Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

570new WordPress flaws this week

391,397entries in the database

2,994 results · page 41 of 60

Apr 6, 2018The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jira administrator to import their Trello bCVE-2017-18097 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.4
The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jira administrator to import their Trello board to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the title of a Trello card.
Product
Jira
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jira.atlassian.com
Apr 5, 2018An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1.CVE-2018-1096 · Other software · Foreman Project · reported by Red HatMedium 6.5
An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database.
Product
Foreman
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record projects.theforeman.org access.redhat.com
Apr 4, 2018In config_set_string of config.cc, it is possible to pair a second BT keyboard without user approval due to improper input validation.CVE-2017-13284 · Computers, phones & browsers · Google Inc. · reported by security@android.comCritical 9.8
In config_set_string of config.cc, it is possible to pair a second BT keyboard without user approval due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-70808273.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Apr 3, 2018Escalation of privilege in all versions of the Intel Remote Keyboard allows a local attacker to inject keystrokes into another remote keyboard session.CVE-2018-3645 · Other software · Intel Corporation · reported by secure@intel.comHigh 7.8
Escalation of privilege in all versions of the Intel Remote Keyboard allows a local attacker to inject keystrokes into another remote keyboard session.
Product
Intel Remote Keyboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-center.intel.com security-center.intel.com
Apr 3, 2018Escalation of privilege in all versions of the Intel Remote Keyboard allows a network attacker to inject keystrokes as a local user.CVE-2018-3641 · Other software · Intel Corporation · reported by secure@intel.comCritical 9.8
Escalation of privilege in all versions of the Intel Remote Keyboard allows a network attacker to inject keystrokes as a local user.
Product
Intel Remote Keyboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-center.intel.com security-center.intel.com
Apr 3, 2018Escalation of privilege in all versions of the Intel Remote Keyboard allows an authorized local attacker to execute arbitrary code as a privileged user.CVE-2018-3638 · Other software · Intel Corporation · reported by secure@intel.comHigh 7.8
Escalation of privilege in all versions of the Intel Remote Keyboard allows an authorized local attacker to execute arbitrary code as a privileged user.
Product
Intel Remote Keyboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-center.intel.com security-center.intel.com
Mar 29, 2018The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended acceCVE-2014-5028 · Other software · Reviewboard · reported by MITREMedium 6.5
The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information from repository files by leveraging knowledge of database ids.
Product
Review Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com bugzilla.redhat.com
Mar 21, 2018Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an informaCVE-2017-0922 · Websites & servers · GitLab · reported by support@hackerone.comHigh 7.5
Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an information disclosure on any board object.
Product
GitLab Community and Enterprise Editions
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com hackerone.com
Mar 20, 2018SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parCVE-2014-4928 · Other software · Invisioncommunity · reported by MITREHigh 8.8
SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parameter.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dringen.blogspot.com.au dringen.blogspot.com.au
Mar 16, 2018The Artezio Kanban Board plugin 1.4 revision 1914 for Atlassian Jira has XSS via the Board Name in a Create New Board action, related to an artezioboard/mainPagCVE-2016-10715 · Other software · Artezio · reported by MITREMedium 5.4
The Artezio Kanban Board plugin 1.4 revision 1914 for Atlassian Jira has XSS via the Board Name in a Create New Board action, related to an artezioboard/mainPage.jspa?kanbanId=7#/kanban-view URI.
Product
Kanban Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Feb 20, 2018Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop before 2.2.0-2459 allows remote attackers to inject arbitrary weCVE-2015-6544 · Other software · Combodo · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop before 2.2.0-2459 allows remote attackers to inject arbitrary web script or HTML via a dashboard title.
Product
Itop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sourceforge.net sourceforge.net
Feb 17, 2018An issue was discovered in iDashboards 9.6b.CVE-2018-7211 · Other software · Idashboards · reported by MITREHigh 8.1
An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing man-in-the-middle attackers to discover credentials.
Product
Idashboards
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record membership.backbox.org membership.backbox.org
Feb 17, 2018An issue was discovered in iDashboards 9.6b.CVE-2018-7210 · Other software · Idashboards · reported by MITREHigh 7.5
An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct request for the idb/config?CMD=installLicense URI, as demonstrated by intranet IP addresses and names of guest accounts.
Product
Idashboards
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record membership.backbox.org membership.backbox.org
Feb 17, 2018An issue was discovered in iDashboards 9.6b.CVE-2018-7209 · Other software · Idashboards · reported by MITREHigh 7.5
An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct request for the idashboards/config.xml URI, as demonstrated by intranet URLs for reports.
