Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,673 results · page 54 of 54
May 2, 2005Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft EPay Pro 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) paymentCVE-2005-0981 · Other software · Alstrasoft · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft EPay Pro 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) payment or (2) send parameter.
- Product
- Epay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005Directory traversal vulnerability in index.php for ProfitCode PayProCart 3.0 allows remote attackers to include arbitrary PHP files via ..CVE-2005-1003 · Other software · Profitcode · reported by MITREHigh 7.5
Directory traversal vulnerability in index.php for ProfitCode PayProCart 3.0 allows remote attackers to include arbitrary PHP files via .. (dot dot) sequences in the modID parameter.
- Product
- Payprocart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005Cross-site scripting (XSS) vulnerability in usrdetails.php in ProfitCode PayProCart 3.0 allows remote attackers to inject arbitrary web script or HTML via the sCVE-2005-1004 · Other software · Profitcode · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in usrdetails.php in ProfitCode PayProCart 3.0 allows remote attackers to inject arbitrary web script or HTML via the sgnuptype parameter.
- Product
- Payprocart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005ProfitCode PayProCart 3.0 allows remote attackers to bypass authentication and gain administrative privileges to the admin control panel, as demonstrated via a CVE-2005-1005 · Other software · Profitcode · reported by MITREHigh 7.5
ProfitCode PayProCart 3.0 allows remote attackers to bypass authentication and gain administrative privileges to the admin control panel, as demonstrated via a direct request to adminshop/index.php with hex-encoded .. sequences in the ftoedit parameter.
- Product
- Payprocart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005Multiple SQL injection vulnerabilities in MetaCart 2.0 for Paypal allow remote attackers to execute arbitrary SQL commands via the (1) intProdID parameter to prCVE-2005-1362 · Other software · Metalinks · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in MetaCart 2.0 for Paypal allow remote attackers to execute arbitrary SQL commands via the (1) intProdID parameter to product.asp, (2) intCatalogID or (3) strSubCatalogID parameters to productsByCategory.asp, (4) chkText, (5) strText, (6) chkPrice, (7) intPrice, (8) chkCat, or (9) strCat parameters to searchAction.asp.
- Product
- Metacart2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005Webseries Payment Application does not properly restrict privileged operations, which allows remote authenticated users to gain privileges by directly accessingCVE-2005-0285 · Other software · Bottomline · reported by MITREMedium 4.6
Webseries Payment Application does not properly restrict privileged operations, which allows remote authenticated users to gain privileges by directly accessing certain URLs.
- Product
- Webseries Payment Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005Multiple SQL injection vulnerabilities in ESMI PayPal Storefront allow remote attackers to execute arbitrary SQL commands via the (1) idpages parameter to pagesCVE-2005-0935 · Other software · Esmi · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in ESMI PayPal Storefront allow remote attackers to execute arbitrary SQL commands via the (1) idpages parameter to pages.php or the (2) id2 parameter to products1.php.
- Product
- Paypal Storefront
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2005Cross-site scripting (XSS) vulnerability in downloadform.php in E-Store Kit-2 PayPal Edition allows remote attackers to inject arbitrary web script or HTML via CVE-2005-0898 · Other software · Magicscripts · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in downloadform.php in E-Store Kit-2 PayPal Edition allows remote attackers to inject arbitrary web script or HTML via the txn_id parameter.
- Product
- E-store Kit-2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Jan 11, 2005The change password functionality in Bottomline Webseries Payment Application does not require the old password when users enter a new password, which could allCVE-2005-0288 · Other software · Bottomline · reported by MITRELow 3.6
The change password functionality in Bottomline Webseries Payment Application does not require the old password when users enter a new password, which could allow remote authenticated users to change other users' passwords.
- Product
- Webseries Payment Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2005Bottomline Webseries Payment Application allows remote attackers to read arbitrary files on the network via a report template with modified ReportPath or ReportCVE-2005-0287 · Other software · Bottomline · reported by MITREMedium 5
Bottomline Webseries Payment Application allows remote attackers to read arbitrary files on the network via a report template with modified ReportPath or ReportName values.
- Product
- Webseries Payment Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2005Verisign Payflow Link, when running with empty Accepted URL fields, does not properly verify the data in the hidden AMOUNT field, which allows remote attackers CVE-2004-1209 · Other software · Verisign · reported by MITREMedium 5
Verisign Payflow Link, when running with empty Accepted URL fields, does not properly verify the data in the hidden AMOUNT field, which allows remote attackers to modify the price of the items that they purchase.
