Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,507 results · page 42 of 71
Aug 11, 2021Uncaught exception in firmware for Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.1.0 may allow a privileged attacCVE-2021-0007 · Other software · Intel · reported by secure@intel.comMedium 4.4
Uncaught exception in firmware for Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.1.0 may allow a privileged attacker to potentially enable denial of service via local access.
- Product
- Ethernet Controller E810 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Aug 11, 2021Improper conditions check in firmware for Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.4.0 may allow a privilegeCVE-2021-0006 · Other software · Intel · reported by secure@intel.comMedium 4.4
Improper conditions check in firmware for Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.4.0 may allow a privileged user to potentially enable denial of service via local access.
- Product
- Ethernet Controller E810 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Aug 11, 2021Uncaught exception in firmware for Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.3.0 may allow a privileged user CVE-2021-0005 · Other software · Intel · reported by secure@intel.comMedium 4.4
Uncaught exception in firmware for Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.3.0 may allow a privileged user to potentially enable denial of service via local access.
- Product
- Ethernet Controller E810 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Aug 11, 2021Improper buffer restrictions in the firmware of Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.3.0 may allow a priCVE-2021-0004 · Other software · Intel · reported by secure@intel.comMedium 4.4
Improper buffer restrictions in the firmware of Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.3.0 may allow a privileged user to potentially enable denial of service via local access.
- Product
- Ethernet Controller E810 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgsecurity.netapp.com
Aug 11, 2021Improper conditions check in some Intel(R) Ethernet Controllers 800 series Linux drivers before version 1.4.11 may allow an authenticated user to potentially enCVE-2021-0003 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper conditions check in some Intel(R) Ethernet Controllers 800 series Linux drivers before version 1.4.11 may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Ethernet Controller E810 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Aug 11, 2021Improper conditions check in some Intel(R) Ethernet Controllers 800 series Linux drivers before version 1.4.11 may allow an authenticated user to potentially enCVE-2021-0002 · Other software · Intel · reported by secure@intel.comHigh 7.1
Improper conditions check in some Intel(R) Ethernet Controllers 800 series Linux drivers before version 1.4.11 may allow an authenticated user to potentially enable information disclosure or denial of service via local access.
- Product
- Ethernet Controller E810 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Aug 10, 2021A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl.CVE-2020-28397 · Other software · Siemens · reported by productcert@siemens.comMedium 5.3
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7 PLCSIM Advanced (All versions > V2 < V4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (Version V4.4), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions > V2.5 < V2.9.2), SIMATIC S7-1500 Software Controller (All versions > V2.5 < V21.9), TIM 1531 IRC (incl. SIPLUS NET variants) (Version V2.1). Due to an incorrect authorization check in the affected component, an attacker could extract information about access protected PLC program variables over port 102/tcp from an affected device when reading multiple attributes at once.
- Product
- SIMATIC Drive Controller family
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Aug 5, 2021A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijackCVE-2021-22927 · Network & remote access · Citrix · reported by support@hackerone.comHigh 8.1
A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session.
- Product
- Application Delivery Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Aug 5, 2021A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN CVE-2021-22919 · Network & remote access · Citrix · reported by support@hackerone.comHigh 7.5
A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, could lead to the limited available disk space on the appliances being fully consumed.
- Product
- Application Delivery Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Aug 3, 2021Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a cross-site scripting vulnerability.CVE-2021-21581 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Dell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, where a malicious URL cCVE-2021-21580 · Other software · Dell · reported by security_alert@emc.comMedium 4.3
Dell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, where a malicious URL can inject text to present a customized message on the application that can phish users into believing that the message is legitimate.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability.CVE-2021-21579 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability.CVE-2021-21578 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability.CVE-2021-21577 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability.CVE-2021-21576 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2021Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability.CVE-2021-21538 · Other software · Dell · reported by security_alert@emc.comCritical 9.6
Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access to the virtual console.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2021Contour is a Kubernetes ingress controller using Envoy proxy.CVE-2021-32783 · Other software · projectcontour · reported by GitHubHigh 8.5
Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy remotely (a denial of service), or to expose the existence of any Secret that Envoy is using for its configuration, including most notably TLS Keypairs. However, it *cannot* be used to get the *content* of those secrets. Since this attack allows access to the administration interface, a variety of administration options are available, such as shutting down the Envoy or draining traffic. In general, the Envoy admin interface cannot easily be used for making changes to the cluster, in-flight requests, or backend services, but it could be used to shut down or drain Envoy, change traffic routing, or to retrieve secret metadata, as mentioned above. The issue will be addressed in Contour v1.18.0 and a cherry-picked patch release, v1.17.1, has been released to cover users who cannot upgrade at this time. For more details refer to the linked GitHub Security Advisory.
