Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,620 results · page 44 of 73
Feb 19, 2019The backdoor account dnsekakf2$$ in /bin/login on DASAN H665 devices with firmware 1.46p1-0028 allows an attacker to login to the admin account via TELNET.CVE-2019-8950 · Other software · Dasannetworks · reported by MITRECritical 9.8
The backdoor account dnsekakf2$$ in /bin/login on DASAN H665 devices with firmware 1.46p1-0028 allows an attacker to login to the admin account via TELNET.
- Product
- H665 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.burghardt.plseclists.org
Feb 17, 2019Hotels_Server through 2018-11-05 has SQL Injection via the API because the controller/api/login.php telephone parameter is mishandled.CVE-2019-8393 · Other software · Hotels Server Project · reported by MITRECritical 9.8
Hotels_Server through 2018-11-05 has SQL Injection via the API because the controller/api/login.php telephone parameter is mishandled.
- Product
- Hotels Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2019www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter.CVE-2019-7313 · Other software · Buildbot · reported by MITREMedium 6.1
www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain.
- Product
- Buildbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2019IBM DataPower Gateway 7.5.0.0 through 7.5.0.19, 7.5.1.0 through 7.5.1.18, 7.5.2.0 through 7.5.2.18, and 7.6.0.0 through 7.6.0.11 appliances allows "null" loginsCVE-2018-1668 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM DataPower Gateway 7.5.0.0 through 7.5.0.19, 7.5.1.0 through 7.5.1.18, 7.5.2.0 through 7.5.2.18, and 7.6.0.0 through 7.6.0.11 appliances allows "null" logins which could give read access to IPMI data to obtain sensitive information. IBM X-Force ID: 144894.
- Product
- DataPower Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 18, 2019TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, becauCVE-2019-6487 · Network & remote access · Tp-link · reported by MITREHigh 8.8
TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included in the weather get_weather_observe citycode field.
- Product
- Tl-wdr5620 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2019Vulnerability in the Oracle Argus Safety component of Oracle Health Sciences Applications (subcomponent: Login).CVE-2019-2432 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9
Vulnerability in the Oracle Argus Safety component of Oracle Health Sciences Applications (subcomponent: Login). Supported versions that are affected are 8.1 and 8.2. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Argus Safety. While the vulnerability is in Oracle Argus Safety, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Argus Safety accessible data as well as unauthorized read access to a subset of Oracle Argus Safety accessible data. CVSS 3.0 Base Score 4.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N).
- Product
- Argus Safety
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Jan 11, 2019Frog CMS 0.9.5 allows XSS via the forgot password page (aka the /admin/?/login/forgot URI).CVE-2019-6243 · Other software · Frog CMS Project · reported by MITREMedium 6.1
Frog CMS 0.9.5 allows XSS via the forgot password page (aka the /admin/?/login/forgot URI).
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsomerandomshitwbu.blogspot.comsomerandomshitwbu.blogspot.com
Jan 11, 2019Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow.CVE-2019-3803 · Other software · Pivotal · reported by security_alert@emc.comMedium 4.5
Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user.
- Product
- Concourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2019Imperva SecureSphere running v13.0, v12.0, or v11.5 allows low privileged users to add SSH login keys to the admin user, resulting in privilege escalation.CVE-2018-5413 · Other software · Imperva · reported by cret@cert.orgHigh 8.8
Imperva SecureSphere running v13.0, v12.0, or v11.5 allows low privileged users to add SSH login keys to the admin user, resulting in privilege escalation.
- Product
- SecureSphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jan 10, 2019Imperva SecureSphere gateway (GW) running v13, for both pre-First Time Login or post-First Time Login (FTL), if the attacker knows the basic authentication passCVE-2018-5403 · Other software · Imperva · reported by cret@cert.orgHigh 8.1
Imperva SecureSphere gateway (GW) running v13, for both pre-First Time Login or post-First Time Login (FTL), if the attacker knows the basic authentication passwords, the GW may be vulnerable to RCE through specially crafted requests, from the web access management interface.
- Product
- SecureSphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jan 9, 2019PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via unCVE-2018-16203 · Other software · PgPool Global Development Group · reported by vultures@jpcert.or.jpCritical 9.8
PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via unspecified vectors.
- Product
- PgpoolAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2019EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and timestamp=-1 cookies.CVE-2018-20512 · Other software · Cdatatec · reported by MITRECritical 9.8
EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and timestamp=-1 cookies.
- Product
- Epon Cpe-wifi Devices Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2018MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter.CVE-2018-20486 · Other software · Metinfo · reported by MITREMedium 6.1
MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.metinfo.cngithub.com
Dec 23, 2018Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to delete the common_member_wechatmp data structure via an ac=unbindmp request to pluCVE-2018-20424 · Other software · Comsenz · reported by MITREMedium 5.9
Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to delete the common_member_wechatmp data structure via an ac=unbindmp request to plugin.php.
