Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

547new WordPress flaws this week

391,964entries in the database

3,620 results · page 42 of 73

Sep 30, 2019A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to CVE-2019-16414 · Other software · GFI · reported by MITREMedium 6.1
A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI.
Product
Kerio Control
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Sep 27, 2019When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog.CVE-2019-11733 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. This vulnerability affects Firefox < 68.0.2 and Firefox ESR < 68.0.2.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Sep 22, 2019Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /LoginAdmin URI.CVE-2019-16702 · Other software · Integard Pro Project · reported by MITRECritical 9.8
Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /LoginAdmin URI.
Product
Integard Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Sep 20, 2019On DrayTek Vigor2925 devices with firmware 3.8.4.3, Incorrect Access Control exists in loginset.htm, and can be used to trigger XSS.CVE-2019-16533 · Network & remote access · Draytek · reported by MITREMedium 6.1
On DrayTek Vigor2925 devices with firmware 3.8.4.3, Incorrect Access Control exists in loginset.htm, and can be used to trigger XSS. NOTE: this is an end-of-life product.
Product
Vigor2925 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record draytek.com facebook.com
Sep 18, 2019Some Dahua products have the problem of denial of service during the login process.CVE-2019-9678 · Network & remote access · Dahua Technology · reported by cybersecurity@dahuatech.comHigh 7.5
Some Dahua products have the problem of denial of service during the login process. An attacker can cause a device crashed by constructing a malicious packet. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18, 2019.
Product
IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dahuasecurity.com dahuasecurity.com
Sep 17, 2019SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.CVE-2019-16392 · Other software · Spip · reported by MITREMedium 6.1
SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.
Product
Spip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.spip.net git.spip.net
Sep 16, 2019The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.CVE-2016-10971 · WordPress plugins & themes · reported by MITRECritical 9.8
The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.
Product
MemberSonic Lite
Fixed in
1.302
What to do
Update MemberSonic Lite to 1.302 or newer.
Full record and what to do →NVD record pritect.net pritect.net
Sep 14, 2019A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetingCheck.jsp in Fuji Xerox DocuShare througCVE-2019-16307 · Other software · Fujixerox · reported by MITREMedium 6.1
A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetingCheck.jsp in Fuji Xerox DocuShare through 7.0.0.C1.609 allows remote attackers to inject arbitrary web script or HTML via the handle parameter (webExMeetingLogin.jsp) and meetingKey parameter (deleteWebExMeetingCheck.jsp).
Product
Docushare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 14, 2019FlameCMS 3.3.5 has SQL injection in account/login.php via accountName.CVE-2019-16309 · Other software · Flamecms Project · reported by MITRECritical 9.8
FlameCMS 3.3.5 has SQL injection in account/login.php via accountName.
Product
Flamecms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record iwantacve.cn iwantacve.cn
Sep 13, 2019The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST CVE-2010-5333 · Other software · Integard Home Project · reported by MITRECritical 9.8
The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST request, leading to arbitrary code execution. An SEH-overwrite buffer overflow already existed for the vulnerable software. This CVE is to track an alternate exploitation method, utilizing an EIP-overwrite buffer overflow.
Product
Integard Home
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 12, 2019Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login.CVE-2019-16238 · Other software · Afterlogic · reported by MITREMedium 6.1
Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login.
Product
Aurora
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sevenlayers.com sevenlayers.com
Sep 9, 2019Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used.CVE-2019-16180 · Other software · Limesurvey · reported by MITREMedium 5.3
Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used.
Product
Limesurvey
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com limesurvey.org
Sep 9, 2019Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component.CVE-2019-12405 · Websites & servers · Apache · reported by security@apache.orgCritical 9.8
Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. Given a username for a user that can be authenticated via LDAP, it is possible to improperly authenticate as that user without that user's correct password.
Product
Traffic Control
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Sep 3, 2019Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page.CVE-2019-15898 · Other software · Nagios · reported by MITREMedium 6.1
Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page.
