Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
281 results · page 4 of 6
Jul 10, 2022The tsileo/flask-yeoman repository through 2013-09-13 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31559 · Other software · Flask-yeoman Project · reported by MITRECritical 9.3
The tsileo/flask-yeoman repository through 2013-09-13 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Flask-yeoman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The pleomax00/flask-mongo-skel repository through 2012-11-01 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31551 · Other software · Flask-mongo-skel Project · reported by MITRECritical 9.3
The pleomax00/flask-mongo-skel repository through 2012-11-01 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Flask-mongo-skel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022A vulnerability, which was classified as critical, was found in Teleopti WFM 7.1.0.CVE-2017-20111 · Other software · Teleopti · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in Teleopti WFM 7.1.0. This affects an unknown part of the component Administration. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- Product
- WFM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022A vulnerability, which was classified as problematic, has been found in Teleopti WFM up to 7.1.0.CVE-2017-20110 · Other software · Teleopti · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Teleopti WFM up to 7.1.0. Affected by this issue is some unknown functionality of the component Administration. The manipulation as part of JSON leads to information disclosure (Credentials). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- Product
- WFM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022A vulnerability classified as problematic was found in Teleopti WFM up to 7.1.0.CVE-2017-20109 · Other software · Teleopti · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Teleopti WFM up to 7.1.0. Affected by this vulnerability is an unknown functionality of the file /TeleoptiWFM/Administration/GetOneTenant of the component Administration. The manipulation leads to information disclosure (Credentials). The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- Product
- WFM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2022In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to pCVE-2022-23082 · Other software · WhiteSource · reported by vulnerabilitylab@mend.ioHigh 7.5
In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.
- Product
- CureKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022A command injection security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble StoCVE-2022-28618 · Other software · HPE · reported by security-alert@hpe.comCritical 9.8
A command injection security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble Storage Secondary Flash Arrays that could allow an attacker to execute arbitrary commands on a Nimble appliance. HPE has made the following software updates to resolve the vulnerability in HPE Nimble Storage: 5.0.10.100 or later, 5.2.1.0 or later, 6.0.0.100 or later.
- Product
- Nimbleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
May 9, 2022A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays, and HPE Nimble Storage Secondary FlCVE-2022-23705 · Other software · HPE · reported by security-alert@hpe.comHigh 7.5
A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays, and HPE Nimble Storage Secondary Flash Arrays which could potentially allow the upload, but not execution, of unauthorized update binaries to the array. HPE has made the following software updates to resolve the vulnerability in HPE Nimble Storage: 5.0.10.100 or later, 5.2.1.0 or later, 6.0.0.100 or later.
- Product
- Nimbleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
May 9, 2022An issue was discovered in Galleon NTS-6002-GPS 4.14.103-Galleon-NTS-6002.V12 4.CVE-2022-27224 · Other software · Galsys · reported by MITREHigh 7.2
An issue was discovered in Galleon NTS-6002-GPS 4.14.103-Galleon-NTS-6002.V12 4. An authenticated attacker can perform command injection as root via shell metacharacters within the Network Tools section of the web-management interface. All three networking tools are affected (Ping, Traceroute, and DNS Lookup) and their respective input fields (ping_address, trace_address, nslookup_address). NOTE: this is disputed by the Supplier because the affected components were never shipped in a production release (they were only present in development releases), and because no privilege boundary is crossed (an applicable "authenticated attacker" always also has the supported ability to make an SSH connection as root).
- Product
- Nts-6002-gps Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgalsys.co.uk
Apr 12, 2022A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble Storage Secondary FlaCVE-2022-23703 · Other software · HPE · reported by security-alert@hpe.comHigh 7.5
A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble Storage Secondary Flash Arrays during update. This would potentially allow an attacker to intercept and modify network communication for software updates initiated by the Nimble appliance. The following NimbleOS versions, and all subsequent releases, contain a software fix for this vulnerability: 5.0.10.100, 5.2.1.500, 6.0.0.100
- Product
- Nimbleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Mar 23, 2022An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname.CVE-2021-4180 · Other software · Openstack · reported by Red HatMedium 4.3
An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the www_authenticate_uri parameter (which is visible to all end users) in configuration files. This would give sensitive information which may aid in additional system exploitation. This flaw affects openstack-tripleo-heat-templates versions prior to 11.6.1.
