Updated 29 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

578new WordPress flaws this week

391,397entries in the database

2,600 results · page 42 of 52

Jul 24, 2007Multiple unspecified vulnerabilities in IBM WebSphere Application Server (WAS) before Fix Pack 21 (6.0.2.21) have unknown impact and attack vectors, aka (1) PK3CVE-2007-3960 · Other software · IBM · reported by MITREHigh 9.3
Multiple unspecified vulnerabilities in IBM WebSphere Application Server (WAS) before Fix Pack 21 (6.0.2.21) have unknown impact and attack vectors, aka (1) PK33799, or (2) a "Potential security exposure" in the Samples component (PK40213).
Product
Websphere Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org osvdb.org
Jul 18, 2007Multiple unspecified vulnerabilities in Oracle Database 10.2.0.3 allow remote authenticated users to have an unknown impact via (1) EXFSYS.DBMS_RLMGR_UTL in RulCVE-2007-3858 · Other software · Oracle · reported by MITREHigh 7.5
Multiple unspecified vulnerabilities in Oracle Database 10.2.0.3 allow remote authenticated users to have an unknown impact via (1) EXFSYS.DBMS_RLMGR_UTL in Rules Manager (DB11) and (2) Program Interface (DB13).
Product
Database Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20000.www2.hp.com secunia.com
Jul 18, 2007Multiple unspecified vulnerabilities in Oracle Collaboration Suite 10.1.2 have unknown impact and remote attack vectors via (1) Instant Messaging/Presence (OCS0CVE-2007-3864 · Other software · Oracle · reported by MITREHigh 7.5
Multiple unspecified vulnerabilities in Oracle Collaboration Suite 10.1.2 have unknown impact and remote attack vectors via (1) Instant Messaging/Presence (OCS01) and (2) Oracle Single Sign On (AS02).
Product
Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20000.www2.hp.com secunia.com
Jul 18, 2007Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10CU2 and 12.0.1 allow remote attackers to have an unknown impact via (a) Oracle ConfiguratCVE-2007-3866 · Other software · Oracle · reported by MITREHigh 7.5
Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10CU2 and 12.0.1 allow remote attackers to have an unknown impact via (a) Oracle Configurator (APPS02), (b) Oracle iExpenses (APPS03), (c) Oracle Application Object Library (APPS09), and (1) APPS12, (2) APPS13, and (3) APPS14 in (d) Oracle Payables.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20000.www2.hp.com secunia.com
Jul 18, 2007Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10CU2 have unknown impact and attack vectors, related to (1) APPS04, (2) APPS05, and (3) APCVE-2007-3867 · Other software · Oracle · reported by MITREHigh 7.5
Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10CU2 have unknown impact and attack vectors, related to (1) APPS04, (2) APPS05, and (3) APPS06 in (a) Oracle Application Object Library, (4) APPS07 in Oracle Customer Intelligence, (5) APPS08 in Oracle Payments, (7) APPS10 in Oracle Human Resources, and (8) APPS11 in iRecruitment.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20000.www2.hp.com secunia.com
Jul 18, 2007Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 and 10.2.0.3 allow remote authenticated users to have unknown impact via (1) DBMS_JAVA_TEST in CVE-2007-3853 · Other software · Oracle · reported by MITREMedium 6.5
Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 and 10.2.0.3 allow remote authenticated users to have unknown impact via (1) DBMS_JAVA_TEST in the JavaVM component (DB01), (2) Oracle Text component (DB09), and (3) MDSYS.SDO_GEOR_INT in the Spatial component (DB15). NOTE: a reliable researcher claims that DB01 is SQL injection in DBMS_PRVTAQIS.
Product
Database Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20000.www2.hp.com secunia.com
Jul 18, 2007Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMSCVE-2007-3854 · Other software · Oracle · reported by MITREMedium 5.5
Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the Advanced Queuing component (DB02) and (2) MDSYS.MD in the Spatial component (DB12). NOTE: Oracle has not disputed reliable researcher claims that DB02 is for SQL injection and DB12 is for a buffer overflow.