- Product
- contour
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2021The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the set_banner() function of /var/www/core/controller/index.CVE-2020-25205 · Other software · Mimosa · reported by MITREMedium 6.1
The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the set_banner() function of /var/www/core/controller/index.php. An unauthenticated attacker may set the contents of the /mnt/jffs2/banner.txt file, stored on the device's filesystem, to contain arbitrary JavaScript. The file contents are then used as part of a welcome/banner message presented to unauthenticated users who visit the login page for the web console. This vulnerability does not occur in the older 1.5.x firmware versions.
- Product
- B5 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.f-secure.comlabs.f-secure.com
Jul 16, 2021Windows Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-34460 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Windows Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-34513 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1909
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Windows Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-34512 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Windows Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-34510 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Storage Spaces Controller Information Disclosure VulnerabilityCVE-2021-34509 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Storage Spaces Controller Information Disclosure Vulnerability
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Windows Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-33751 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 13, 2021Incorrect Implementation of Authentication Algorithm in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.2.50 to Ver.CVE-2021-20593 · Other software · Mitsubishi · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.1
Incorrect Implementation of Authentication Algorithm in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.2.50 to Ver. 3.35, GB-50A Ver.2.50 to Ver. 3.35, AG-150A-A Ver.3.20 and prior, AG-150A-J Ver.3.20 and prior, GB-50ADA-A Ver.3.20 and prior, GB-50ADA-J Ver.3.20 and prior, EB-50GU-A Ver 7.09 and prior, EB-50GU-J Ver 7.09 and prior, AE-200A Ver 7.93 and prior, AE-200E Ver 7.93 and prior, AE-50A Ver 7.93 and prior, AE-50E Ver 7.93 and prior, EW-50A Ver 7.93 and prior, EW-50E Ver 7.93 and prior, TE-200A Ver 7.93 and prior, TE-50A Ver 7.93 and prior, TW-50A Ver 7.93 and prior, CMS-RMD-J Ver.1.30 and prior) and Air Conditioning System/Expansion Controllers (PAC-YG50ECA Ver.2.20 and prior) allows a remote authenticated attacker to impersonate administrators to disclose configuration information of the air conditioning system and tamper information (e.g. operation information and configuration of air conditioning system) by exploiting this vulnerability.
- Product
- G-50a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmitsubishielectric.com
Jul 13, 2021Improper Restriction of XML External Entity Reference vulnerability in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.3.35 and pCVE-2021-20595 · Other software · Mitsubishi · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 8.2
Improper Restriction of XML External Entity Reference vulnerability in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.3.35 and prior, GB-50A Ver.3.35 and prior, GB-24A Ver.9.11 and prior, AG-150A-A Ver.3.20 and prior, AG-150A-J Ver.3.20 and prior, GB-50ADA-A Ver.3.20 and prior, GB-50ADA-J Ver.3.20 and prior, EB-50GU-A Ver 7.09 and prior, EB-50GU-J Ver 7.09 and prior, AE-200A Ver 7.93 and prior, AE-200E Ver 7.93 and prior, AE-50A Ver 7.93 and prior, AE-50E Ver 7.93 and prior, EW-50A Ver 7.93 and prior, EW-50E Ver 7.93 and prior, TE-200A Ver 7.93 and prior, TE-50A Ver 7.93 and prior, TW-50A Ver 7.93 and prior, CMS-RMD-J Ver.1.30 and prior), Air Conditioning System/Expansion Controllers (PAC-YG50ECA Ver.2.20 and prior) and Air Conditioning System/BM adapter(BAC-HD150 Ver.2.21 and prior) allows a remote unauthenticated attacker to disclose some of data in the air conditioning system or cause a DoS condition by sending specially crafted packets.
- Product
- G-50a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmitsubishielectric.com
Jul 13, 2021Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition.CVE-2020-28400 · Other software · Siemens · reported by productcert@siemens.comHigh 8.7
Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition. The vulnerability can be triggered if a large amount of DCP reset packets are sent to the device.
- Product
- Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jul 9, 2021Incorrect Access Control vulnerability in PbootCMS 2.0.6 via the list parameter in the update function in upgradecontroller.php.CVE-2020-22535 · Other software · Pbootcms · reported by MITREMedium 6.5
Incorrect Access Control vulnerability in PbootCMS 2.0.6 via the list parameter in the update function in upgradecontroller.php.
- Product
- Pbootcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2021An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.CVE-2021-33221 · Other software · Commscope · reported by MITRECritical 9.8
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Unauthenticated API Endpoints.
- Product
- Ruckus IOT Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgkorelogic.com
Jul 7, 2021An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.CVE-2021-33220 · Other software · Commscope · reported by MITREHigh 7.8
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. Hard-coded API Keys exist.
- Product
- Ruckus IOT Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgkorelogic.com
Jul 7, 2021An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.CVE-2021-33219 · Other software · Commscope · reported by MITRECritical 9.8
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded Web Application Administrator Passwords for the admin and nplus1user accounts.
