Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

525new WordPress flaws this week

391,883entries in the database

2,323 results · page 46 of 47

Jul 12, 2006Premium Anti-Spam in Ipswitch IMail Secure Server 2006 and Collaboration Suite 2006 Premium, when using a certain .dat file in the StarEngine /data directory frCVE-2006-3552 · Other software · Ipswitch · reported by MITREMedium 6.4
Premium Anti-Spam in Ipswitch IMail Secure Server 2006 and Collaboration Suite 2006 Premium, when using a certain .dat file in the StarEngine /data directory from 20060630 or earlier, does not properly receive and implement bullet signature updates, which allows context-dependent attackers to use the server for spam transmission.
Product
Ipswitch Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ipswitch.com ipswitch.com
Jun 7, 2006The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and exeCVE-2006-2898 · Other software · Digium · reported by MITREHigh 7.5
The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via truncated IAX 2 (IAX2) video frames, which bypasses a length check and leads to a buffer overflow involving negative length check. NOTE: the vendor advisory claims that only a DoS is possible, but the original researcher is reliable.
Product
Asterisk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com secunia.com
Jun 5, 2006PHP remote file inclusion vulnerability in common-menu.php in Cameron McKay Informium 0.12.0 allows remote attackers to execute arbitrary PHP code via a URL in CVE-2006-2818 · Other software · Cameron Mckay · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in common-menu.php in Cameron McKay Informium 0.12.0 allows remote attackers to execute arbitrary PHP code via a URL in the CONF[local_path] parameter.
Product
Informium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
May 31, 2006PHP remote file inclusion vulnerability in 404.php in open-medium.CMS 0.25 allows remote attackers to execute arbitrary PHP code via a URL in the REDSYS[MYPATH]CVE-2006-2683 · Other software · Open-medium · reported by MITREMedium 6.4
PHP remote file inclusion vulnerability in 404.php in open-medium.CMS 0.25 allows remote attackers to execute arbitrary PHP code via a URL in the REDSYS[MYPATH][TEMPLATES] parameter.
Product
Open-medium CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com vupen.com
May 22, 2006Sybase EAServer 5.0 for HP-UX Itanium, 5.2 for IBM AIX, HP-UX PA-RISC, Linux x86, and Sun Solaris SPARC, and 5.3 for Sun Solaris SPARC does not properly protectCVE-2006-2539 · Other software · Sybase · reported by MITRELow 3.5
Sybase EAServer 5.0 for HP-UX Itanium, 5.2 for IBM AIX, HP-UX PA-RISC, Linux x86, and Sun Solaris SPARC, and 5.3 for Sun Solaris SPARC does not properly protect passwords when they are being entered via the GUI, which allows local users to obtain the cleartext passwords via the getSelectedText function in javax.swing.JPasswordField component.
Product
Easerver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
May 16, 2006The raydium_network_read function in network.c in Raydium SVN revision 312 and earlier allows remote attackers to cause a denial of service (application crash) CVE-2006-2412 · Other software · Raydium · reported by MITREMedium 5
The raydium_network_read function in network.c in Raydium SVN revision 312 and earlier allows remote attackers to cause a denial of service (application crash) via a large ID, which causes an invalid memory access (buffer over-read).
Product
Raydium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aluigi.altervista.org secunia.com
May 16, 2006Buffer overflow in raydium_network_read function in network.c in Raydium SVN revision 312 and earlier allows remote attackers to execute arbitrary code by sendiCVE-2006-2411 · Other software · Raydium · reported by MITREHigh 7.5
Buffer overflow in raydium_network_read function in network.c in Raydium SVN revision 312 and earlier allows remote attackers to execute arbitrary code by sending packets with long global variables to the client.
Product
Raydium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aluigi.altervista.org secunia.com
May 16, 2006raydium_network_netcall_exec function in network.c in Raydium SVN revision 312 and earlier allows remote attackers to cause a denial of service (application craCVE-2006-2410 · Other software · Raydium · reported by MITREMedium 5
raydium_network_netcall_exec function in network.c in Raydium SVN revision 312 and earlier allows remote attackers to cause a denial of service (application crash) via a packet of type 0xFF, which causes a null dereference.