Product
Apex
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20000.www2.hp.com secunia.com
Jul 18, 2007Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 allow remote authenticated users to have an unknown impact via (a) the Oracle Text component, iCVE-2007-3857 · Other software · Oracle · reported by MITREMedium 6.5
Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 allow remote authenticated users to have an unknown impact via (a) the Oracle Text component, including (1) unspecified vectors (DB05), (2) CTXSYS.DRVXMD (DB06), (3) CTXSYS.DRI_MOVE_CTXSYS (DB07), (4) CTXSYS.DRVXMD (DB08), and (b) JavaVM (DB14).
Product
Database Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20000.www2.hp.com secunia.com
Jul 18, 2007Unspecified vulnerability in the Oracle Customer Intelligence component in Oracle E-Business Suite 12.0.1 has unknown impact and remote attack vectors, aka APPSCVE-2007-3865 · Other software · Oracle · reported by MITREHigh 7.5
Unspecified vulnerability in the Oracle Customer Intelligence component in Oracle E-Business Suite 12.0.1 has unknown impact and remote attack vectors, aka APPS01.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20000.www2.hp.com secunia.com
Jul 18, 2007Unspecified vulnerability in Oracle Application Express (formerly Oracle HTML DB) 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via CVE-2007-3860 · Other software · Oracle · reported by MITREHigh 7.5
Unspecified vulnerability in Oracle Application Express (formerly Oracle HTML DB) 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01. NOTE: a reliable researcher states that this is SQL injection in the wwv_flow_security.check_db_password function due to insufficient checks for '"' characters.
Product
Apex
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20000.www2.hp.com secunia.com
Jul 18, 2007Unspecified vulnerability in Oracle Application Server 9.0.4.3 and 10.1.2.0.2 allows remote attackers to have an unknown impact via Oracle Single Sign On, aka ACVE-2007-3862 · Other software · Oracle · reported by MITREHigh 7.5
Unspecified vulnerability in Oracle Application Server 9.0.4.3 and 10.1.2.0.2 allows remote attackers to have an unknown impact via Oracle Single Sign On, aka AS01.
Product
Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20000.www2.hp.com secunia.com
Jul 12, 2007Multiple unspecified vulnerabilities in Webmatic before 2.7 have unknown impact and attack vectors, related to the "administration area."CVE-2007-3727 · Other software · Valarsoft · reported by MITREHigh 7.5
Multiple unspecified vulnerabilities in Webmatic before 2.7 have unknown impact and attack vectors, related to the "administration area."
Product
Webmatic
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jul 12, 2007Multiple unspecified vulnerabilities in the SVG parsing engine in Apple Safari 3 Beta for Windows have unspecified remote attack vectors and impact.CVE-2007-3718 · Computers, phones & browsers · Apple · reported by MITREHigh 7.5
Multiple unspecified vulnerabilities in the SVG parsing engine in Apple Safari 3 Beta for Windows have unspecified remote attack vectors and impact. NOTE: this issue contains no actionable information, but it was released by a reliable researcher.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org security-protocols.com
Jul 11, 2007The _sanitize_globals function in CodeIgniter 1.5.3 before 20070628 allows remote attackers to unset arbitrary global variables with unspecified impact, as demoCVE-2007-3706 · Other software · Codeigniter · reported by MITRELow 2.1
The _sanitize_globals function in CodeIgniter 1.5.3 before 20070628 allows remote attackers to unset arbitrary global variables with unspecified impact, as demonstrated by a _SERVER cookie.
Product
Codeigniter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.grok.org.uk osvdb.org
Jul 10, 2007Unspecified vulnerability in the kernel in Microsoft Windows Vista has unspecified remote attack vectors and impact, as shown in the "0day IPO" presentation at CVE-2007-3671 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.8
Unspecified vulnerability in the kernel in Microsoft Windows Vista has unspecified remote attack vectors and impact, as shown in the "0day IPO" presentation at SyScan'07.