- Product
- Ruckus IOT Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comseclists.org
Jul 7, 2021An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.CVE-2021-33218 · Other software · Commscope · reported by MITRECritical 9.8
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded System Passwords that provide shell access.
- Product
- Ruckus IOT Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comseclists.org
Jul 7, 2021An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.CVE-2021-33217 · Other software · Commscope · reported by MITREHigh 8.8
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The Web Application allows Arbitrary Read/Write actions by authenticated users. The API allows an HTTP POST of arbitrary content into any file on the filesystem as root.
- Product
- Ruckus IOT Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgkorelogic.com
Jul 7, 2021An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.CVE-2021-33216 · Other software · Commscope · reported by MITRECritical 9.8
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An Undocumented Backdoor exists, allowing shell access via a developer account.
- Product
- Ruckus IOT Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgkorelogic.com
Jul 7, 2021An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.CVE-2021-33215 · Other software · Commscope · reported by MITREMedium 4.3
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The API allows Directory Traversal.
- Product
- Ruckus IOT Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgkorelogic.com
Jul 1, 2021Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level CVE-2021-27661 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 8.8
Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the controller’s file system, allowing them to access or modify system files by sending specifically crafted web messages to the F4-SNC.
- Product
- Facility Explorer SNC Series Supervisory Controllers (F4-SNC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govjohnsoncontrols.com
Jun 28, 2021Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2) description parameters in application/controllers/admin/PermissiontemplatCVE-2020-22607 · Other software · Limesurvey · reported by MITREMedium 6.1
Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2) description parameters in application/controllers/admin/PermissiontemplatesController.php.
- Product
- Limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2021Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability.CVE-2021-33541 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 7.5
Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability. The communication protocols and device access do not feature authentication measures. Remote attackers can use specially crafted IP packets to cause a denial of service on the PLC's network communication module. A successful attack stops all network communication. To restore the network connectivity the device needs to be restarted. The automation task is not affected.
- Product
- ILC1x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Jun 24, 2021In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php.CVE-2020-21786 · Other software · Ibos · reported by MITRECritical 9.8
In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2021In onActivityResult of EditUserPhotoController.java, there is a possible access of unauthorized files due to an unexpected URI handler.CVE-2021-0481 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onActivityResult of EditUserPhotoController.java, there is a possible access of unauthorized files due to an unexpected URI handler. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-172939189
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 11, 2021In notifyScreenshotError of ScreenshotNotificationsController.java, there is a possible permission bypass due to an unsafe PendingIntent.CVE-2021-0477 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In notifyScreenshotError of ScreenshotNotificationsController.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-178189250
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 11, 2021In shouldLockKeyguard of LockTaskController.java, there is a possible way to exit App Pinning without a PIN due to a permissions bypass.CVE-2021-0472 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In shouldLockKeyguard of LockTaskController.java, there is a possible way to exit App Pinning without a PIN due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-9 Android-10Android ID: A-176801033
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 11, 2021Improper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator to alter the configuration of Controllers and other hardware iCVE-2021-23205 · Other software · Gallagher · reported by disclosures@gallagher.comHigh 8.1
Improper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator to alter the configuration of Controllers and other hardware items beyond their privilege. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 (MR3); 8.30 versions prior to 8.30.1359 (MR3); 8.20 versions prior to 8.20.1259 (MR5); version 8.10 and prior versions.
- Product
- Command Centre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.comsecurity.gallagher.com
Jun 11, 2021E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remCVE-2021-26996 · Other software · Netapp · reported by security-alert@netapp.comHigh 7.5
E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to discover system configuration and application information which may aid in crafting more complex attacks.
- Product
- E-series Santricity OS Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsecurity.netapp.com
Jun 11, 2021E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow priviCVE-2021-26995 · Other software · Netapp · reported by security-alert@netapp.comHigh 8.8
E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow privileged attackers to execute arbitrary code.
- Product
- E-series Santricity OS Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsecurity.netapp.com
Jun 11, 2021E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remCVE-2021-26993 · Other software · Netapp · reported by security-alert@netapp.comMedium 5.3
E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to cause a partial Denial of Service (DoS) to the web server.
- Product
- E-series Santricity OS Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsecurity.netapp.com
Jun 11, 2021E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remCVE-2021-26997 · Other software · Netapp · reported by security-alert@netapp.comMedium 6.5
E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to discover information via error messaging which may aid in crafting more complex attacks.
- Product
- E-series Santricity OS Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsecurity.netapp.com
Jun 9, 2021Improper initialization in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenCVE-2020-24475 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper initialization in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Buffer overflow in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenticated CVE-2020-24474 · Other software · Intel · reported by secure@intel.comHigh 8
Buffer overflow in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenticated user to potentially enable escalation of privilege via adjacent access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Out of bounds write in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenticaCVE-2020-24473 · Other software · Intel · reported by secure@intel.comHigh 7.8
Out of bounds write in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Baseboard Management Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.