Product
Raydium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aluigi.altervista.org secunia.com
May 16, 2006Format string vulnerability in the raydium_log function in console.c in Raydium before SVN revision 310 allows local users to execute arbitrary code via format CVE-2006-2409 · Other software · Raydium · reported by MITREMedium 4.6
Format string vulnerability in the raydium_log function in console.c in Raydium before SVN revision 310 allows local users to execute arbitrary code via format string specifiers in the format parameter, which are not properly handled in a call to raydium_console_line_add.
Product
Raydium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aluigi.altervista.org raydium.org
May 16, 2006Multiple buffer overflows in Raydium before SVN revision 310 allow remote attackers to execute arbitrary code via a large packet when logged via (1) the raydiumCVE-2006-2408 · Other software · Raydium · reported by MITREHigh 7.5
Multiple buffer overflows in Raydium before SVN revision 310 allow remote attackers to execute arbitrary code via a large packet when logged via (1) the raydium_log function in log.c or (2) the raydium_console_line_add function in console.c, possibly from a long player name.
Product
Raydium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aluigi.altervista.org raydium.org
May 15, 2006NmConsole/utility/RenderMap.asp in Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to obtain sensitive informatCVE-2006-2356 · Other software · Ipswitch · reported by MITREMedium 5
NmConsole/utility/RenderMap.asp in Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to obtain sensitive information about network nodes via a modified nDeviceGroupID parameter.
Product
Whatsup Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
May 15, 2006Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium allows remote attackers to obtain full path information via 404 error messagesCVE-2006-2355 · Other software · Ipswitch · reported by MITREMedium 5
Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium allows remote attackers to obtain full path information via 404 error messages. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Whatsup Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com osvdb.org
May 15, 2006NmConsole/Login.asp in Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium generates different error messages in a way that allowsCVE-2006-2354 · Other software · Ipswitch · reported by MITREMedium 5
NmConsole/Login.asp in Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium generates different error messages in a way that allows remote attackers to enumerate valid usernames. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Whatsup Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com osvdb.org
May 15, 2006NmConsole/DeviceSelection.asp in Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to redirect users to other webCVE-2006-2353 · Other software · Ipswitch · reported by MITREMedium 5
NmConsole/DeviceSelection.asp in Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to redirect users to other websites via the (1) sCancelURL and possibly (2) sRedirectUrl parameters.
Product
Whatsup Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
May 15, 2006Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to obtain source code for scripts via a trailing dot in a requeCVE-2006-2357 · Other software · Ipswitch · reported by MITREMedium 5
Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to obtain source code for scripts via a trailing dot in a request to NmConsole/Login.asp.
Product
Whatsup Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
May 15, 2006Multiple cross-site scripting (XSS) vulnerabilities in IPswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allow remote attackers to injectCVE-2006-2352 · Other software · Ipswitch · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in IPswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allow remote attackers to inject arbitrary web script or HTML via unknown vectors in (1) NmConsole/Tools.asp and (2) NmConsole/DeviceSelection.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Whatsup Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com osvdb.org
May 15, 2006Multiple cross-site scripting (XSS) vulnerabilities in IPswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allow remote attackers to injectCVE-2006-2351 · Other software · Ipswitch · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in IPswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allow remote attackers to inject arbitrary web script or HTML via the (1) sDeviceView or (2) nDeviceID parameter to (a) NmConsole/Navigation.asp or (3) sHostname parameter to (b) NmConsole/ToolResults.asp.
