Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
428 results · page 5 of 9
Jan 3, 2023A vulnerability, which was classified as problematic, has been found in ahmyi RivetTracker.CVE-2012-10003 · Other software · ahmyi · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in ahmyi RivetTracker. This issue affects some unknown processing. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be initiated remotely. The patch is named f053c5cc2bc44269b0496b5f275e349928a92ef9. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217271.
- Product
- RivetTracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2023A vulnerability was found in ahmyi RivetTracker.CVE-2012-10002 · Other software · ahmyi · reported by VulDBLow 3.5
A vulnerability was found in ahmyi RivetTracker. It has been declared as problematic. Affected by this vulnerability is the function changeColor of the file css.php. The manipulation of the argument set_css leads to cross site scripting. The attack can be launched remotely. The patch is named 45a0f33876d58cb7e4a0f17da149e58fc893b858. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217267.
- Product
- RivetTracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2022fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious firmware, and brick CVE-2021-35954 · Other software · Fastrack · reported by MITREHigh 8.1
fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious firmware, and brick the device via the Serial Wire Debug (SWD) feature.
- Product
- Reflex 2.0 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2022fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service (device outage) via crafted choices of the last tCVE-2021-35953 · Other software · Fastrack · reported by MITREHigh 7.5
fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service (device outage) via crafted choices of the last three bytes of a characteristic value.
- Product
- Reflex 2.0 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2022fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month via Bluetooth LE Characteristics on handleCVE-2021-35952 · Other software · Fastrack · reported by MITREMedium 5.3
fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month via Bluetooth LE Characteristics on handle 0x0017.
- Product
- Reflex 2.0 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2022fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows an Unauthenticated Remote attacker to send a malicious firmware update via BLE and brick the devCVE-2021-35951 · Other software · Fastrack · reported by MITREHigh 7.5
fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows an Unauthenticated Remote attacker to send a malicious firmware update via BLE and brick the device.
- Product
- Reflex 2.0 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022Activity Watch is a free and open-source automated time tracker.CVE-2021-32692 · Other software · ActivityWatch · reported by GitHubCritical 9.6
Activity Watch is a free and open-source automated time tracker. Versions prior to 0.11.0 allow an attacker to execute arbitrary commands on any macOS machine with ActivityWatch running. The attacker can exploit this vulnerability by having the user visiting a website with the page title set to a malicious string. An attacker could use another application to accomplish the same, but the web browser is the most likely attack vector. This issue is patched in version 0.11.0. As a workaround, users can run the latest version of aw-watcher-window from source, or manually patch the `printAppTitle.scpt` file.
- Product
- Activity Watch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022Silverware Games is a social network where people can play games online.CVE-2022-23543 · Other software · mesosoi · reported by GitHubMedium 6.3
Silverware Games is a social network where people can play games online. Users can attach URLs to YouTube videos, the site will generate related `<iframe>` when the post will be published. The handler has some sort of protection so non-YouTube links can't be posted, as well as HTML tags are being stripped. However, it was still possible to add custom HTML attributes (e.g. `onclick=alert("xss")`) to the `<iframe>'. This issue was fixed in the version `1.1.34` and does not require any extra actions from our members. There has been no evidence that this vulnerability was used by anyone at this time.
- Product
- silverwaregames-io-issue-tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022A cross-site scripting (XSS) vulnerability in Expense Tracker 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into CVE-2022-45033 · Other software · Oretnom23 · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Expense Tracker 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Chat text field.
- Product
- Expense Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2022Chipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control.CVE-2022-37193 · Other software · Chipolo · reported by MITREHigh 7.4
Chipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control. Chipolo devices suffer from access revocation evasion attacks once the malicious sharee obtains the access credentials.
- Product
- Chipolo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2022ActivityWatch open-source automated time tracker.CVE-2022-31149 · Other software · ActivityWatch · reported by GitHubHigh 8.8
ActivityWatch open-source automated time tracker. Versions prior to 0.12.0b2 are vulnerable to DNS rebinding attacks. This vulnerability impacts everyone running ActivityWatch and gives the attacker full access to the ActivityWatch REST API. Users should upgrade to v0.12.0b2 or later to receive a patch. As a workaround, block DNS lookups that resolve to 127.0.0.1.
