Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

2,565 results · page 45 of 52

Oct 27, 2020A memory corruption vulnerability was addressed with improved locking.CVE-2019-8829 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, watchOS 6.1, tvOS 13.2, iOS 13.2 and iPadOS 13.2. An application may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 27, 2020A memory corruption issue was addressed with improved memory handling.CVE-2019-8828 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3 and iPadOS 13.3, watchOS 6.1.1, macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra, tvOS 13.3. An application may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 27, 2020The HTTP referrer header may be used to leak browsing history.CVE-2019-8827 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin. This issue is fixed in Safari 13.0.3, iTunes 12.10.2 for Windows, iCloud for Windows 10.9.2, tvOS 13.2, iOS 13.2 and iPadOS 13.2, iCloud for Windows 7.15. Visiting a maliciously crafted website may reveal the sites a user has visited.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 27, 2020A validation issue was addressed with improved logic.CVE-2019-8809 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
A validation issue was addressed with improved logic. This issue is fixed in macOS Catalina 10.15, iOS 13.1 and iPadOS 13.1, tvOS 13, watchOS 6, iOS 13. A local app may be able to read a persistent account identifier.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 27, 2020This issue was resolved by replacing device names with a random identifier.CVE-2019-8799 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 2.4
This issue was resolved by replacing device names with a random identifier. This issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15, watchOS 6, tvOS 13. An attacker in physical proximity may be able to passively observe device names in AWDL communications.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 27, 2020The issue was addressed with improved permissions logic.CVE-2019-8780 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved permissions logic. This issue is fixed in iOS 13.1 and iPadOS 13.1, tvOS 13. A malicious application may be able to determine kernel memory layout.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 27, 2020A resource exhaustion issue was addressed with improved input validation.CVE-2019-8774 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15. Parsing a maliciously crafted iBooks file may lead to a persistent denial-of-service.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 27, 2020Multiple memory corruption issues were addressed with improved memory handling.CVE-2019-8773 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, iCloud for Windows 10.7, iCloud for Windows 7.14, tvOS 13, watchOS 6, iTunes 12.10.1 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 27, 2020A validation issue was addressed with improved logic.CVE-2019-8762 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.1
A validation issue was addressed with improved logic. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, iCloud for Windows 10.7, tvOS 13, iCloud for Windows 7.14, iTunes 12.10.1 for Windows. Processing maliciously crafted web content may lead to universal cross site scripting.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 27, 2020Multiple memory corruption issues were addressed with improved memory handling.CVE-2019-8752 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, iCloud for Windows 10.7, iCloud for Windows 7.14, tvOS 13, watchOS 6, iTunes 12.10.1 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 27, 2020Multiple memory corruption issues were addressed with improved memory handling.CVE-2019-8751 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, iCloud for Windows 10.7, iCloud for Windows 7.14, tvOS 13, watchOS 6, iTunes 12.10.1 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 27, 2020A memory corruption vulnerability was addressed with improved locking.CVE-2019-8740 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 13.1 and iPadOS 13.1, watchOS 6, tvOS 13. An application may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 27, 2020A memory corruption issue was addressed with improved state management.CVE-2019-8706 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15, iOS 13.1 and iPadOS 13.1, tvOS 13, macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, watchOS 6. Processing a maliciously crafted audio file may lead to arbitrary code execution.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 16, 2020This issue was addressed by encrypting communications over the network to devices running iOS 14, iPadOS 14, tvOS 14, and watchOS 7.CVE-2020-9992 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
This issue was addressed by encrypting communications over the network to devices running iOS 14, iPadOS 14, tvOS 14, and watchOS 7. This issue is fixed in iOS 14.0 and iPadOS 14.0, Xcode 12.0. An attacker in a privileged network position may be able to execute arbitrary code on a paired device during a debug session over the network.
Product
iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org support.apple.com
Oct 16, 2020Apple iOS, iPadOS, and macOS Input Validation VulnerabilityCVE-2020-9934 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information.
Product
iOS, iPadOS, and macOS
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Oct 15, 2020Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the ticketCVE-2020-1777 · Other software · OTRS AG · reported by security@otrs.comMedium 4.3
Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the tickets, when system is configured to mask real agent names. This issue affects OTRS; 7.0.21 and prior versions, 8.0.6 and prior versions.
Product
OTRS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record otrs.com otrs.com
Oct 6, 2020In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash.CVE-2020-25863 · Other software · Wireshark · reported by MITREHigh 7.5
In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash. This was addressed in epan/dissectors/packet-multipart.c by correcting the deallocation of invalid MIME parts.