Product
Whatsup Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
Apr 20, 2006Multiple buffer overflows in World Wide Web Consortium (W3C) Amaya 9.4, and possibly other versions including 8.x before 8.8.5, allow remote attackers to executCVE-2006-1900 · Other software · W3c · reported by MITREHigh 7.6
Multiple buffer overflows in World Wide Web Consortium (W3C) Amaya 9.4, and possibly other versions including 8.x before 8.8.5, allow remote attackers to execute arbitrary code via a long value in (1) the COMPACT attribute of the COLGROUP element, (2) the ROWS attribute of the TEXTAREA element, and (3) the COLOR attribute of the LEGEND element; and via other unspecified attack vectors consisting of "dozens of possible snippets."
Product
Amaya
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record morph3us.org morph3us.org
Apr 18, 2006Integer signedness error in format_jpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a lengtCVE-2006-1827 · Other software · Digium · reported by MITREMedium 6.4
Integer signedness error in format_jpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number, but triggers a buffer overflow when it is used as an unsigned length.
Product
Asterisk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ftp.digium.com secunia.com
Apr 18, 2006Multiple cross-site scripting (XSS) vulnerabilities in register.php in Tritanium Bulletin Board (TBB) 1.2.3 allow remote attackers to inject arbitrary web scripCVE-2006-1815 · Other software · Tritanium Scripts · reported by MITRELow 2.6
Multiple cross-site scripting (XSS) vulnerabilities in register.php in Tritanium Bulletin Board (TBB) 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) newuser_realname and (2) newuser_icq parameters, a different vector than CVE-2006-1768. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Tritanium Bulletin Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
Apr 13, 2006Multiple cross-site scripting (XSS) vulnerabilities in register.php in Tritanium Bulletin Board (TBB) 1.2.3 allow remote attackers to inject arbitrary web scripCVE-2006-1768 · Other software · Tritanium Scripts · reported by MITREMedium 5.1
Multiple cross-site scripting (XSS) vulnerabilities in register.php in Tritanium Bulletin Board (TBB) 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) newuser_name, (2) newuser_email, and (3) newuser_hp parameters in the faction=register mode in index.php.
Product
Tritanium Bulletin Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com osvdb.org
Feb 25, 2006Cross-site scripting (XSS) vulnerability in Calcium 3.10.1 allows remote attackers to inject arbitrary web script or HTML via the EventText parameter.CVE-2006-0889 · Other software · Brown Bear Software · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Calcium 3.10.1 allows remote attackers to inject arbitrary web script or HTML via the EventText parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Calcium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com osvdb.org
Jan 10, 2006An unspecified Microsoft WMF parsing application, as used in Internet Explorer 5.01 SP4 on Windows 2000 SP4, and 5.5 SP2 on Windows Millennium, and possibly othCVE-2006-0020 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 9.3
An unspecified Microsoft WMF parsing application, as used in Internet Explorer 5.01 SP4 on Windows 2000 SP4, and 5.5 SP2 on Windows Millennium, and possibly other versions, allows attackers to cause a denial of service (crash) and possibly execute code via a crafted WMF file with a manipulated WMF header size, possibly involving an integer overflow, a different vulnerability than CVE-2005-4560, and aka "WMF Image Parsing Memory Corruption Vulnerability."
Product
Windows 2000
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record linuxbox.org secunia.com
Dec 31, 2005The Linux kernel before 2.6.11 on the Itanium IA64 platform has certain "ptrace corner cases" that allow local users to cause a denial of service (crash) via crCVE-2005-0136 · Computers, phones & browsers · Linux · reported by MITRELow 2.1
The Linux kernel before 2.6.11 on the Itanium IA64 platform has certain "ptrace corner cases" that allow local users to cause a denial of service (crash) via crafted syscalls, possibly related to MCA/INIT, a different vulnerability than CVE-2005-1761.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.alioth.debian.org openvz.org
Dec 22, 2005SQL injection vulnerability in index.asp in pTools allows remote attackers to execute arbitrary SQL commands via the docID parameter.CVE-2005-4509 · Other software · Parallel Tools Consortium · reported by MITREHigh 7.5
SQL injection vulnerability in index.asp in pTools allows remote attackers to execute arbitrary SQL commands via the docID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Ptools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com osvdb.org
Dec 4, 2005Multiple cross-site scripting (XSS) vulnerabilities in phpMyChat 0.14.6 allow remote attackers to inject arbitrary web script or HTML via the medium parameter tCVE-2005-3991 · Websites & servers · Phpheaven · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in phpMyChat 0.14.6 allow remote attackers to inject arbitrary web script or HTML via the medium parameter to (1) start_page.css.php and (2) style.css.php; or the From parameter to users_popupL.php.
