Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,620 results · page 41 of 73
Jan 21, 2020An issue was discovered in button_open in login/logind-button.c in systemd before 243.CVE-2019-20386 · Other software · Systemd Project · reported by MITRELow 2.4
An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.
- Product
- Systemd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orggithub.com
Jan 20, 2020SMC D3G0804W 3.5.2.5-LAT_GA devices allow XSS via the SSID field on the WiFi Network Configuration page (after a successful login to the admin account).CVE-2020-7249 · Other software · SMC · reported by MITREMedium 4.8
SMC D3G0804W 3.5.2.5-LAT_GA devices allow XSS via the SSID field on the WiFi Network Configuration page (after a successful login to the admin account).
- Product
- D3g0804 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsku11army.blogspot.comsku11army.blogspot.com
Jan 19, 2020Ruckus ZoneFlex R310 104.0.0.0.1347 devices allow Stored XSS via the SSID field on the Configuration > Radio 2.4G > Wireless X screen (after a successful login CVE-2020-7234 · Other software · Ruckuswireless · reported by MITREMedium 4.8
Ruckus ZoneFlex R310 104.0.0.0.1347 devices allow Stored XSS via the SSID field on the Configuration > Radio 2.4G > Wireless X screen (after a successful login to the super account).
- Product
- R310 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsku11army.blogspot.comsku11army.blogspot.com
Jan 19, 2020Evoko Home 1.31 devices provide different error messages for failed login requests depending on whether the username is valid.CVE-2020-7231 · Other software · Evoko · reported by MITREMedium 5.3
Evoko Home 1.31 devices provide different error messages for failed login requests depending on whether the username is valid.
- Product
- Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsku11army.blogspot.comsku11army.blogspot.com
Jan 15, 2020Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Login).CVE-2020-2677 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.7
Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Login). Supported versions that are affected are 5.5 and 5.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 accessible data. CVSS 3.0 Base Score 5.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N).
- Product
- Hospitality OPERA 5 Property Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2020Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Login).CVE-2020-2675 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1
Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Login). The supported version that is affected is 5.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality OPERA 5 accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
- Product
- Hospitality OPERA 5 Property Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2020Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depenCVE-2020-7057 · Network & remote access · Hikvision · reported by MITREMedium 5.3
Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depending on whether the user account exists, which might make it easier to enumerate users. However, only about 4 or 5 failed logins are allowed.
- Product
- Ds-7204hghi-f1 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsku11army.blogspot.comsku11army.blogspot.com
Jan 8, 2020A Denial of Service vulnerability exists in the ITMS workflow process manager login window in Symantec IT Management Suite 8.0.CVE-2016-6589 · Other software · Symantec · reported by secure@symantec.comMedium 6.5
A Denial of Service vulnerability exists in the ITMS workflow process manager login window in Symantec IT Management Suite 8.0.
- Product
- IT Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsupport.symantec.com
Jan 6, 2020The application login page in AKIPS Network Monitor 15.37 through 16.5 allows a remote unauthenticated attacker to execute arbitrary OS commands via shell metacCVE-2016-11017 · Other software · Akips · reported by MITRECritical 9.8
The application login page in AKIPS Network Monitor 15.37 through 16.5 allows a remote unauthenticated attacker to execute arbitrary OS commands via shell metacharacters in the username parameter (a failed login attempt returns the command-injection output to a limited login failure field). This is fixed in 16.6.
- Product
- Network Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordctrlu.netexploit-db.com
Jan 6, 2020Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to obtain a login password via HTTP referer.CVE-2019-5990 · Other software · ANGLERSNET Co,.Ltd. · reported by vultures@jpcert.or.jpHigh 7.5
Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to obtain a login password via HTTP referer.
- Product
- Access analysis CGI An-Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2020obs-server before 1.7.7 allows logins by 'unconfirmed' accounts due to a bug in the REST api implementation.CVE-2010-3782 · Other software · Obs-server · reported by MITREHigh 8.8
obs-server before 1.7.7 allows logins by 'unconfirmed' accounts due to a bug in the REST api implementation.
- Product
- Obs-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jan 2, 2020MyBB before 1.8.22 allows an open redirect on login.CVE-2019-20225 · Other software · Mybb · reported by MITREMedium 6.1
MyBB before 1.8.22 allows an open redirect on login.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2019PRTG Network Monitor v7.1.3.3378 allows XSS via the /public/login.htm errormsg or loginurl parameter.CVE-2019-9206 · Other software · Paessler · reported by MITREMedium 6.1
PRTG Network Monitor v7.1.3.3378 allows XSS via the /public/login.htm errormsg or loginurl parameter. NOTE: This product is discontinued.