Product
Idashboards
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record membership.backbox.org membership.backbox.org
Feb 17, 2018SQL Injection exists in the Realpin through 1.5.04 component for Joomla! via the pinboard parameter.CVE-2018-6005 · Other software · Realpin Project · reported by MITRECritical 9.8
SQL Injection exists in the Realpin through 1.5.04 component for Joomla! via the pinboard parameter.
Product
Realpin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Pinterest Clone Social Pinboard 2.0 component for Joomla! via the pin_id or user_id parameter in a task=getlikeinfo action, the endsCVE-2018-5987 · Other software · Social Pinboard Project · reported by MITRECritical 9.8
SQL Injection exists in the Pinterest Clone Social Pinboard 2.0 component for Joomla! via the pin_id or user_id parameter in a task=getlikeinfo action, the ends parameter in a view=gift action, the category parameter in a view=home action, the uid parameter in a view=pindisplay action, the searchVal parameter in a view=search action, or the uid parameter in a view=likes action.
Product
Social Pinboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Advertisement Board 3.1.0 component for Joomla! via a task=show_rss_categories&catname= request.CVE-2018-5982 · Other software · Ordasoft · reported by MITRECritical 9.8
SQL Injection exists in the Advertisement Board 3.1.0 component for Joomla! via a task=show_rss_categories&catname= request.
Product
Advertisement Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 31, 2018In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a fCVE-2017-8916 · Other software · Cisecurity · reported by MITREHigh 7.8
In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a forgot password email to themselves, thereby gaining administrative access.
Product
Cis-cat Pro Dashboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisecurity.org cisecurity.org
Jan 17, 2018Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: Mobile Gangway aCVE-2018-2621 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: Mobile Gangway and Mustering). The supported version that is affected is 7.3.874. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Shipboard Property Management System. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Shipboard Property Management System accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Shipboard Property Management System accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Product
Hospitality Cruise Shipboard Property Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com securityfocus.com
Jan 17, 2018Input validation error in Intel MinnowBoard 3 Firmware versions prior to 0.65 allow local attacker to cause denial of service via UEFI APIs.CVE-2017-5699 · Other software · Intel Corporation · reported by secure@intel.comMedium 5.5
Input validation error in Intel MinnowBoard 3 Firmware versions prior to 0.65 allow local attacker to cause denial of service via UEFI APIs.
Product
MinnowBoard 3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record edk2-docs.gitbooks.io edk2-docs.gitbooks.io
Jan 17, 2018Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Analytics Web Dashboards).CVE-2017-10068 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Analytics Web Dashboards). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
Product
Business Intelligence Enterprise Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com securityfocus.com
Jan 13, 2018The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a request to wp-adminCVE-2018-5695 · WordPress plugins & themes · reported by MITREHigh 7.2
The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a request to wp-admin/admin.php.
Affected
4.4.4 to 4.4.4
What to do
Affects 4.4.4 to 4.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Jan 12, 2018An information disclosure vulnerability in the Android framework (clipboardservice).CVE-2017-0846 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.5
An information disclosure vulnerability in the Android framework (clipboardservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64934810.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Jan 8, 2018clipedit in the Clipboard module for Perl allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$.CVE-2014-5509 · Other software · Clipboard Project · reported by security@debian.orgMedium 5.5
clipedit in the Clipboard module for Perl allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$.
Product
Clipboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 4, 2018xDashboard in OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 has SQL Injection.CVE-2017-14960 · Other software · Opentext · reported by MITREHigh 7.5
xDashboard in OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 has SQL Injection.
Product
Document Sciences Xpression
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org securityfocus.com
Dec 22, 2017Huawei SmartCare V200R003C10 has a stored XSS (cross-site scripting) vulnerability in the dashboard module.CVE-2017-15312 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.4
Huawei SmartCare V200R003C10 has a stored XSS (cross-site scripting) vulnerability in the dashboard module. A remote authenticated attacker could exploit this vulnerability to inject malicious scripts in the affected device.
Product
SmartCare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huawei.com huawei.com
Dec 15, 2017A debug tool in Synaptics TouchPad drivers allows local users with administrative access to obtain sensitive information about keyboard scan codes by modifying CVE-2017-17556 · Other software · HP · reported by MITREMedium 5.1
A debug tool in Synaptics TouchPad drivers allows local users with administrative access to obtain sensitive information about keyboard scan codes by modifying registry keys.