Product
Wireshark
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Sep 22, 2020Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, CVE-2020-15839 · Other software · Liferay · reported by MITREMedium 6.5
Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.
Product
Digital Experience Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record issues.liferay.com issues.liferay.com
Sep 2, 2020The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosure (participant data, CVE-2020-25026 · Other software · Derhansen · reported by MITREMedium 4.3
The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosure (participant data, and event data via email) because of Broken Access Control.
Product
Event Management And Registration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org typo3.org
Aug 26, 2020An issue was discovered on Nescomed Multipara Monitor M1000 devices.CVE-2020-15485 · Other software · Niscomed · reported by MITREMedium 5.5
An issue was discovered on Nescomed Multipara Monitor M1000 devices. The onboard Flash memory stores data in cleartext, without integrity protection against tampering.
Product
M1000 Multipara Patient Monitor Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record payatu.com niscomed.com
Aug 26, 2020An issue was discovered on Nescomed Multipara Monitor M1000 devices.CVE-2020-15483 · Other software · Niscomed · reported by MITREMedium 6.8
An issue was discovered on Nescomed Multipara Monitor M1000 devices. The physical UART debug port provides a shell, without requiring a password, with complete access.
Product
M1000 Multipara Patient Monitor Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record payatu.com niscomed.com
Aug 26, 2020An issue was discovered on Nescomed Multipara Monitor M1000 devices.CVE-2020-15482 · Other software · Niscomed · reported by MITREHigh 7.8
An issue was discovered on Nescomed Multipara Monitor M1000 devices. The device enables an unencrypted TELNET service by default, with a blank password for the admin account. This allows an attacker to gain root access to the device over the local network.
Product
M1000 Multipara Patient Monitor Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record payatu.com niscomed.com
Aug 26, 2020An issue was discovered on Nescomed Multipara Monitor M1000 devices.CVE-2020-15484 · Other software · Niscomed · reported by MITREHigh 7.5
An issue was discovered on Nescomed Multipara Monitor M1000 devices. The internal storage of the underlying Linux system stores data in cleartext, without integrity protection against tampering.
Product
M1000 Multipara Patient Monitor Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record payatu.com niscomed.com
Aug 19, 2020SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page.CVE-2020-17456 · Other software · Seowonintech · reported by MITRECritical 9.8
SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page.
Product
Slc-130 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 30, 2020Use after free issue while processing error notification from camx driver due to not properly releasing the sequence data in Snapdragon Mobile in Saipan, SM8250CVE-2020-3701 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Use after free issue while processing error notification from camx driver due to not properly releasing the sequence data in Snapdragon Mobile in Saipan, SM8250, SXR2130
Product
Snapdragon Mobile
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Jul 5, 2020SQL injection can occur in We-com Municipality portal CMS 2.1.x via the cerca/ keywords field.CVE-2020-15539 · Other software · We-com · reported by MITRECritical 9.8
SQL injection can occur in We-com Municipality portal CMS 2.1.x via the cerca/ keywords field.
Product
Municipality Portal CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxsecurity.com packetstormsecurity.com
Jul 5, 2020XSS can occur in We-com Municipality portal CMS 2.1.x via the cerca/ search bar.CVE-2020-15538 · Other software · We-com · reported by MITREMedium 6.1
XSS can occur in We-com Municipality portal CMS 2.1.x via the cerca/ search bar.
Product
Municipality Portal CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxsecurity.com packetstormsecurity.com
Jun 22, 2020While IPA driver processes route add rule IOCTL, there is no input validation of the rule ID prior to adding the rule to the IPA HW commit list in Snapdragon AuCVE-2019-14047 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
While IPA driver processes route add rule IOCTL, there is no input validation of the rule ID prior to adding the rule to the IPA HW commit list in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, APQ8096AU, MDM9607, MSM8909W, MSM8996, MSM8996AU, QCN7605, QCS605, SC8180X, SDA845, SDX20, SDX24, SDX55, SM8150, SXR1130
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Jun 18, 2020Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to CVE-2020-14422 · Other software · Siemens · reported by MITREMedium 5.9
Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.
Product
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Jun 9, 2020Apple iOS, iPadOS, and watchOS Memory Corruption VulnerabilityCVE-2020-9819 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 4.3
Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message.
Product
iOS, iPadOS, and watchOS
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jun 9, 2020Apple iOS, iPadOS, and watchOS Out-of-Bounds Write VulnerabilityCVE-2020-9818 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message.