- Product
- activitywatch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 6, 2022SilverwareGames.io is a social network for users to play video games online.CVE-2022-36072 · Other software · mesosoi · reported by GitHubMedium 5.9
SilverwareGames.io is a social network for users to play video games online. In version 1.1.8 and prior, due to an unobvious feature of PHP, hashes generated by built-in functions and starting with the `0e` symbols were being handled as zero multiplied with the `e` number. Therefore, the hash value was equal to 0. The maintainers fixed this in version 1.1.9 by using `===` instead of `==` in comparisons where it is possible (e.g. on sign in/sign up handlers).
- Product
- silverwaregames-io-issue-tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2022MilkyTracker v1.03.00 was discovered to contain a stack overflow via the component LoaderXM::load.CVE-2022-34927 · Other software · Milkytracker Project · reported by MITREHigh 7.8
MilkyTracker v1.03.00 was discovered to contain a stack overflow via the component LoaderXM::load. This vulnerability is triggered when the program is supplied a crafted XM module file.
- Product
- Milkytracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which acCVE-2022-34150 · Other software · MiCODUS · reported by ics-cert@hq.dhs.govHigh 7.1
The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification.
- Product
- MV720
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” wCVE-2022-33944 · Other software · MiCODUS · reported by ics-cert@hq.dhs.govMedium 6.5
The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.
- Product
- MV720
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a userCVE-2022-2199 · Other software · MiCODUS · reported by ics-cert@hq.dhs.govHigh 7.5
The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request.
- Product
- MV720
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.CVE-2022-2141 · Other software · MiCODUS · reported by ics-cert@hq.dhs.govCritical 9.8
SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.
- Product
- MV720
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password.CVE-2022-2107 · Other software · MiCODUS · reported by ics-cert@hq.dhs.govCritical 9.8
The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number.
- Product
- MV720
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2022Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search.CVE-2022-25803 · Other software · Bestpractical · reported by MITREMedium 6.1
Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Jul 14, 2022Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment.CVE-2022-25802 · Other software · Bestpractical · reported by MITREMedium 6.1
Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Jul 14, 2022Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools.CVE-2022-25801 · Other software · Bestpractical · reported by MITRECritical 9.1
Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools.
- Product
- Request Tracker For Incident Response
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Jul 14, 2022Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.CVE-2022-25800 · Other software · Bestpractical · reported by MITRECritical 9.1
Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.
- Product
- Request Tracker For Incident Response
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Jul 1, 2022MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort.CVE-2022-32088 · Other software · Mariadb · reported by MITREHigh 7.5
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort.
- Product
- Mariadb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mariadb.orglists.debian.org
Jul 1, 2022MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker.CVE-2022-32083 · Other software · Mariadb · reported by MITREHigh 7.5
MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker.
- Product
- Mariadb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mariadb.orglists.debian.org
Jul 1, 2022Insufficient sanitization in GitLab EE's external issue tracker affecting all versions from 14.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.CVE-2022-2235 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8.7
Insufficient sanitization in GitLab EE's external issue tracker affecting all versions from 14.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to perform cross-site scripting when a victim clicks on a maliciously crafted ZenTao link
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022A cross-site scripting (XSS) vulnerability in the batch add function of Urtracker Premium v4.0.1.1477 allows attackers to execute arbitrary web scripts or HTML CVE-2022-33043 · Other software · Urtracker · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the batch add function of Urtracker Premium v4.0.1.1477 allows attackers to execute arbitrary web scripts or HTML via a crafted excel file.
- Product
- Urtracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022An issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android, allows attackers to cause unspecified consequences due to beingCVE-2021-43512 · Other software · Flightradar24 · reported by MITREMedium 5.5
An issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android, allows attackers to cause unspecified consequences due to being able to decompile a local application and extract their API keys.