Product
Phpmychat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityreason.com securityfocus.com
Dec 3, 2005Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition 1.0.1, Professional Edition 1.5.1, Standard Edition 1.9.6.3, and Free Edition 1.0.1 allCVE-2005-3978 · Other software · Scriptdevelopers.net · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition 1.0.1, Professional Edition 1.5.1, Standard Edition 1.9.6.3, and Free Edition 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) CatID parameter in (a) ViewCat.php and (b) gallery.php, and the (2) ItemNum parameter in (c) ViewItem.php.
Product
Netclassifieds
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pridels0.blogspot.com secunia.com
Nov 16, 2005Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a ..CVE-2005-3559 · Other software · Digium · reported by MITREMedium 5
Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a .. (dot dot) in the folder parameter.
Product
Asterisk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Oct 30, 2005Multiple interpretation error in Panda Titanium 2005 4.02.01 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ"CVE-2005-3380 · Other software · Panda · reported by MITREMedium 5
Multiple interpretation error in Panda Titanium 2005 4.02.01 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Product
Titanium 2005
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info securityelf.org
Oct 23, 2005Unspecified vulnerability in HP-UX B.11.23 on Itanium platforms allows local users to cause a denial of service due to a "specific stack size."CVE-2005-3295 · Other software · HP · reported by MITRELow 2.1
Unspecified vulnerability in HP-UX B.11.23 on Itanium platforms allows local users to cause a denial of service due to a "specific stack size."
Product
Hp-ux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com
Sep 30, 2005The mprotect code (mprotect.c) in Linux 2.6 on Itanium IA64 Montecito processors does not properly maintain cache coherency as required by the architecture, whiCVE-2005-3105 · Computers, phones & browsers · Linux · reported by MITRELow 2.1
The mprotect code (mprotect.c) in Linux 2.6 on Itanium IA64 Montecito processors does not properly maintain cache coherency as required by the architecture, which allows local users to cause a denial of service and possibly corrupt data by modifying PTE protections.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cache-www.intel.com linux.bkbits.net
Sep 2, 2005Format string vulnerability in Lithium II mod 1.24 for Quake 2 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrarCVE-2005-2774 · Other software · Lithium Software · reported by MITREMedium 5
Format string vulnerability in Lithium II mod 1.24 for Quake 2 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in the nickname.
Product
Lithium II MOD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info secunia.com
Jul 5, 2005Stack-based buffer overflow in the function that parses commands in Asterisk 1.0.7, when the 'write = command' option is enabled, allows remote attackers to exeCVE-2005-2081 · Other software · Digium · reported by MITREMedium 5
Stack-based buffer overflow in the function that parses commands in Asterisk 1.0.7, when the 'write = command' option is enabled, allows remote attackers to execute arbitrary code via a command that has two double quotes followed by a tab character.
Product
Asterisk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info portcullis-security.com
Jun 7, 2005Unknown vulnerability in ObjectWeb Consortium C-JDBC before 1.3.1 allows local users to bypass intended access restrictions and obtain the cache results from anCVE-2005-1961 · Other software · Objectweb · reported by MITREMedium 4.6
Unknown vulnerability in ObjectWeb Consortium C-JDBC before 1.3.1 allows local users to bypass intended access restrictions and obtain the cache results from another user.
Product
Consortium C-jdbc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com
May 2, 2005Cross-site scripting (XSS) vulnerability in setuser.php of the Digitanium addon to PHP-Fusion 5.01 allows remote attackers to inject arbitrary web script or HTMCVE-2005-0829 · Websites & servers · PHP Fusion · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in setuser.php of the Digitanium addon to PHP-Fusion 5.01 allows remote attackers to inject arbitrary web script or HTML via the (1) user_name or (2) user_pass parameters.
