpo365-login to 11.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 1, 2020Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts.CVE-2020-25200 · Other software · Pritunl · reported by MITREMedium 5.3
Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames will receive error 401 indefinitely. Note: This has been disputed by the vendor as not a vulnerability. They argue that this is an intended design
- Product
- Pritunl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2020The login page in Telmat AccessLog <= 6.0 (TAL_20180415) allows an attacker to get root shell access via Unauthenticated code injection over the network.CVE-2020-16147 · Other software · Telmat · reported by MITRECritical 9.8
The login page in Telmat AccessLog <= 6.0 (TAL_20180415) allows an attacker to get root shell access via Unauthenticated code injection over the network.
- Product
- Accesslog Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpodalirius.netpodalirius.net
Sep 23, 2020In IgniteNet HeliOS GLinq v2.2.1 r2961, the login functionality does not contain any CSRF protection mechanisms.CVE-2020-5783 · Other software · Ignitenet · reported by vulnreport@tenable.comMedium 5.4
In IgniteNet HeliOS GLinq v2.2.1 r2961, the login functionality does not contain any CSRF protection mechanisms.
- Product
- Helios Glinq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Sep 23, 2020PingID Integration for Windows Login before 2.4.2 allows local users to gain privileges by modifying CefSharp.BrowserSubprocess.exe.CVE-2020-25826 · Other software · Pingidentity · reported by MITREHigh 7.8
PingID Integration for Windows Login before 2.4.2 allows local users to gain privileges by modifying CefSharp.BrowserSubprocess.exe.
- Product
- Pingid Integration For Windows Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.comgitlab.com
Sep 10, 2020An issue was discovered in the Login Password feature of the Password Manager component in Avast Antivirus 20.1.5069.562.CVE-2020-15024 · Other software · Avast · reported by MITREMedium 5.5
An issue was discovered in the Login Password feature of the Password Manager component in Avast Antivirus 20.1.5069.562. An entered password continues to be stored in Windows main memory after a logout, and after a Lock Vault operation.
- Product
- Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnestedif.comnestedif.com
Sep 9, 2020A SQL injection vulnerability in the login component in Stock Management System v1.0 allows remote attacker to execute arbitrary SQL commands via the username pCVE-2020-24197 · Other software · Stock Management System Project · reported by MITRECritical 9.8
A SQL injection vulnerability in the login component in Stock Management System v1.0 allows remote attacker to execute arbitrary SQL commands via the username parameter.
- Product
- Stock Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comsourcecodester.com
Sep 3, 2020Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbitrary code.CVE-2020-25006 · Other software · Heybbs Project · reported by MITRECritical 9.8
Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbitrary code.
- Product
- Heybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comjazzsec.com
Sep 3, 2020The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual.CVE-2020-25119 · Other software · Vbulletin · reported by MITREMedium 4.8
The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest-vincent.blogspot.compentest-vincent.blogspot.com
Sep 3, 2020A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated user to execute authentication bypass with SQL injectCVE-2020-24193 · Other software · Daily Tracker System Project · reported by MITRECritical 9.8
A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated user to execute authentication bypass with SQL injection via the email parameter.
- Product
- Daily Tracker System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Sep 1, 2020An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3.CVE-2020-6141 · Other software · Os4ed · reported by talos-cna@cisco.comCritical 9.8
An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can send an HTTP request to trigger this vulnerability.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 1, 2020A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JCVE-2020-23839 · Other software · Get-simple · reported by MITREMedium 6.1
A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the login form.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 28, 2020in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated underscCVE-2020-15164 · Other software · InternationalScratchWiki · reported by GitHubCritical 10
in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated underscore(s), since those are treated as whitespace and trimmed by MediaWiki. This affects all users on any wiki using this extension. Since version 1.1, comments by users whose usernames would be trimmed on MediaWiki are ignored when searching for the verification code.
- Product
- mediawiki-scratch-login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2020DesignMasterEvents Conference management 1.0.0 allows SQL Injection via the username field on the administrator login page.CVE-2020-23980 · Other software · Designmasterevents · reported by MITRECritical 9.8
DesignMasterEvents Conference management 1.0.0 allows SQL Injection via the username field on the administrator login page.
- Product
- Conference Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.compacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.