- Product
- Prtg Network Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 27, 2019AVTECH AVN801 DVR has a security bypass via the administration login captchaCVE-2013-4982 · Other software · Avtech · reported by MITRECritical 9.8
AVTECH AVN801 DVR has a security bypass via the administration login captcha
- Product
- Avn801 DVR Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Dec 18, 2019A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.10 in the Salesforce login integration that could be used by an attaCVE-2019-5486 · Websites & servers · Gitlab · reported by support@hackerone.comHigh 8.8
A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.10 in the Salesforce login integration that could be used by an attacker to create an account that bypassed domain restrictions and email verification requirements.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Dec 16, 2019A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1.CVE-2019-19368 · Other software · Maxum · reported by MITREMedium 6.1
A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. An attacker can exploit it by sending a crafted link to end users and can execute arbitrary Javascripts
- Product
- Rumpus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 10, 2019JBoss KeyCloak: XSS in login-status-iframe.htmlCVE-2014-3656 · Other software · JBoss KeyCloak · reported by Red HatMedium 6.1
JBoss KeyCloak: XSS in login-status-iframe.html
- Product
- JBoss KeyCloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Dec 6, 2019The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi.CVE-2018-7282 · Other software · Titool · reported by MITRECritical 9.8
The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi.
- Product
- Printmonitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2019Intelbras IWR 3000N 1.8.7 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled, a related issue to CVE-201CVE-2019-19007 · Other software · Intelbras · reported by MITREHigh 7.2
Intelbras IWR 3000N 1.8.7 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled, a related issue to CVE-2019-17600.
- Product
- IWR 3000n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2019In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is a logic error in the main function in suCVE-2019-19519 · Other software · Openbsd · reported by MITREHigh 7.8
In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is a logic error in the main function in su/su.c.
- Product
- Openbsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 2, 2019NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[username] field when double quotes are usedCVE-2019-19245 · Other software · Napc · reported by MITRECritical 9.8
NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[username] field when double quotes are used.
- Product
- Xinet Elegant 6 Asset Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhyp3rlinx.altervista.orgpacketstormsecurity.com
Nov 29, 2019When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changCVE-2019-16766 · Other software · Lab Digital · reported by GitHubHigh 8.7
When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0.
- Product
- wagtail-2fa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2019The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary cCVE-2019-15072 · Other software · Openfind · reported by twcert@cert.org.twMedium 6.1
The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities.
- Product
- MAIL2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 13, 2019letodms has multiple XSS issues: Reflected XSS in Login Page, Stored XSS in Document Owner/User name, Stored XSS in CalendarCVE-2012-4384 · Other software · letodms · reported by Red HatMedium 6.1
letodms has multiple XSS issues: Reflected XSS in Login Page, Stored XSS in Document Owner/User name, Stored XSS in Calendar
- Product
- letodms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurity-tracker.debian.org
Nov 13, 2019FUDForum 3.0.9 is vulnerable to Stored XSS via the nlogin parameter.CVE-2019-18839 · Other software · Fudforum · reported by MITRECritical 9
FUDForum 3.0.9 is vulnerable to Stored XSS via the nlogin parameter. This may result in remote code execution. An attacker can use a user account to fully compromise the system using a POST request. When the admin visits the user information, the payload will execute. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.
- Product
- Fudforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Nov 5, 2019Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for cusCVE-2019-8118 · Websites & servers · Adobe Systems Incorporated · reported by AdobeMedium 5.3
Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts.
- Product
- Magento 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmagento.commagento.com
Nov 4, 2019TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login box.CVE-2010-3669 · Other software · Typo3 · reported by MITREMedium 5.4
TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login box.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgsecurity-tracker.debian.org
Nov 4, 2019A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attackers to execute arbitrary SQL commands viCVE-2019-18663 · Other software · ISL · reported by MITRECritical 9.8
A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attackers to execute arbitrary SQL commands via the user_id parameter.
- Product
- Arp-guard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordatomic111.github.ioatomic111.github.io
Oct 24, 2019In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute forceCVE-2019-15929 · Other software · Craftcms · reported by MITRECritical 9.8
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 24, 2019A remote code execution vulnerability exists in MapR CLDB code, specifically in the JSON framework that is used in the CLDB code that handles login and ticket iCVE-2019-12017 · Other software · Mapr · reported by security-alert@hpe.comCritical 9.8
A remote code execution vulnerability exists in MapR CLDB code, specifically in the JSON framework that is used in the CLDB code that handles login and ticket issuance. An attacker can use the 'class' property of the JSON request sent to the CLDB to influence the JSON library's decision on which Java class this JSON request is deserialized to. By doing so, the attacker can force the MapR CLDB to construct a URLClassLoader which loads a malicious Java class from a remote path and instantiate this object in the MapR CLDB, thus executing arbitrary code on the machine running the MapR CLDB and take over the cluster. By switching to the newer Jackson library and ensuring that all incoming JSON requests are only deserialized to the same class that it was serialized from, the vulnerability is fixed. This vulnerability affects the entire MapR core platform.
- Product
- Mapr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2019In Ant Design Pro 4.0.0, reflected XSS in the user/login redirect GET parameter affects the authorization component, leading to execution of JavaScript code in CVE-2019-18350 · Other software · Ant.design · reported by MITREMedium 6.1
In Ant Design Pro 4.0.0, reflected XSS in the user/login redirect GET parameter affects the authorization component, leading to execution of JavaScript code in the login after-action script.