Product
PHP Fusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info marc.info
May 2, 2005Linux kernel 2.6 on Itanium (ia64) architectures allows local users to cause a denial of service via a "missing Itanium syscall table entry."CVE-2005-0137 · Computers, phones & browsers · Linux · reported by MITRELow 2.1
Linux kernel 2.6 on Itanium (ia64) architectures allows local users to cause a denial of service via a "missing Itanium syscall table entry."
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record redhat.com redhat.com
May 2, 2005The unw_unwind_to_user function in unwind.c on Itanium (ia64) architectures in Linux kernel 2.6 allows local users to cause a denial of service (system crash).CVE-2005-0135 · Computers, phones & browsers · Linux · reported by MITRELow 2.1
The unw_unwind_to_user function in unwind.c on Itanium (ia64) architectures in Linux kernel 2.6 allows local users to cause a denial of service (system crash).
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record linux.bkbits.net secunia.com
Mar 5, 2005Hyper-Threading technology, as used in FreeBSD and other operating systems that are run on Intel Pentium and other processors, allows local users to use a malicCVE-2005-0109 · Other software · Freebsd · reported by MITREMedium 5.6
Hyper-Threading technology, as used in FreeBSD and other operating systems that are run on Intel Pentium and other processors, allows local users to use a malicious thread to create covert channels, monitor the execution of other threads, and obtain sensitive information such as cryptographic keys, via a timing attack on memory cache misses.
Product
Freebsd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ftp.sco.com marc.info
Jan 27, 2005Microsoft Proxy Server 2.0 and Microsoft ISA Server 2000 (which is included in Small Business Server 2000 and Small Business Server 2003 Premium Edition) allowsCVE-2004-0892 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
Microsoft Proxy Server 2.0 and Microsoft ISA Server 2000 (which is included in Small Business Server 2000 and Small Business Server 2003 Premium Edition) allows remote attackers to spoof trusted Internet content on a specially crafted webpage via spoofed reverse DNS lookup results.
Product
ISA Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com docs.microsoft.com
Dec 31, 2004Format string vulnerability in prelink.c in kextload in Apple OS X, as used by TDIXSupport in Roxio Toast Titanium and possibly other products, allows local useCVE-2004-1398 · Other software · Roxio · reported by MITREMedium 4.6
Format string vulnerability in prelink.c in kextload in Apple OS X, as used by TDIXSupport in Roxio Toast Titanium and possibly other products, allows local users to execute arbitrary code via format string specifiers in the extension argument.
Product
Toast
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.grok.org.uk marc.info
Dec 31, 2003Multiple stack-based buffer overflows in Atrium MERCUR IMAPD in MERCUR Mailserver before 4.2.15.0 allow remote attackers to execute arbitrary code via a long (1CVE-2003-1322 · Other software · Atrium Software · reported by MITREHigh 10
Multiple stack-based buffer overflows in Atrium MERCUR IMAPD in MERCUR Mailserver before 4.2.15.0 allow remote attackers to execute arbitrary code via a long (1) EXAMINE, (2) DELETE, (3) SUBSCRIBE, (4) RENAME, (5) UNSUBSCRIBE, (6) LIST, (7) LSUB, (8) STATUS, (9) LOGIN, (10) CREATE, or (11) SELECT command.
Product
Mercur Mailserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record iss.net securityfocus.com
Dec 31, 2003Buffer overflow in the base64 decoder in MERCUR Mailserver 4.2 before SP3a allows remote attackers to cause a denial of service and possibly execute arbitrary cCVE-2003-1177 · Other software · Atrium Software · reported by MITREHigh 7.5
Buffer overflow in the base64 decoder in MERCUR Mailserver 4.2 before SP3a allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long (1) AUTH command to the POP3 server or (2) AUTHENTICATE command to the IMAP server.