- Product
- Tripleo Heat Templates
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Mar 11, 2022Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.CVE-2022-0932 · Other software · saleor · reported by security@huntr.devMedium 6.5
Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.
- Product
- saleor/saleor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2022A potential vulnerability in the Oracle Talent Acquisition Cloud - Taleo Enterprise Edition.CVE-2021-35689 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.8
A potential vulnerability in the Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. This high severity potential vulnerability allows attackers to perform remote code execution on Taleo Enterprise Edition system. Successful attacks of this vulnerability can result in unauthorized remote code execution within Taleo Enterprise Edition and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. All affected customers were notified of CVE-2021-35689 by Oracle.
- Product
- Oracle Talent Acquisition Cloud - Taleo Enterprise Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022Leostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal attacks by uploading z ZIP file that contains a symbolic link.CVE-2021-41551 · Other software · Leostream · reported by MITREMedium 4.9
Leostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal attacks by uploading z ZIP file that contains a symbolic link.
- Product
- Connection Broker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordleostream.comleostream.com
Jan 18, 2022Leostream Connection Broker 9.0.40.17 allows administrator to upload and execute Perl code.CVE-2021-41550 · Other software · Leostream · reported by MITREHigh 7.2
Leostream Connection Broker 9.0.40.17 allows administrator to upload and execute Perl code.
- Product
- Connection Broker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordleostream.comleostream.com
Nov 8, 2021Chameleon CSS: Does not have any CSRF and capability checks in all its AJAX callsCVE-2021-24626 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, remove_css, also does not sanitise or escape the css_id POST parameter before using it in a SQL statement, leading to a SQL Injection
- Product
- Chameleon CSS
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Chameleon CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Oct 26, 2021An Insecure Permissions issue exists in Gestionale Open 11.00.00.CVE-2021-37363 · Other software · Gestionaleopen · reported by MITREHigh 7.8
An Insecure Permissions issue exists in Gestionale Open 11.00.00. A low privilege account is able to rename the mysqld.exe file located in bin folder and replace with a malicious file that would connect back to an attacking computer giving system level privileges (nt authority\system) due to the service running as Local System. While a low privilege user is unable to restart the service through the application, a restart of the computer triggers the execution of the malicious file. The application also have unquoted service path issues.
- Product
- Gestionale Open
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comgestionaleopen.org
Oct 20, 2021In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch CVE-2021-25972 · Other software · camaleon_cms · reported by vulnerabilitylab@mend.ioMedium 4.9
In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.
- Product
- camaleon_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Oct 20, 2021In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception.CVE-2021-25971 · Other software · camaleon_cms · reported by vulnerabilitylab@mend.ioMedium 4.3
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file
- Product
- camaleon_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Oct 20, 2021Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password.CVE-2021-25970 · Other software · camaleon_cms · reported by vulnerabilitylab@mend.ioHigh 8.8
Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed.
- Product
- camaleon_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Oct 20, 2021In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comCVE-2021-25969 · Other software · camaleon_cms · reported by vulnerabilitylab@mend.ioMedium 6.1
In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment.
- Product
- camaleon_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Sep 22, 2021Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py.CVE-2020-23478 · Other software · Leoeditor · reported by MITREHigh 7.5
Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py.
- Product
- LEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Aug 6, 2021LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter.CVE-2021-38157 · Other software · Leostream · reported by MITREMedium 6.1
LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- Connection Broker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddgccpa.comgist.github.com
Jun 18, 2021An issue was discovered in Cleo LexiCom 5.5.0.0.CVE-2021-33577 · Other software · Cleo · reported by MITREMedium 5.3
An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves (via encryption and signing of the message) can be bypassed by changing the Content-Type of the message to text/plain.
- Product
- Lexicom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2021An issue was discovered in Cleo LexiCom 5.5.0.0.CVE-2021-33576 · Other software · Cleo · reported by MITRECritical 9.8
An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-traversal characters, allowing the file to be written to an arbitrary location on disk.
- Product
- Lexicom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2021A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1.CVE-2021-31918 · Other software · Redhat · reported by Red HatHigh 7.5
A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.