Product
Windows Vista
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blogs.zdnet.com osvdb.org
Jul 10, 2007Multiple unspecified vulnerabilities in the Innovasys DockStudioXP InnovaDSXP2.OCX ActiveX Control have unspecified attack vectors and impact, including a deniaCVE-2007-3669 · Other software · Innovasys · reported by MITREMedium 4.3
Multiple unspecified vulnerabilities in the Innovasys DockStudioXP InnovaDSXP2.OCX ActiveX Control have unspecified attack vectors and impact, including a denial of service via "improper use" of the SaveToFile function.
Product
Dockstudioxp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org securityfocus.com
Jul 6, 2007inc/vul_check.inc in phpVideoPro before 0.8.8 permits non-alphanumeric characters in the sess_id parameter, which has unknown impact and remote attack vectors, CVE-2007-3596 · Other software · Izzysoft · reported by MITREMedium 4.3
inc/vul_check.inc in phpVideoPro before 0.8.8 permits non-alphanumeric characters in the sess_id parameter, which has unknown impact and remote attack vectors, probably cross-site scripting (XSS).
Product
Phpvideopro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org phpvideopro.cvs.sourceforge.net
Jul 4, 2007Multiple unspecified vulnerabilities in Esqlanelapse before 2.6 have unknown impact and attack vectors.CVE-2007-3560 · Other software · Esqlanelapse · reported by MITREHigh 7.5
Multiple unspecified vulnerabilities in Esqlanelapse before 2.6 have unknown impact and attack vectors.
Product
Esqlanelapse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jun 29, 2007Multiple buffer overflows in Firebird 1.5, one of which affects WNET, have unknown impact and attack vectors.CVE-2006-7212 · Other software · Firebirdsql · reported by MITREMedium 6.8
Multiple buffer overflows in Firebird 1.5, one of which affects WNET, have unknown impact and attack vectors. NOTE: this issue might overlap CVE-2006-1240.
Product
Firebird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com debian.org
Jun 29, 2007Unspecified vulnerability in Microsoft Excel 2003 SP2 allows remote attackers to have an unknown impact via unspecified vectors, possibly related to the sheet nCVE-2007-3490 · Email & office · Microsoft · reported by MITREHigh 7.5
Unspecified vulnerability in Microsoft Excel 2003 SP2 allows remote attackers to have an unknown impact via unspecified vectors, possibly related to the sheet name, as demonstrated by 2670.xls.
Product
Excel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org pstgroup.blogspot.com
Jun 29, 2007Buffer overflow in _mprosrv in Progress Software OpenEdge before 9.1E0422, and 10.x before 10.1B01, allows remote attackers to have an unknown impact via a malfCVE-2007-3491 · Other software · Progress · reported by MITREHigh 7.5
Buffer overflow in _mprosrv in Progress Software OpenEdge before 9.1E0422, and 10.x before 10.1B01, allows remote attackers to have an unknown impact via a malformed TCP/IP message.
Product
Openedge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jun 28, 2007Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 have unspecified impact and user-assisted remote attack CVE-2007-3474 · Other software · Libgd · reported by MITRELow 2.6
Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 have unspecified impact and user-assisted remote attack vectors.
Product
GD Graphics Library
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ftp.slackware.com fedoranews.org
Jun 26, 2007Multiple unspecified vulnerabilities in phpTrafficA before 1.4.2 allow remote attackers to have an unknown impact via the file parameter to (1) plotStatBar.php CVE-2007-3428 · Other software · Zoneo-soft · reported by MITREHigh 7.5
Multiple unspecified vulnerabilities in phpTrafficA before 1.4.2 allow remote attackers to have an unknown impact via the file parameter to (1) plotStatBar.php or (2) plotStatPie.php, different vectors than CVE-2007-1076.
Product
Phptraffica
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org osvdb.org
Jun 26, 2007Multiple unspecified vulnerabilities in Dia before 0.96.1-6 have unspecified attack vectors and impact, probably involving the use of vulnerable FreeType librarCVE-2007-3408 · Other software · DIA · reported by MITREHigh 7.5
Multiple unspecified vulnerabilities in Dia before 0.96.1-6 have unspecified attack vectors and impact, probably involving the use of vulnerable FreeType libraries that contain CVE-2007-2754 and/or CVE-2007-1351.