- Product
- ANT Design Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2019The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value.CVE-2015-9498 · WordPress plugins & themes · reported by MITREHigh 8.8
The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value.
- Product
- wps-hide-login
- Fixed in
- 1.1
- What to do
- Update wps-hide-login to 1.1 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Oct 17, 2019HiNet GPON firmware version < I040GWR190731 allows an attacker login to device without any authentication.CVE-2019-15064 · Other software · HiNET · reported by twcert@cert.org.twCritical 9.8
HiNet GPON firmware version < I040GWR190731 allows an attacker login to device without any authentication.
- Product
- GPON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtvn.twcert.org.twtwcert.org.tw
Oct 16, 2019Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login Help).CVE-2019-3027 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login Help). Supported versions that are affected are 12.2.5-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Object Library. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
- Product
- Application Object Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2019The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrated by sniffing of a pCVE-2019-17356 · Other software · Infinitestudio · reported by MITREMedium 6.5
The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrated by sniffing of a public Wi-Fi network.
- Product
- Infinite Design
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2019Intelbras IWR 1000N 1.6.4 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled.CVE-2019-17600 · Other software · Intelbras · reported by MITRECritical 9.8
Intelbras IWR 1000N 1.6.4 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled.
- Product
- IWR 1000n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.comexploit-db.com
Oct 14, 2019A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitrary web script or HTCVE-2019-16344 · Other software · Scadabr · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitrary web script or HTML via the username or password parameter.
- Product
- Scadabr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfabiantronc.wordpress.comfabiantronc.wordpress.com
Oct 11, 2019The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, uCVE-2015-9492 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- Product
- ThemeMakers SmartIT Premium Responsive
- Affected
- up to 2015-05-15
- What to do
- Affects up to 2015-05-15. Update ThemeMakers SmartIT Premium Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 11, 2019The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, CVE-2015-9491 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- Product
- ThemeMakers Blessing Premium Responsive
- Affected
- up to 2015-05-15
- What to do
- Affects up to 2015-05-15. Update ThemeMakers Blessing Premium Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 11, 2019The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_passCVE-2015-9490 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- Product
- ThemeMakers GamesTheme Premium
- Affected
- up to 2015-05-15
- What to do
- Affects up to 2015-05-15. Update ThemeMakers GamesTheme Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 11, 2019The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, uCVE-2015-9489 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- Product
- ThemeMakers Goodnex Premium Responsive
- Affected
- up to 2015-05-15
- What to do
- Affects up to 2015-05-15. Update ThemeMakers Goodnex Premium Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 11, 2019The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, CVE-2015-9487 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- Product
- ThemeMakers Almera Responsive Portfolio
- Affected
- up to 2015-05-15
- What to do
- Affects up to 2015-05-15. Update ThemeMakers Almera Responsive Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 11, 2019The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, usCVE-2015-9486 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- Product
- ThemeMakers Axioma Premium Responsive
- Affected
- up to 2015-05-15
- What to do
- Affects up to 2015-05-15. Update ThemeMakers Axioma Premium Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 11, 2019The ThemeMakers Diplomat | Political theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_paCVE-2015-9481 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Diplomat | Political theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- Product
- ThemeMakers Diplomat | Political
- Affected
- up to 2015-05-15
- What to do
- Affects up to 2015-05-15. Update ThemeMakers Diplomat | Political to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 11, 2019IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: admin/login.html with the parameter username is persistent in 10.2.0.CVE-2010-5336 · Other software · Icewarp · reported by MITREMedium 6.1
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: admin/login.html with the parameter username is persistent in 10.2.0.
- Product
- Webclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comgosecurity.ch
Oct 10, 2019The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext.CVE-2019-9532 · Other software · Cobham plc · reported by cret@cert.orgHigh 7.8
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal.
- Product
- Explorer 710
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Oct 10, 2019EyouCms through 2019-07-11 has XSS related to the login.php web_recordnum parameter.CVE-2019-17430 · Other software · Eyoucms · reported by MITREMedium 6.1
EyouCms through 2019-07-11 has XSS related to the login.php web_recordnum parameter.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2019Netreo OmniCenter through 12.1.1 allows unauthenticated SQL Injection (Boolean Based Blind) in the redirect parameters and parameter name of the login page throCVE-2019-17128 · Other software · Netreo · reported by MITREHigh 7.5
Netreo OmniCenter through 12.1.1 allows unauthenticated SQL Injection (Boolean Based Blind) in the redirect parameters and parameter name of the login page through a GET request. The injection allows an attacker to read sensitive information from the database used by the application.
- Product
- Omnicenter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comnetreo.com
Oct 9, 2019S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.CVE-2019-17368 · Other software · S-cms · reported by MITREMedium 6.1
S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2019TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt.CVE-2019-17205 · Other software · Teampass · reported by MITREMedium 6.1
TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.