- Product
- Discuzx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2018Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass a "disabled registration" setting by adding a non-existing wxopenid value tCVE-2018-20423 · Other software · Comsenz · reported by MITREHigh 8.1
Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass a "disabled registration" setting by adding a non-existing wxopenid value to the plugin.php ac=wxregister query string.
- Product
- Discuzx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2018Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass authentication by leveraging a non-empty #wechat#common_member_wechatmp to CVE-2018-20422 · Other software · Comsenz · reported by MITREHigh 8.1
Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass authentication by leveraging a non-empty #wechat#common_member_wechatmp to gain login access to an account via a plugin.php ac=wxregister request (the attacker does not have control over which account will be accessed).
- Product
- Discuzx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2018panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature.CVE-2018-16627 · Other software · Getkirby · reported by MITREMedium 6.1
panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature.
- Product
- Kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2018WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in user_login.php, register.php that can result in Javascript execCVE-2018-1000868 · Other software · Webidsupport · reported by MITREMedium 6.1
WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in user_login.php, register.php that can result in Javascript execution in the user's browser, injection of malicious markup into the page. This attack appear to be exploitable via The victim user must click a malicous link. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.
- Product
- Webid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.webidsupport.comgithub.com
Dec 20, 2018Microweber version <= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution of JavaScript code.CVE-2018-1000826 · Other software · Microweber · reported by MITREMedium 6.1
Microweber version <= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution of JavaScript code.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2018Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites.CVE-2018-15798 · Other software · Pivotal · reported by security_alert@emc.comHigh 7.6
Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse.
- Product
- Concourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2018login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field.CVE-2018-19877 · Other software · Adiscon · reported by MITREMedium 6.1
login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field.
- Product
- Loganalyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordloganalyzer.adiscon.comexploit-db.com
Dec 4, 2018Denial-of-service in the login page of ASUSTOR ADM 3.1.1 allows attackers to prevent users from signing in by placing malformed text in the title.CVE-2018-12319 · Network & remote access · Asustor · reported by MITREHigh 7.5
Denial-of-service in the login page of ASUSTOR ADM 3.1.1 allows attackers to prevent users from signing in by placing malformed text in the title.
- Product
- Data Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
Dec 4, 2018Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announcement feature.CVE-2018-12310 · Network & remote access · Asustor · reported by MITREMedium 5.4
Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announcement feature.
- Product
- Data Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
Dec 4, 2018panel/login in Kirby v2.5.12 allows XSS via a blog name.CVE-2018-16628 · Other software · Getkirby · reported by MITREMedium 5.4
panel/login in Kirby v2.5.12 allows XSS via a blog name.
- Product
- Kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2018In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variCVE-2018-19836 · Other software · Metinfo · reported by MITREMedium 6.1
In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variables from the $_COOKIE value. This issue can, for example, be exploited in conjunction with CVE-2018-19835 to bypass many XSS filters such as the Chrome XSS filter.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2018index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginForm[username] and LoginForm[password] parameters, which might make CVE-2018-19548 · Other software · Rudrasoftech · reported by MITRECritical 9.8
index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginForm[username] and LoginForm[password] parameters, which might make it easier for remote attackers to obtain access via a brute-force approach.
- Product
- Edusec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2018HuCart 5.7.4 has SQL injection in get_ip() in system/class/helper_class.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=act_login UCVE-2018-19468 · Other software · Hucart · reported by MITRECritical 9.8
HuCart 5.7.4 has SQL injection in get_ip() in system/class/helper_class.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=act_login URI.
- Product
- Hucart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Nov 18, 2018GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, CVE-2018-19358 · Other software · Gnome · reported by MITREHigh 7.8
GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms (involving the busconfig and policy XML elements) are not used. NOTE: the vendor disputes this because, according to the security model, untrusted applications must not be allowed to access the user's session bus socket.
- Product
- Gnome-keyring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugzilla.redhat.com
Nov 16, 2018School Equipment Monitoring System 1.0 allows SQL injection via the login screen, related to include/user.vb.CVE-2018-18806 · Other software · School Equipment Monitoring System Project · reported by MITRECritical 9.8
School Equipment Monitoring System 1.0 allows SQL injection via the login screen, related to include/user.vb.
- Product
- School Equipment Monitoring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Nov 16, 2018Point Of Sales 1.0 allows SQL injection via the login screen, related to LoginForm1.vb.CVE-2018-18805 · Other software · Pointofsales Project · reported by MITRECritical 9.8
Point Of Sales 1.0 allows SQL injection via the login screen, related to LoginForm1.vb.
- Product
- Pointofsales
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Nov 16, 2018Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb.CVE-2018-18804 · Other software · Bakeshop Inventory System Project · reported by MITRECritical 9.8
Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb.
- Product
- Bakeshop Inventory System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Nov 16, 2018Curriculum Evaluation System 1.0 allows SQL Injection via the login screen, related to frmCourse.vb and includes/user.vb.CVE-2018-18803 · Other software · Curriculum Evaluation System Project · reported by MITRECritical 9.8
Curriculum Evaluation System 1.0 allows SQL Injection via the login screen, related to frmCourse.vb and includes/user.vb.