Product
iOS, iPadOS, and watchOS
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
May 20, 2020phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the User Instructions widget.CVE-2020-13225 · Websites & servers · Phpipam · reported by MITREMedium 4.8
phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the User Instructions widget.
Product
Phpipam
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com youtube.com
Apr 29, 2020Beeline Smart Box 2.0.38 routers allow "Advanced settings > Other > Diagnostics" OS command injection via the Ping ping_ipaddr parameter, the Nslookup nslookup_CVE-2020-12246 · Other software · Beeline · reported by MITREHigh 8.8
Beeline Smart Box 2.0.38 routers allow "Advanced settings > Other > Diagnostics" OS command injection via the Ping ping_ipaddr parameter, the Nslookup nslookup_ipaddr parameter, or the Traceroute traceroute_ipaddr parameter.
Product
Smart BOX Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com yadi.sk
Apr 27, 2020A flaw was found in all ipa versions 4.x.x through 4.8.0.CVE-2020-1722 · Other software · Red Hat · reported by Red HatMedium 5.3
A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this vulnerability is to system availability.
Product
ipa
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com bugzilla.redhat.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11587 · Other software · Cipplanner · reported by MITREHigh 7.5
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and get the content of ETL Processes running on the server.
Product
Cipace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record criticalstart.com criticalstart.com
Apr 6, 2020An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11586 · Other software · Cipplanner · reported by MITRECritical 9.8
An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that contains malicious XML DTD data.
Product
Cipace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record criticalstart.com criticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 6.80 Build 2016031401.CVE-2020-11599 · Other software · Cipplanner · reported by MITREHigh 7.5
An issue was discovered in CIPPlanner CIPAce 6.80 Build 2016031401. GetDistributedPOP3 allows attackers to obtain the username and password of the SMTP user.
Product
Cipace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record criticalstart.com criticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11598 · Other software · Cipplanner · reported by MITRECritical 9.8
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. Upload.ashx allows remote attackers to execute arbitrary code by uploading and executing an ASHX file.
Product
Cipace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record criticalstart.com criticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11597 · Other software · Cipplanner · reported by MITRECritical 9.8
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request and inject SQL statements in the user context of the db owner.
Product
Cipace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record criticalstart.com criticalstart.com
Apr 6, 2020A Directory Traversal issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11596 · Other software · Cipplanner · reported by MITREHigh 7.5
A Directory Traversal issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make HTTP GET requests to a certain URL and obtain information about what files and directories reside on the server.
Product
Cipace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record criticalstart.com criticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11595 · Other software · Cipplanner · reported by MITREHigh 7.5
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the upload folder path that includes the hostname in a UNC path.
Product
Cipace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record criticalstart.com criticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11594 · Other software · Cipplanner · reported by MITREHigh 7.5
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that causes a stack error to be shown providing the full file path.
Product
Cipace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record criticalstart.com criticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11593 · Other software · Cipplanner · reported by MITREHigh 7.5
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request with injected HTML data that is later leveraged to send emails from a customer trusted email address.
Product
Cipace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record criticalstart.com criticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11592 · Other software · Cipplanner · reported by MITREHigh 7.5
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and get the columns of a specific table within the CIP database.
Product
Cipace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record criticalstart.com criticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11591 · Other software · Cipplanner · reported by MITREMedium 5.3
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the full application path along with the customer name.
Product
Cipace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record criticalstart.com criticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11590 · Other software · Cipplanner · reported by MITREMedium 5.3
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to HealthPage.aspx and obtain the internal server name.
Product
Cipace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record criticalstart.com criticalstart.com
Apr 6, 2020An Insecure Direct Object Reference issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11589 · Other software · Cipplanner · reported by MITREHigh 7.5
An Insecure Direct Object Reference issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make a GET request to a certain URL and obtain information that should be provided to authenticated users only.
Product
Cipace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record criticalstart.com criticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11588 · Other software · Cipplanner · reported by MITREMedium 5.3
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to two files that contain customer data and application paths.
Product
Cipace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record criticalstart.com criticalstart.com
Mar 20, 2020Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a speciallCVE-2020-8136 · Other software · Fastify · reported by support@hackerone.comHigh 7.5
Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request.
Product
Fastify-multipart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com hackerone.com
Mar 4, 2020An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4.CVE-2020-7988 · Websites & servers · Phpipam · reported by MITREHigh 8.8
An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. CSRF can be used to change the password of any user/admin, to escalate privileges, and to gain access to more data and functionality. This issue exists due to the lack of a requirement to provide the old password, and the lack of security tokens.
Product
Phpipam
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pastebin.com phpipam.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.