Product
LOG Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com nagios.com
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.CVE-2019-15872 · WordPress plugins & themes · reported by MITRECritical 9.8
The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.
Product
LoginPress
Fixed in
1.1.4
What to do
Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD record wordpress.org webarxsecurity.com
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.CVE-2019-15871 · WordPress plugins & themes · reported by MITREMedium 4.3
The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.
Product
LoginPress
Fixed in
1.1.4
What to do
Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD record wordpress.org webarxsecurity.com
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.CVE-2019-15826 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.
Product
wps-hide-login
Fixed in
1.5.3
What to do
Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD record secupress.me wordpress.org
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.CVE-2019-15825 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.
Product
wps-hide-login
Fixed in
1.5.3
What to do
Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD record secupress.me wordpress.org
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.CVE-2019-15824 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.
Product
wps-hide-login
Fixed in
1.5.3
What to do
Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD record secupress.me wordpress.org
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.CVE-2019-15823 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.
Product
wps-hide-login
Fixed in
1.5.3
What to do
Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD record secupress.me wordpress.org
Aug 30, 2019The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.CVE-2019-15820 · WordPress plugins & themes · reported by MITREMedium 6.1
The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.
Product
login-or-logout-menu-item
Fixed in
1.2.0
What to do
Update login-or-logout-menu-item to 1.2.0 or newer.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Aug 27, 2019In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.CVE-2019-13235 · Other software · Alkacon · reported by MITREMedium 6.1
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.
Product
Opencms Apollo Template
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com aetsu.github.io
Aug 22, 2019The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.CVE-2016-10928 · WordPress plugins & themes · reported by MITREHigh 7.5
The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
Product
onelogin-saml-sso
Fixed in
2.2.0
What to do
Update onelogin-saml-sso to 2.2.0 or newer.
Full record and what to do →NVD record github.com wordpress.org
Aug 22, 2019The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.CVE-2016-10925 · WordPress plugins & themes · reported by MITREMedium 6.1
The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.
Product
peters-login-redirect
Fixed in
2.9.1
What to do
Update peters-login-redirect to 2.9.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.CVE-2017-18573 · WordPress plugins & themes · reported by MITRECritical 9.8
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
Product
simple-login-log
Fixed in
1.1.2
What to do
Update simple-login-log to 1.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The clean-login plugin before 1.5.1 for WordPress has reflected XSS.CVE-2015-9336 · WordPress plugins & themes · reported by MITREMedium 6.1
The clean-login plugin before 1.5.1 for WordPress has reflected XSS.
Product
clean-login
Fixed in
1.5.1
What to do
Update clean-login to 1.5.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comparing response timesCVE-2019-13599 · Other software · Control-webpanel · reported by MITREMedium 5.3
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comparing response times.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 16, 2019The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.CVE-2019-15115 · WordPress plugins & themes · reported by MITREHigh 8.8
The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.
Product
peters-login-redirect
Fixed in
2.9.2
What to do
Update peters-login-redirect to 2.9.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.CVE-2015-9322 · WordPress plugins & themes · reported by MITREHigh 8.8
The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.
Product
erident-custom-login-and-dashboard
Fixed in
3.5
What to do
Update erident-custom-login-and-dashboard to 3.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and InCVE-2019-15081 · Other software · Opencart · reported by MITREMedium 4.8
OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages.
Product
Opencart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Aug 14, 2019An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session.CVE-2019-1172 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An attacker who successfully exploited the vulnerability could take over a user's account. To exploit the vulnerability, an attacker would have to trick a user into browsing to a specially crafted website, allowing the attacker to steal the user's token. The security update addresses the vulnerability by correcting how MSA handles cookies.
Product
Windows 10 Version 1703
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Aug 14, 2019eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login.CVE-2019-9583 · Other software · Eq-3 · reported by MITREHigh 8.2
eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login. This allows a Denial of Service and is a starting point for other attacks. Affected versions for CCU2: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15. Affected versions for CCU3: 3.41.11, 3.43.16, 3.45.5, 3.45.7, 3.47.10, 3.47.15.