Product
DIA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com sourceforge.net
Jun 22, 2007Buffer overflow in ageet AGEphone before 1.4.0 might allow remote attackers to have an unknown impact via unspecified vectors.CVE-2006-7207 · Other software · Ageet · reported by MITREHigh 10
Buffer overflow in ageet AGEphone before 1.4.0 might allow remote attackers to have an unknown impact via unspecified vectors.
Product
Agephone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ageet.com ageet.com
Jun 22, 2007Multiple unspecified vulnerabilities in ageet AGEphone before 1.6.3 allow remote attackers to have an unknown impact via malformed SIP packets.CVE-2007-3363 · Other software · Ageet · reported by MITREHigh 10
Multiple unspecified vulnerabilities in ageet AGEphone before 1.6.3 allow remote attackers to have an unknown impact via malformed SIP packets.
Product
Agephone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jun 19, 2007Unspecified vulnerability in the Default Messaging Component in IBM WebSphere Application Server (WAS) 6.1.0.7 and earlier has unknown impact and attack vectorsCVE-2007-3263 · Other software · IBM · reported by MITREHigh 10
Unspecified vulnerability in the Default Messaging Component in IBM WebSphere Application Server (WAS) 6.1.0.7 and earlier has unknown impact and attack vectors, related to "incorrect authorization on a remote interface to the SDO repository."
Product
Websphere Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jun 19, 2007Unspecified vulnerability in the PD tools component in IBM WebSphere Application Server (WAS) 6.1.0.7 and earlier has unknown impact and attack vectors.CVE-2007-3264 · Other software · IBM · reported by MITREHigh 10
Unspecified vulnerability in the PD tools component in IBM WebSphere Application Server (WAS) 6.1.0.7 and earlier has unknown impact and attack vectors.
Product
Websphere Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jun 14, 2007Buffer overflow in MeCab before 0.96 has unknown impact and attack vectors.CVE-2007-3231 · Other software · Mecab · reported by MITREHigh 7.5
Buffer overflow in MeCab before 0.96 has unknown impact and attack vectors.
Product
Mecab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record internap.dl.sourceforge.net osvdb.org
Jun 11, 2007Unspecified vulnerability in eGroupWare before 1.2.107-2 has unknown impact and attack vectors related to ADOdb.CVE-2007-3155 · Other software · Egroupware · reported by MITREHigh 10
Unspecified vulnerability in eGroupWare before 1.2.107-2 has unknown impact and attack vectors related to ADOdb. NOTE: due to lack of details from the vendor, it is uncertain whether this issue is already covered by another CVE identifier.
Product
Egroupware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jun 7, 2007unsp.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 does not properly calculate the end of a certain buffer, with unknown impact and remote attack vectors.CVE-2007-3023 · Other software · Clam Anti-virus · reported by MITREHigh 10
unsp.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 does not properly calculate the end of a certain buffer, with unknown impact and remote attack vectors.
Product
Clamav
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kolab.org lurker.clamav.net
Jun 4, 2007Mbedthis AppWeb before 2.2.2 enables the HTTP TRACE method, which has unspecified impact probably related to remote information leaks and cross-site tracing (XSCVE-2007-3008 · Websites & servers · Mbedthis Software · reported by MITREMedium 4.3
Mbedthis AppWeb before 2.2.2 enables the HTTP TRACE method, which has unspecified impact probably related to remote information leaks and cross-site tracing (XST) attacks, a related issue to CVE-2004-2320 and CVE-2005-3398.
Product
Mbedthis Appweb Http Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com appwebserver.org
Jun 4, 2007Unspecified vulnerability in sysmgt.websm.rte in IBM AIX 5.2.0 and 5.3.0 has unknown impact and attack vectors.CVE-2007-2995 · Other software · IBM · reported by MITREMedium 4.3
Unspecified vulnerability in sysmgt.websm.rte in IBM AIX 5.2.0 and 5.3.0 has unknown impact and attack vectors.