- Product
- Openstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Apr 26, 2021LeoCAD before 21.03 sometimes allows a use-after-free during the opening of a new document.CVE-2021-31804 · Other software · Leocad · reported by MITREMedium 5.5
LeoCAD before 21.03 sometimes allows a use-after-free during the opening of a new document.
- Product
- Leocad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2021Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary memory values.CVE-2021-20307 · Other software · Libpano13 Project · reported by Red HatCritical 9.8
Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary memory values.
- Product
- Libpano13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Jan 5, 2021The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted SyCVE-2020-35488 · Other software · Nxlog · reported by MITREHigh 7.5
The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted Syslog payload to the Syslog service. This attack requires a specific configuration. Also, the name of the directory created must use a Syslog field. (For example, on Linux it is not possible to create a .. directory. On Windows, it is not possible to create a CON directory.)
- Product
- Nxlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2020Leostream Connection Broker 8.2.x is affected by stored XSS.CVE-2020-26574 · Other software · Leostream · reported by MITRECritical 9.6
Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScript code via the webquery.pl User-Agent HTTP header. It is rendered by the admins the next time they log in. The JavaScript injected can be used to force the admin to upload a malicious Perl script that will be executed as root via libMisc::browser_client. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- Connection Broker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadepts.of0x.ccleostream.com
Oct 6, 2020Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution.CVE-2020-8782 · Other software · Sierrawireless · reported by MITREHigh 7.5
Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution.
- Product
- Aleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.sierrawireless.comsource.sierrawireless.com
Oct 6, 2020Lack of input sanitization in UpdateRebootMgr service of ALEOS 4.11 and later allow an escalation to root from a low-privilege process.CVE-2020-8781 · Other software · Sierrawireless · reported by MITREHigh 7.8
Lack of input sanitization in UpdateRebootMgr service of ALEOS 4.11 and later allow an escalation to root from a low-privilege process.
- Product
- Aleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.sierrawireless.comsource.sierrawireless.com
Aug 29, 2020The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported CVE-2020-24972 · Other software · Kleopatra Project · reported by MITREHigh 8.8
The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.
- Product
- Kleopatra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Aug 28, 2020Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor.CVE-2020-15165 · Other software · maxieds · reported by GitHubCritical 9.3
Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official maintainer of the package is recommending all users upgrade to v1.1.8 as soon as possible. For more information, review the referenced GitHub Security Advisory.
- Product
- ChameleonMiniLiveDebugger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.complay.google.com
Aug 21, 2020The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying.CVE-2019-11862 · Other software · Sierrawireless · reported by MITREHigh 8.1
The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying.
- Product
- Aleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.sierrawireless.comsource.sierrawireless.com
Aug 21, 2020A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root.CVE-2019-11859 · Other software · Sierrawireless · reported by MITREMedium 6
A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root.
- Product
- Aleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.sierrawireless.comsource.sierrawireless.com
Aug 21, 2020Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9.CVE-2019-11858 · Other software · Sierrawireless · reported by MITREMedium 5.7
Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9.
- Product
- Aleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.sierrawireless.comsource.sierrawireless.com
Aug 21, 2020Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information.CVE-2019-11857 · Other software · Sierrawireless · reported by MITRECritical 9.1
Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information.
- Product
- Aleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.sierrawireless.comsource.sierrawireless.com
Aug 21, 2020A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay.CVE-2019-11856 · Other software · Sierrawireless · reported by MITRELow 3.3
A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView service can be replayed to other gateways sharing the same credentials.
- Product
- Aleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.sierrawireless.comsource.sierrawireless.com
Aug 21, 2020An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9.CVE-2019-11855 · Other software · Sierrawireless · reported by MITREHigh 8.1
An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9.
- Product
- Aleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.sierrawireless.comsource.sierrawireless.com
Aug 21, 2020Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4.CVE-2019-11853 · Other software · Sierrawireless · reported by MITRELow 3.9
Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4.