- Product
- Flightradar24 Flight Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comflightradar24.com
Apr 22, 2022All versions of Uffizio GPS Tracker may allow an attacker to perform unintended actions on behalf of a user.CVE-2021-32929 · Other software · Uffizio · reported by ics-cert@hq.dhs.govMedium 4.3
All versions of Uffizio GPS Tracker may allow an attacker to perform unintended actions on behalf of a user.
- Product
- GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2022An attacker may be able to inject client-side JavaScript code on multiple instances within all versions of Uffizio GPS Tracker.CVE-2021-32927 · Other software · Uffizio · reported by ics-cert@hq.dhs.govHigh 7.1
An attacker may be able to inject client-side JavaScript code on multiple instances within all versions of Uffizio GPS Tracker.
- Product
- GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of ServiCVE-2022-27384 · Other software · Mariadb · reported by MITREHigh 7.5
An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
- Product
- Mariadb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mariadb.orglists.debian.org
Mar 28, 2022Plezi: Has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable optionCVE-2022-0680 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scripting issue
- Product
- Plezi
- Fixed in
- 1.0.3
- What to do
- Update Plezi to 1.0.3 or newer.
Mar 7, 2022test parameter of the xmlfeed in the Tradetracker-Store: Is not sanitisedCVE-2021-24778 · WordPress plugins & themes · reported by WPScanHigh 7.2
The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- test parameter of the xmlfeed in the Tradetracker-Store
- Fixed in
- 4.6.60
- What to do
- Update test parameter of the xmlfeed in the Tradetracker-Store to 4.6.60 or newer.
Feb 24, 2022Anuko Time Tracker is an open source, web-based time tracking application written in PHP.CVE-2022-24708 · Other software · anuko · reported by GitHubMedium 6.5
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with elements of JavaScript. Such script could then be executed in user browser on subsequent requests on pages where primary group name was displayed. This is vulnerability has been fixed in version 1.20.0.5646. Users who are unable to upgrade may modify ttUser.class.php to use an additional call to htmlspecialchars when printing group name.
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022Anuko Time Tracker is an open source, web-based time tracking application written in PHP.CVE-2022-24707 · Other software · anuko · reported by GitHubHigh 7.4
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was happening because the Puncher plugin was reusing code from other places and was relying on an unsanitized date parameter in POST requests. Because the parameter was not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue has been resolved in in version 1.20.0.5642. Users unable to upgrade are advised to add their own checks to input.
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 8, 2022Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.CVE-2021-45329 · Other software · Gitea · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.iogithub.com
Jan 19, 2022Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.CVE-2021-44777 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.2.6).
- Affected
- up to 5.2.6
- What to do
- Affects up to 5.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Dec 21, 2021Anuko Time Tracker is an open source, web-based time tracking application written in PHP.CVE-2021-43851 · Other software · anuko · reported by GitHubHigh 8.1
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. SQL injection vulnerability exist in multiple files in Time Tracker version 1.19.33.5606 and prior due to not properly checking of the "group" and "status" parameters in POST requests. Group parameter is posted along when navigating between organizational subgroups (groups.php file). Status parameter is used in multiple files to change a status of an entity such as making a project, task, or user inactive. This issue has been patched in version 1.19.33.5607. An upgrade is highly recommended. If an upgrade is not practical, introduce ttValidStatus function as in the latest version and start using it user input check blocks wherever status field is used. For groups.php fix, introduce ttValidInteger function as in the latest version and use it in the access check block in the file.
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2021anuko/timetracker is an, open source time tracking system.CVE-2021-41156 · Other software · anuko · reported by GitHubMedium 6.8
anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browser_today hidden control on a few pages to collect the today's date from user browsers. Because of not checking this parameter for sanity in versions prior to 1.19.30.5601, it was possible to craft an html form with malicious JavaScript, use social engineering to convince logged on users to execute a POST from such form, and have the attacker-supplied JavaScript to be executed in user's browser. This has been patched in version 1.19.30.5600. Upgrade is recommended. If it is not practical, introduce ttValidDbDateFormatDate function as in the latest version and add a call to it within the access checks block.