Product
AIX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
May 21, 2007manage-admins.php in eSyndiCat Pro 1.x allows remote attackers to create additional administrative accounts, and have other unspecified impact, via modified useCVE-2007-2785 · Other software · Esyndicat · reported by MITREMedium 6.8
manage-admins.php in eSyndiCat Pro 1.x allows remote attackers to create additional administrative accounts, and have other unspecified impact, via modified username, new_pass, new_pass2, status, super, and certain other parameters in an add action.
Product
Esyndicat Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org securityreason.com
May 17, 2007Unspecified vulnerability in xajax before 0.2.5 has unknown impact and attack vectors, not related to XSS.CVE-2007-2740 · Other software · Xajax · reported by MITREMedium 6.8
Unspecified vulnerability in xajax before 0.2.5 has unknown impact and attack vectors, not related to XSS.
Product
Xajax
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
May 16, 2007The soap extension in PHP calls php_rand_r with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcrypt_creatCVE-2007-2728 · Websites & servers · PHP · reported by MITREMedium 5
The soap extension in PHP calls php_rand_r with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcrypt_create_iv issue covered by CVE-2007-2727. Note: The PHP team argue that this is not a valid security issue.
Product
PHP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.php-security.org osvdb.org
May 16, 2007Unspecified vulnerability in MH Software Connect Daily before 3.3.3 has unknown impact and attack vectors.CVE-2007-2712 · Other software · MH Software · reported by MITREHigh 10
Unspecified vulnerability in MH Software Connect Daily before 3.3.3 has unknown impact and attack vectors.
Product
Connect Daily
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
May 16, 2007Unspecified vulnerability in akismet.php in Matt Mullenweg Akismet before 2.0.2, a WordPress plugin, has unknown impact and attack vectors.CVE-2007-2714 · WordPress plugins & themes · reported by MITREHigh 10
Unspecified vulnerability in akismet.php in Matt Mullenweg Akismet before 2.0.2, a WordPress plugin, has unknown impact and attack vectors.
Fixed in
2.0.2
What to do
Update the plugin to 2.0.2 or newer.
Full record and what to do →NVD record lists.grok.org.uk michaeldaw.org
May 14, 2007Unspecified vulnerability in NetWin Webmail 3.1s-1 in SurgeMail before 3.8i2 has unknown impact and remote attack vectors, possibly a format string vulnerabilitCVE-2007-2655 · Other software · Netwin · reported by MITREHigh 7.5
Unspecified vulnerability in NetWin Webmail 3.1s-1 in SurgeMail before 3.8i2 has unknown impact and remote attack vectors, possibly a format string vulnerability that allows remote code execution.
Product
Surgemail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
May 13, 2007Unspecified vulnerability in phpTodo before 0.8.1 allows remote attackers to have an unknown impact via newlines in regular expressions to (1) index.php, (2) feCVE-2007-2636 · Other software · Jason Frisvold · reported by MITREMedium 6.8
Unspecified vulnerability in phpTodo before 0.8.1 allows remote attackers to have an unknown impact via newlines in regular expressions to (1) index.php, (2) feed.php, (3) prefs.php, and (4) todolist.php; and (5) classTodoItem.php and (6) phpTodoUser.php in libs/. NOTE: some of these details are obtained from third party information.
Product
Phptodo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record phptodo.godshell.com securityfocus.com
May 11, 2007Multiple buffer overflows in Firebird 2.1 allow attackers to trigger memory corruption and possibly have other unspecified impact via certain input processed byCVE-2007-2606 · Other software · Firebirdsql · reported by MITREHigh 7.8
Multiple buffer overflows in Firebird 2.1 allow attackers to trigger memory corruption and possibly have other unspecified impact via certain input processed by (1) config\ConfigFile.cpp or (2) msgs\check_msgs.epp. NOTE: if ConfigFile.cpp reads a configuration file with restrictive permissions, then the ConfigFile.cpp vector may not cross privilege boundaries and perhaps should not be included in CVE.