- Product
- Aleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.sierrawireless.comsource.sierrawireless.com
Aug 21, 2020An out-of-bounds reads vulnerability exists in the ACEView Service of ALEOS before 4.13.0, 4.9.5, and 4.4.9.CVE-2019-11852 · Other software · Sierrawireless · reported by MITRELow 3.7
An out-of-bounds reads vulnerability exists in the ACEView Service of ALEOS before 4.13.0, 4.9.5, and 4.4.9. Sensitive information may be disclosed via the ACEviewservice, accessible by default on the LAN.
- Product
- Aleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.sierrawireless.comsource.sierrawireless.com
Aug 21, 2020A stack overflow vulnerabiltity exist in the AT command interface of ALEOS before 4.11.0.CVE-2019-11850 · Other software · Sierrawireless · reported by MITREMedium 6.3
A stack overflow vulnerabiltity exist in the AT command interface of ALEOS before 4.11.0. The vulnerability may allow code execution
- Product
- Aleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.sierrawireless.comsource.sierrawireless.com
Aug 21, 2020A stack overflow vulnerabiltity exists in the AT command APIs of ALEOS before 4.11.0.CVE-2019-11849 · Other software · Sierrawireless · reported by MITREMedium 6.3
A stack overflow vulnerabiltity exists in the AT command APIs of ALEOS before 4.11.0. The vulnerability may allow code execution.
- Product
- Aleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.sierrawireless.comsource.sierrawireless.com
Aug 21, 2020An API abuse vulnerability exists in the AT command API of ALEOS before 4.13.0, 4.9.5, 4.4.9 due to lack of length checking when handling certain user-provided CVE-2019-11848 · Other software · Sierrawireless · reported by MITREMedium 4.1
An API abuse vulnerability exists in the AT command API of ALEOS before 4.13.0, 4.9.5, 4.4.9 due to lack of length checking when handling certain user-provided values.
- Product
- Aleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.sierrawireless.comsource.sierrawireless.com
Aug 21, 2020An improper privilege management vulnerabitlity exists in ALEOS before 4.11.0, 4.9.4 and 4.4.9.CVE-2019-11847 · Other software · Sierrawireless · reported by MITREHigh 7.3
An improper privilege management vulnerabitlity exists in ALEOS before 4.11.0, 4.9.4 and 4.4.9. An authenticated user can escalate to root via the command shell.
- Product
- Aleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.sierrawireless.comsource.sierrawireless.com
Aug 14, 2020There is stored cross site scripting (XSS) in Galileo CMS v0.042.CVE-2019-7410 · Other software · Galileo CMS Project · reported by MITREMedium 6.1
There is stored cross site scripting (XSS) in Galileo CMS v0.042. Remote authenticated users could inject arbitrary web script or HTML via $page_title in /lib/Galileo/files/templates/page/show.html.ep (aka the PAGE TITLE Field).
- Product
- Galileo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Jun 30, 2020In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, incluCVE-2020-15085 · Other software · mirumee · reported by GitHubMedium 6.9
In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials. A malicious user with direct access to the browser could extract the email and password. In versions prior to 2.10.0 persisted the cache even after the user logged out. This is fixed in version 2.10.3. A workaround is to manually clear application data (browser's local storage) after logging into Saleor Storefront.
- Product
- saleor-storefront
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2020Potential remote access security vulnerabilities have been identified with HPE Nimble Storage systems that could be exploited by an attacker to access and modifCVE-2020-7139 · Other software · HPE · reported by security-alert@hpe.comHigh 8.1
Potential remote access security vulnerabilities have been identified with HPE Nimble Storage systems that could be exploited by an attacker to access and modify sensitive information on the system. The following NimbleOS versions, and all subsequent releases, contain a software fix for this vulnerability: 3.9.3.0 4.5.6.0 5.0.9.0 5.1.4.100
- Product
- Nimbleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
May 19, 2020Potential remote code execution security vulnerabilities have been identified with HPE Nimble Storage systems that could be exploited by an attacker to gain eleCVE-2020-7138 · Other software · HPE · reported by security-alert@hpe.comHigh 8.8
Potential remote code execution security vulnerabilities have been identified with HPE Nimble Storage systems that could be exploited by an attacker to gain elevated privileges on the array. The following NimbleOS versions, and all subsequent releases, contain a software fix for this vulnerability: 3.9.3.0 4.5.6.0 5.0.9.0 5.1.4.100
- Product
- Nimbleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.