- Product
- Payflow Link
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infoexchange.xforce.ibmcloud.com
Jan 10, 2005Buffer overflow in InnerMedia DynaZip DUNZIP32.dll file version 5.00.03 and earlier allows remote attackers to execute arbitrary code via a ZIP file containing CVE-2004-1094 · Other software · Checkmark · reported by MITREHigh 10
Buffer overflow in InnerMedia DynaZip DUNZIP32.dll file version 5.00.03 and earlier allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename, as demonstrated using (1) a .rjs (skin) file in RealPlayer 10 through RealPlayer 10.5 (6.0.12.1053), RealOne Player 1 and 2, (2) the Restore Backup function in CheckMark Software Payroll 2004/2005 3.9.6 and earlier, (3) CheckMark MultiLedger before 7.0.2, (4) dtSearch 6.x and 7.x, (5) mcupdmgr.exe and mghtml.exe in McAfee VirusScan 10 Build 10.0.21 and earlier, (6) IBM Lotus Notes before 6.5.5, and other products. NOTE: it is unclear whether this is the same vulnerability as CVE-2004-0575, although the data manipulations are the same.
- Product
- Checkmark Payroll
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.commarc.info
Dec 31, 2004SQL injection vulnerability in (1) mailorder.asp or (2) payonline.asp in CactuShop 5.x allows remote attackers to execute arbitrary SQL commands via the strItemCVE-2004-1881 · Other software · Cactusoft · reported by MITREHigh 7.5
SQL injection vulnerability in (1) mailorder.asp or (2) payonline.asp in CactuShop 5.x allows remote attackers to execute arbitrary SQL commands via the strItems parameter.
- Product
- Cactushop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2004Unknown vulnerability in the "admin of paypal email addresses" in AudienceConnect before 1.0.beta.21 has unknown impact and attack vectors.CVE-2004-2247 · Other software · Goosequill · reported by MITREHigh 10
Unknown vulnerability in the "admin of paypal email addresses" in AudienceConnect before 1.0.beta.21 has unknown impact and attack vectors.
- Product
- Audienceconnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netosvdb.org
Aug 6, 2004comersus_gatewayPayPal.asp in Comersus Cart 5.09, and possibly other versions before 5.098, allows remote attackers to change the prices of items by directly moCVE-2004-0682 · Other software · Comersus Open Technologies · reported by MITREHigh 7.5
comersus_gatewayPayPal.asp in Comersus Cart 5.09, and possibly other versions before 5.098, allows remote attackers to change the prices of items by directly modifying them in the URL.
- Product
- Comersus Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
May 4, 2004isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service via an ISAKMP packet with a malformed Cert Request payload, which causesCVE-2004-0220 · Other software · Openbsd · reported by MITREHigh 10
isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service via an ISAKMP packet with a malformed Cert Request payload, which causes an integer underflow that is used in a malloc operation that is not properly handled, as demonstrated by the Striker ISAKMP Protocol Test Suite.
- Product
- Openbsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2004isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a delete payload containing a large nuCVE-2004-0221 · Other software · Openbsd · reported by MITREMedium 5
isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a delete payload containing a large number of SPIs, which triggers an out-of-bounds read error, as demonstrated by the Striker ISAKMP Protocol Test Suite.
- Product
- Openbsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2004isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a malformed IPSEC SA payload, as demonCVE-2004-0219 · Other software · Openbsd · reported by MITREMedium 5
isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a malformed IPSEC SA payload, as demonstrated by the Striker ISAKMP Protocol Test Suite.
- Product
- Openbsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2004TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via ISAKMP packets containing a Delete payload with a large number of SPICVE-2004-0183 · Other software · Tcpdump · reported by MITREMedium 5
TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via ISAKMP packets containing a Delete payload with a large number of SPI's, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.
- Product
- Tcpdump
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2004isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (infinite loop) via an ISAKMP packet with a zero-length payload, as demoCVE-2004-0218 · Other software · Openbsd · reported by MITREMedium 5
isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (infinite loop) via an ISAKMP packet with a zero-length payload, as demonstrated by the Striker ISAKMP Protocol Test Suite.
- Product
- Openbsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2004The SPP_VerifyPVV function in nCipher payShield SPP library 1.3.12, 1.5.18 and 1.6.18 returns a Status_OK value even if the HSM returns a different status code,CVE-2004-0063 · Other software · Ncipher · reported by MITREHigh 7.5
The SPP_VerifyPVV function in nCipher payShield SPP library 1.3.12, 1.5.18 and 1.6.18 returns a Status_OK value even if the HSM returns a different status code, which could cause applications to make incorrect security-critical decisions, e.g. by accepting an invalid PIN number.
- Product
- Payshield SPP Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2001Avaya Argent Office allows remote attackers to cause a denial of service by sending UDP packets to port 53 with no payload.CVE-2001-1259 · Other software · Avaya · reported by MITREMedium 5
Avaya Argent Office allows remote attackers to cause a denial of service by sending UDP packets to port 53 with no payload.
- Product
- Argent Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordonline.securityfocus.comiss.net
Apr 12, 2000Infonautics getdoc.cgi allows remote attackers to bypass the payment phase for accessing documents via a modified form variable.CVE-2000-0288 · Other software · reported by MITREMedium 5
Infonautics getdoc.cgi allows remote attackers to bypass the payment phase for accessing documents via a modified form variable.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.