Product
Firebird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org osvdb.org
May 9, 2007Unspecified vulnerability in search/list/action_search/index.php in ACP3 4.0 beta 3 allows remote attackers to have unknown impact, relating to "Cookie ManipulaCVE-2007-2578 · Other software · Acp3 · reported by MITREHigh 7.5
Unspecified vulnerability in search/list/action_search/index.php in ACP3 4.0 beta 3 allows remote attackers to have unknown impact, relating to "Cookie Manipulation", via the form[search_term] parameter.
Product
Acp3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org securityreason.com
May 9, 2007MOStlyDB Admin in Mambo 4.6.1 does not properly check privileges, which allows remote authenticated administrators to have an unknown impact via unspecified vecCVE-2007-2557 · Other software · Mambo · reported by MITREMedium 4
MOStlyDB Admin in Mambo 4.6.1 does not properly check privileges, which allows remote authenticated administrators to have an unknown impact via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Mambo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
May 9, 2007Unspecified vulnerability in Default.aspx in Podium CMS allows remote attackers to have an unknown impact, possibly session fixation, via a META HTTP-EQUIV Set-CVE-2007-2555 · Other software · Podium CMS · reported by MITREMedium 4.3
Unspecified vulnerability in Default.aspx in Podium CMS allows remote attackers to have an unknown impact, possibly session fixation, via a META HTTP-EQUIV Set-cookie expression in the id parameter, related to "cookie manipulation." NOTE: this issue might be cross-site scripting (XSS).
Product
Podium CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org securityreason.com
May 9, 2007Unspecified vulnerability in index.php in TurnkeyWebTools SunShop Shopping Cart 4.0 has unknown impact and an l remote attack vector, related to "Cookie ManipulCVE-2007-2548 · Other software · Turnkey Web Tools · reported by MITREMedium 6.4
Unspecified vulnerability in index.php in TurnkeyWebTools SunShop Shopping Cart 4.0 has unknown impact and an l remote attack vector, related to "Cookie Manipulation."
Product
Sunshop Shopping Cart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org securityreason.com
May 8, 2007Buffer overflow in the bundled libxmlrpc library in PHP before 4.4.7, and 5.x before 5.2.2, has unknown impact and remote attack vectors.CVE-2007-1864 · Websites & servers · PHP · reported by Red HatHigh 7.5
Buffer overflow in the bundled libxmlrpc library in PHP before 4.4.7, and 5.x before 5.2.2, has unknown impact and remote attack vectors.
Product
PHP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org osvdb.org
May 8, 2007Buffer overflow in the make_http_soap_request function in PHP before 5.2.2 has unknown impact and remote attack vectors, possibly related to "/" (slash) charactCVE-2007-2510 · Websites & servers · PHP · reported by MITREMedium 5.1
Buffer overflow in the make_http_soap_request function in PHP before 5.2.2 has unknown impact and remote attack vectors, possibly related to "/" (slash) characters.
Product
PHP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org osvdb.org
May 8, 2007Buffer overflow in the user_filter_factory_create function in PHP before 5.2.2 has unknown impact and local attack vectors.CVE-2007-2511 · Websites & servers · PHP · reported by MITREHigh 7.2
Buffer overflow in the user_filter_factory_create function in PHP before 5.2.2 has unknown impact and local attack vectors.
Product
PHP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org osvdb.org
May 2, 2007Unspecified vulnerability in Novell SecureLogin (NSL) 6 SP1 before 6.0.106 has unknown impact and remote attack vectors, related to Active Directory (AD) passwoCVE-2007-2476 · Other software · Novell · reported by MITREHigh 10
Unspecified vulnerability in Novell SecureLogin (NSL) 6 SP1 before 6.0.106 has unknown impact and remote attack vectors, related to Active Directory (AD) password changes.
Product
Securelogin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
May 2, 2007Unspecified vulnerability in the ADSCHEMA utility in Novell SecureLogin (NSL) 6 SP1 before 6.0.106 has unknown impact and remote attack vectors, related to granCVE-2007-2475 · Other software · Novell · reported by MITREMedium 6.5
Unspecified vulnerability in the ADSCHEMA utility in Novell SecureLogin (NSL) 6 SP1 before 6.0.106 has unknown impact and remote attack vectors, related to granting "users excess permissions to their own attributes."
Product
Securelogin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.