Product
Homematic Ccu3 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com psytester.github.io
Aug 14, 2019The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.CVE-2017-18514 · WordPress plugins & themes · reported by MITRECritical 9.8
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
Product
simple-login-log
Fixed in
1.1.2
What to do
Update simple-login-log to 1.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usernames via an informatCVE-2019-8448 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.3
The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usernames via an information disclosure vulnerability.
Product
Jira
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Aug 12, 2019The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.CVE-2017-18501 · WordPress plugins & themes · reported by MITREMedium 6.1
The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.
Product
social-login-bws
Fixed in
0.2
What to do
Update social-login-bws to 0.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.CVE-2016-10872 · WordPress plugins & themes · reported by MITREMedium 6.1
The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.
Product
ultimate-member
Fixed in
1.3.40
What to do
Update ultimate-member to 1.3.40 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 9, 2019Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter.CVE-2017-18486 · Other software · Jitbit · reported by MITREHigh 7.2
Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote authentication. The shared secret can be used to escalate privileges by forging new tokens for any user. These tokens can be used to automatically log in as the affected user.
Product
Helpdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com packetstormsecurity.com
Aug 7, 2019YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.CVE-2019-14537 · Other software · Yourls · reported by MITRECritical 9.8
YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.
Product
Yourls
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 6, 2019cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559).CVE-2016-10791 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446).CVE-2018-20881 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 16, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowCVE-2019-13605 · Other software · Control-webpanel · reported by MITREHigh 8.8
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid username. The attacker must defeat an encoding that is not equivalent to base64, and thus this is different from CVE-2019-13360.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jul 16, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP responsCVE-2019-13383 · Other software · Control-webpanel · reported by MITREMedium 5.3
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP response.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jul 16, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid CVE-2019-13360 · Other software · Control-webpanel · reported by MITRECritical 9.8
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid username.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jul 11, 2019Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version CVE-2019-9886 · Other software · BroadLearning · reported by twcert@cert.org.twHigh 7.5
Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1.
Product
eclass
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record surl.twcert.org.tw tvn.twcert.org.tw
Jul 10, 2019Nagios XI before 5.5.4 has XSS in the auto login admin management page.CVE-2018-17147 · Other software · Nagios · reported by MITREMedium 4.8
Nagios XI before 5.5.4 has XSS in the auto login admin management page.
Product
Nagios XI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com assets.nagios.com
Jul 10, 2019On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achieved by continuing to CVE-2019-10120 · Other software · Eq-3 · reported by MITREHigh 8.8
On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achieved by continuing to use a session ID after a logout, aka HMCCU-154.
Product
Ccu3 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record eq-3.de eq-3.de
Jul 5, 2019Digisol Wireless Wifi Home Router HR-3300 allows XSS via the userid or password parameter to the admin login page.CVE-2018-14027 · Other software · Digisol · reported by MITREMedium 6.1
Digisol Wireless Wifi Home Router HR-3300 allows XSS via the userid or password parameter to the admin login page.
Product
Dg-hr-3300 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record indiancybersecuritysolutions.com indiancybersecuritysolutions.com
Jul 3, 2019BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, loginCVE-2019-10721 · Other software · Dotnetblogengine · reported by MITREMedium 6.1
BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, login.aspx, and register.aspx.
Product
Blogengine.net
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com securitymetrics.com
Jun 30, 2019Arastta eCommerce 1.6.2 is vulnerable to XSS via the PATH_INFO to the login/ URI.CVE-2018-20849 · Websites & servers · Arastta · reported by MITREMedium 6.1
Arastta eCommerce 1.6.2 is vulnerable to XSS via the PATH_INFO to the login/ URI.
Product
Ecommerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jun 30, 2019core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrf_cCVE-2019-13086 · Other software · Cszcms · reported by MITRECritical 9.8
core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrf_csz parameter.
Product
CSZ CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.