Product
Mercur Mailserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
Dec 31, 2003Aprelium Technologies Abyss Web Server 1.1.2, and possibly other versions before 1.1.4, allows remote attackers to cause a denial of service (crash) via an HTTPCVE-2003-1364 · Other software · Aprelium Technologies · reported by MITREHigh 8.5
Aprelium Technologies Abyss Web Server 1.1.2, and possibly other versions before 1.1.4, allows remote attackers to cause a denial of service (crash) via an HTTP GET message with empty (1) Connection or (2) Range fields.
Product
Abyss Web Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com securityfocus.com
Dec 31, 2003The remote web management interface of Aprelium Technologies Abyss Web Server 1.1.2 and earlier does not log connection attempts to the web management port (999CVE-2003-1363 · Other software · Aprelium Technologies · reported by MITREMedium 6.4
The remote web management interface of Aprelium Technologies Abyss Web Server 1.1.2 and earlier does not log connection attempts to the web management port (9999), which allows remote attackers to mount brute force attacks on the administration console without detection.
Product
Abyss Web Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com iss.net
Dec 31, 2003index.php in Tritanium Bulletin Board 1.2.3 allows remote attackers to read and reply to arbitrary messages by modifying the thread_id, forum_id, and sid parameCVE-2003-1162 · Other software · Tritanium Scripts · reported by MITREMedium 5
index.php in Tritanium Bulletin Board 1.2.3 allows remote attackers to read and reply to arbitrary messages by modifying the thread_id, forum_id, and sid parameters.
Product
Tritanium Bulletin Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
Dec 31, 2003CRLF injection vulnerability in Aprelium Abyss Web Server 1.1.2 and earlier allows remote attackers to inject arbitrary HTTP headers and possibly conduct HTTP RCVE-2003-1338 · Other software · Aprelium Technologies · reported by MITREMedium 4.3
CRLF injection vulnerability in Aprelium Abyss Web Server 1.1.2 and earlier allows remote attackers to inject arbitrary HTTP headers and possibly conduct HTTP Response Splitting attacks via CRLF sequences in the Location header.
Product
Abyss Web Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com archives.neohapsis.com
Dec 31, 2003Heap-based buffer overflow in Aprelium Abyss Web Server 1.1.2 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.CVE-2003-1337 · Other software · Aprelium Technologies · reported by MITREHigh 7.5
Heap-based buffer overflow in Aprelium Abyss Web Server 1.1.2 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
Product
Abyss Web Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com securityfocus.com
Sep 22, 2003SQL injection vulnerability in the Call Detail Record (CDR) logging functionality for Asterisk allows remote attackers to execute arbitrary SQL via a CallerID sCVE-2003-0779 · Other software · Digium · reported by MITREHigh 7.5
SQL injection vulnerability in the Call Detail Record (CDR) logging functionality for Asterisk allows remote attackers to execute arbitrary SQL via a CallerID string.
Product
Asterisk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record atstake.com atstake.com
Sep 17, 2003Buffer overflow in the get_msg_text of chan_sip.c in the Session Initiation Protocol (SIP) protocol implementation for Asterisk releases before August 15, 2003,CVE-2003-0761 · Other software · Digium · reported by MITREHigh 7.5
Buffer overflow in the get_msg_text of chan_sip.c in the Session Initiation Protocol (SIP) protocol implementation for Asterisk releases before August 15, 2003, allows remote attackers to execute arbitrary code via certain (1) MESSAGE or (2) INFO requests.
Product
Asterisk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record atstake.com atstake.com
Aug 7, 2003Cross-site scripting (XSS) vulnerabilities in XMB Forum 1.8 Partagium allow remote attackers to insert arbitrary script via (1) the member parameter to member.pCVE-2003-0483 · Other software · XMB Forum · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerabilities in XMB Forum 1.8 Partagium allow remote attackers to insert arbitrary script via (1) the member parameter to member.php or (2) the action parameter to buddy.php.
Product
XMB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info docs.xmbforum2.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.