- Product
- Curriculum Evaluation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Nov 16, 2018SaltOS 3.1 r8126 allows action=login&querystring=&user=[SQL] SQL Injection.CVE-2018-18761 · Other software · Saltos · reported by MITRECritical 9.8
SaltOS 3.1 r8126 allows action=login&querystring=&user=[SQL] SQL Injection.
- Product
- Saltos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Nov 15, 2018tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later views the system log.CVE-2018-19301 · Other software · Tp4a · reported by MITREMedium 6.1
tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later views the system log.
- Product
- Teleport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2018Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the Login.asp MsgCVE-2018-18775 · Other software · Microstrategy · reported by MITREMedium 6.1
Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the Login.asp Msg parameter. NOTE: this is a deprecated product.
- Product
- Microstrategy Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Oct 30, 2018Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second factor failed to load.CVE-2018-16465 · Other software · Nextcloud · reported by support@hackerone.comMedium 5.3
Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second factor failed to load.
- Product
- Nextcloud Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comnextcloud.com
Oct 30, 2018Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login.CVE-2018-18825 · Other software · Pagoda Linux Project · reported by MITREMedium 6.1
Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. A crafted code is mishandled during rendering of the login log.
- Product
- Pagoda Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2018PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno CVE-2018-18705 · Websites & servers · Phptpoint · reported by MITRECritical 9.8
PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno parameter to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 26, 2018The PureVPN client before 6.1.0 for Windows stores Login Credentials (username and password) in cleartext.CVE-2018-18656 · Other software · Purevpn · reported by MITREHigh 7.8
The PureVPN client before 6.1.0 for Windows stores Login Credentials (username and password) in cleartext. The location of such files is %PROGRAMDATA%\purevpn\config\login.conf. Additionally, all local users can read this file.
- Product
- Purevpn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrustwave.comtrustwave.com
Oct 24, 2018www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/lCVE-2018-18635 · Other software · Mailcleaner · reported by MITREMedium 6.1
www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/login/user/message/ PATH_INFO.
- Product
- Mailcleaner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2018s-cms 3.0 allows SQL Injection via the member/post.php 0_id parameter or the POST data to member/member_login.php.CVE-2018-18427 · Other software · S-cms · reported by MITRECritical 9.8
s-cms 3.0 allows SQL Injection via the member/post.php 0_id parameter or the POST data to member/member_login.php.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2018goform/setReset on Orange AirBox Y858_FL_01.16_04 devices allows attackers to reset a router to factory settings, which can be used to login using the default aCVE-2018-18377 · Other software · Orange · reported by MITREHigh 7.5
goform/setReset on Orange AirBox Y858_FL_01.16_04 devices allows attackers to reset a router to factory settings, which can be used to login using the default admin:admin credentials.
- Product
- Airbox Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2018Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to cross-site scripting vulnerabilities in hotspotlogin.cgi due to insufficient user input saCVE-2018-17533 · Other software · Teltonika · reported by MITREMedium 6.1
Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to cross-site scripting vulnerabilities in hotspotlogin.cgi due to insufficient user input sanitization.
- Product
- Rut900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 15, 2018Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlCVE-2018-17532 · Other software · Teltonika · reported by MITRECritical 9.8
Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization. This allows remote attackers to execute arbitrary commands with root privileges.
- Product
- Rut900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 12, 2018GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML.CVE-2018-10141 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 6.1
GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML.
- Product
- Palo Alto Networks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comsecurity.paloaltonetworks.com
Oct 11, 2018youke365 v1.1.5 has SQL injection via admin/login.html, as demonstrated by username=admin&pass=123456&code=9823&act=login&submit=%E7%99%BB+%E9%99%86.CVE-2018-18242 · Other software · Youke365 · reported by MITRECritical 9.8
youke365 v1.1.5 has SQL injection via admin/login.html, as demonstrated by username=admin&pass=123456&code=9823&act=login&submit=%E7%99%BB+%E9%99%86.
- Product
- Youke 365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2018Code injection in the /ui/login form Language parameter in Epicentro E_7.3.2+ allows attackers to execute JavaScript code by making a user issue a manipulated PCVE-2018-7633 · Other software · Adbglobal · reported by MITRECritical 9.8
Code injection in the /ui/login form Language parameter in Epicentro E_7.3.2+ allows attackers to execute JavaScript code by making a user issue a manipulated POST request.
- Product
- Epicentro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfschallock.wordpress.comfschallock.wordpress.com
Oct 9, 2018Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0CVE-2018-17866 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field.
- Fixed in
- 2.0.28
- What to do
- Update the plugin to 2.0.28 or newer.
Full record and what to do →NVD recordserhack.mewordpress.org
Oct 7, 2018ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to iCVE-2012-6710 · Other software · Extplorer · reported by MITRECritical 9.8
ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to index.php.
- Product
- Extplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorditsecuritysolutions.orgcnnvd.org.cn
Oct 3, 2018SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.CVE-2018-17552 · Other software · Naviwebs · reported by MITRECritical 9.8
SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.
- Product
- Navigate CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.