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2021Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack againsCVE-2021-38562 · Other software · Bestpractical · reported by MITREHigh 7.5
Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comgithub.com
Oct 13, 2021Anuko Time Tracker is an open source, web-based time tracking application written in PHP.CVE-2021-41139 · Other software · anuko · reported by GitHubHigh 8.1
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time Tracker, it is being passed on via the date parameter in URI. Because of not checking this parameter for sanity in versions prior to 1.19.30.5600, it was possible to craft the URI with malicious JavaScript, use social engineering to convince logged on user to click on such link, and have the attacker-supplied JavaScript to be executed in user's browser. This issue is patched in version 1.19.30.5600. As a workaround, one may introduce `ttValidDbDateFormatDate` function as in the latest version and add a call to it within the access checks block in time.php.
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021A SQL-Injection vulnerability in the nTracker USB Enterprise(secure USB management solution) allows a remote unauthenticated attacker to perform SQL query to acCVE-2020-7819 · Other software · nTrackSystem · reported by vuln@krcert.or.krCritical 9.3
A SQL-Injection vulnerability in the nTracker USB Enterprise(secure USB management solution) allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information.
- Product
- nTracker USB Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2021Pi-hole is a Linux network-level advertisement and Internet tracker blocking application.CVE-2021-29448 · Other software · pi-hole · reported by GitHubHigh 7.6
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.
- Product
- AdminLTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2021Pi-hole is a Linux network-level advertisement and Internet tracker blocking application.CVE-2021-29449 · Other software · pi-hole · reported by GitHubMedium 6.3
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in version 5.2.4 of Pi-hole core. See the referenced GitHub security advisory for details.
- Product
- pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2021Anuko Time Tracker is an open source, web-based time tracking application written in PHP.CVE-2021-29436 · Other software · anuko · reported by GitHubMedium 5.4
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an attacker-provided form that executes an unintended action such as changing user password. The vulnerability is fixed in Time Tracker version 1.19.27.5431. Upgrade is recommended. If upgrade is not practical, introduce ttMitigateCSRF() function in /WEB-INF/lib/common.php.lib using the latest available code and call it from ttAccessAllowed().
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021In onReceive of ImsPhoneCallTracker.java, there is a possible misattribution of data usage due to an incorrect broadcast handler.CVE-2021-0388 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onReceive of ImsPhoneCallTracker.java, there is a possible misattribution of data usage due to an incorrect broadcast handler. This could lead to local escalation of privilege resulting in attributing video call data to the wrong app, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-162741489
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In onReceive of DcTracker.java, there is a possible way to trigger a provisioning URL and modify other telephony settings due to a missing permission check.CVE-2021-0380 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onReceive of DcTracker.java, there is a possible way to trigger a provisioning URL and modify other telephony settings due to a missing permission check. This could lead to local escalation of privilege during the onboarding flow with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-172459128
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 2, 2021Anuko Time Tracker is an open source, web-based time tracking application written in PHP.CVE-2021-21352 · Other software · anuko · reported by GitHubMedium 6.8
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predictable. This opens a window for brute force attacks to guess user tokens and, once successful, change user passwords, including that of a system administrator. This vulnerability is pathced in version 1.19.24.5415 (started to use more secure tokens) with an additional improvement in 1.19.24.5416 (limited an available window for brute force token guessing).
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2021An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices.CVE-2019-20468 · Other software · tk-star · reported by MITRECritical 9.8
An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It has unnecessary permissions such as READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, and READ_CONTACTS.
- Product
- q90_junior_gps_horloge_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgeurofins-cybersecurity.com
Jan 20, 2021Vulnerability in the Oracle Application Express Opportunity Tracker component of Oracle Database Server.CVE-2021-2116 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.4
Vulnerability in the Oracle Application Express Opportunity Tracker component of Oracle Database Server. The supported version that is affected is Prior to 20.2. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Express Opportunity Tracker. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express Opportunity Tracker, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express Opportunity Tracker accessible data as well as unauthorized read access to a subset of Oracle Application Express Opportunity Tracker accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
- Product
- Application Express (APEX)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user'CVE-2020-27423 · Other software · Anuko · reported by MITREHigh 7.5
Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox
- Product
- Time Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.