Product
Synaptics Touchpad Driver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hp.com synaptics.com
Dec 13, 2017MikroTik RouterBOARD v6.39.2 and v6.40.5 allows an unauthenticated remote attacker to cause a denial of service by connecting to TCP port 53 and sending data thCVE-2017-17537 · Network & remote access · Mikrotik · reported by MITREHigh 7.5
MikroTik RouterBOARD v6.39.2 and v6.40.5 allows an unauthenticated remote attacker to cause a denial of service by connecting to TCP port 53 and sending data that begins with many '\0' characters, possibly related to DNS.
Product
Routerboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstorm.news exploit-db.com
Nov 16, 2017Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter.CVE-2017-16849 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter.
Product
Manageengine Applications Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code610.blogspot.com manageengine.com
Nov 16, 2017A vulnerability in the upgrade process of Cisco Spark Board could allow an authenticated, local attacker to install an unverified upgrade package, aka SignatureCVE-2017-12306 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.4
A vulnerability in the upgrade process of Cisco Spark Board could allow an authenticated, local attacker to install an unverified upgrade package, aka Signature Verification Bypass. The vulnerability is due to insufficient upgrade package validation. An attacker could exploit this vulnerability by providing the upgrade process with an upgrade package that the attacker controls. An exploit could allow the attacker to install custom firmware to the Spark Board. Cisco Bug IDs: CSCvf84502.
Product
Conference Director
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com tools.cisco.com
Nov 3, 2017Mahara 1.10 before 1.10.0 and 15.04 before 15.04.0 are vulnerable to possible cross site scripting when adding a text block to a page via the keyboard (rather tCVE-2017-1000137 · Other software · Mahara · reported by MITREMedium 5.4
Mahara 1.10 before 1.10.0 and 15.04 before 15.04.0 are vulnerable to possible cross site scripting when adding a text block to a page via the keyboard (rather than drag and drop).
Product
Mahara
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.launchpad.net bugs.launchpad.net
Oct 31, 2017Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/.CVE-2017-15990 · Other software · Savsofteproducts · reported by MITRECritical 9.8
Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/.
Product
Phpinventory
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Oct 29, 2017Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.CVE-2017-15964 · Other software · Nicephpscripts · reported by MITRECritical 9.8
Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.
Product
JOB Board Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Oct 19, 2017Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: OHC DRS).CVE-2017-10361 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.4
Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: OHC DRS). The supported version that is affected is 8.0.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Cruise Shipboard Property Management System. While the vulnerability is in Oracle Hospitality Cruise Shipboard Property Management System, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality Cruise Shipboard Property Management System accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Cruise Shipboard Property Management System. CVSS 3.0 Base Score 6.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L).
Product
Hospitality Cruise Shipboard Property Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com securityfocus.com
Oct 16, 2017Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress.CVE-2017-15375 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress. The vulnerabilities are located in the `query` and `id` parameters of the `wpjb-email`, `wpjb-job`, `wpjb-application`, and `wpjb-membership` modules. Remote attackers are able to inject malicious script code to hijack admin session credentials via the backend, or to manipulate the backend on client-side performed requests. The attack vector is non-persistent and the request method to inject is GET. The attacker does not need a privileged user account to perform a successful exploitation.
Affected
4.5.1 to 4.5.1
What to do
Affects 4.5.1 to 4.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private project of another user.CVE-2017-15212 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private project of another user.
Product
Kanboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user.CVE-2017-15211 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user.
Product
Kanboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another user.CVE-2017-15210 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another user.
Product
Kanboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user.CVE-2017-15209 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user.
Product
Kanboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user.CVE-2017-15208 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user.
Product
Kanboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another user.CVE-2017-15207 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another user.
Product
Kanboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of another user.CVE-2017-15206 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of another user.
Product
Kanboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user.CVE-2017-15205 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user.
Product
Kanboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user.CVE-2017-15204 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user.
Product
Kanboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user.CVE-2017-15203 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user.
Product
Kanboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user.CVE-2017-15202 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user.
Product
Kanboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another user.CVE-2017-15201 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another user.
Product
Kanboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user.CVE-2017-15200 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user.
Product
Kanboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, CVE-2017-15199 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, Identifier, and Description.
Product
Kanboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can edit a category of a private project of another user.CVE-2017-15198 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit a category of a private project of another user.
Product
Kanboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.