Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,634 results · page 55 of 73
Jul 3, 2018An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field.CVE-2018-12255 · Other software · Invoiceplane · reported by MITREMedium 6.1
An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field.
- Product
- Invoiceplane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevelopment.invoiceplane.comgithub.com
Jun 30, 2018phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field.CVE-2018-12990 · Websites & servers · Phpwcms · reported by MITREMedium 5.3
phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field.
- Product
- Phpwcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record3xpl01tc0d3r.blogspot.com3xpl01tc0d3r.blogspot.com
Jun 29, 2018onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecms_username and onefilecms_password fields.CVE-2018-12993 · Other software · Onefilecms · reported by MITRECritical 9.8
onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecms_username and onefilecms_password fields.
- Product
- Onefilecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2018In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcB_register_fields in bootstrap.c.CVE-2018-12918 · Other software · PBC Project · reported by MITRECritical 9.8
In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcB_register_fields in bootstrap.c.
- Product
- PBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieldValidator.java thaCVE-2018-1000605 · Websites & servers · Jenkins · reported by MITREHigh 7.4
A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieldValidator.java that allows attackers to impersonate any service that Jenkins connects to.
- Product
- Collabnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS .CVE-2018-1000529 · Other software · Grails · reported by MITREMedium 6.1
Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fixed in 2.2.8.
- Product
- Grails Fields
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2018Improperly implemented option-field processing in the TCP/IP stack on Allen-Bradley L30ERMS safety devices v30 and earlier causes a denial of service.CVE-2017-9312 · Other software · Rockwellautomation · reported by MITREHigh 7.5
Improperly implemented option-field processing in the TCP/IP stack on Allen-Bradley L30ERMS safety devices v30 and earlier causes a denial of service. When a crafted TCP packet is received, the device reboots immediately.
- Product
- Allen-bradley L30erms Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Jun 13, 2018Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue.CVE-2018-12355 · Other software · ENG · reported by MITREMedium 6.1
Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue.
- Product
- Knowage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2018Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.CVE-2018-12353 · Other software · Knowage-suite · reported by MITREMedium 6.1
Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.
- Product
- Knowage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2018RSS fields can inject new lines into the created email structure, modifying the message body.CVE-2017-7848 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird < 52.5.2.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jun 5, 2018Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any filCVE-2018-11808 · Email & office · Zohocorp · reported by MITRECritical 9.1
Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user (which by default is "NT AUTHORITY / SYSTEM") by sending a specially crafted request to the server.
- Product
- Manageengine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jun 1, 2018There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field.CVE-2018-11552 · Other software · NCH · reported by MITREMedium 6.1
There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field. The vulnerability exists due to insufficient filtration of user-supplied data. A remote attacker can execute arbitrary HTML and script code in a browser in the context of the vulnerable application.
- Product
- Axon PBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jun 1, 2018CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, CVE-2018-11652 · Other software · Cirt.net · reported by MITRECritical 9.8
CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report.
- Product
- Nikto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 30, 2018ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI.CVE-2018-11572 · Other software · Clippercms · reported by MITREMedium 5.4
ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI.
- Product
- Clippercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2018SchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names (aka user_name fields) and group ids (aka gid fields).CVE-2018-10995 · Other software · Schedmd · reported by MITREMedium 5.3
SchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names (aka user_name fields) and group ids (aka gid fields).
- Product
- Slurm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.debian.org
May 28, 2018Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 CVE-2018-11512 · Other software · Creatiwity · reported by MITREMedium 4.8
Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general.
- Product
- Witycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2018Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 allows remote attackerCVE-2018-11332 · Other software · Clippercms · reported by MITREMedium 4.8
Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted site name to the manager/processors/save_settings.processor.php file.
- Product
- Clippercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 22, 2018SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountanCVE-2018-9019 · Other software · Dolibarr · reported by MITRECritical 9.8
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categories_list.php, /accountancy/admin/journals_list.php, /admin/dict.php, /admin/mails_templates.php, or /admin/website.php.
- Product
- Dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2018An issue was discovered in com_fields in Joomla! Core before 3.8.8.CVE-2018-11321 · Websites & servers · Joomla · reported by MITREMedium 6.5
An issue was discovered in com_fields in Joomla! Core before 3.8.8. Inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 17, 2018PrinterOn Enterprise 4.1.3 suffers from multiple authenticated stored XSS vulnerabilities via the (1) department field in the printer configuration, (2) descripCVE-2018-10326 · Other software · Printeron · reported by MITREMedium 5.4
PrinterOn Enterprise 4.1.3 suffers from multiple authenticated stored XSS vulnerabilities via the (1) department field in the printer configuration, (2) description field in the print server configuration, and (3) username field for authentication to print as guest.
- Product
- Printeron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2018A vulnerability in the web-based management interface of Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to conduct aCVE-2018-0270 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.8
A vulnerability in the web-based management interface of Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and alter the data of existing users and groups on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. If the user has administrative privileges, the attacker could create a new, privileged account to obtain full control over the device interface. This vulnerability affects Connected Grid Network Management System, if running a software release prior to IoT-FND Release 3.0; and IoT Field Network Director, if running a software release prior to IoT-FND Release 4.1.1-6 or 4.2.0-123. Cisco Bug IDs: CSCvi02448.
- Product
- IOT Field Network Director
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
May 12, 2018ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.CVE-2018-11011 · Other software · Halo · reported by MITREMedium 6.1
ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2018NULL pointer dereference in the _fields_add function in fields.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service (aCVE-2018-10775 · Other software · Bibutils Project · reported by MITREMedium 6.5
NULL pointer dereference in the _fields_add function in fields.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service (application crash), as demonstrated by end2xml.
- Product
- Bibutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
May 4, 2018The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.CVE-2018-10752 · WordPress plugins & themes · reported by MITREMedium 4.8
The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.
- Affected
- 0.6 to 0.6
- What to do
- Affects 0.6 to 0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpastebin.comexploit-db.com
May 4, 2018In Lantech IDS 2102 2.0 and prior, nearly all input fields allow for arbitrary input on the device.CVE-2018-8869 · Other software · Lantech · reported by ics-cert@hq.dhs.govCritical 9.8
In Lantech IDS 2102 2.0 and prior, nearly all input fields allow for arbitrary input on the device. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Product
- IDS 2102
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Apr 30, 2018BigTree before 4.2.22 has XSS in the Users management page via the name or company field.CVE-2018-10364 · Other software · Bigtreecms · reported by MITREMedium 5.4
BigTree before 4.2.22 has XSS in the Users management page via the name or company field.
- Product
- Bigtree CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2018Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field.CVE-2018-10570 · Other software · Frogcms Project · reported by MITREMedium 4.8
Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field.
- Product
- Frogcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2018EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/indexCVE-2018-10527 · Other software · Easycms Project · reported by MITREMedium 5.4
EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.html#listarticle URI.
- Product
- Easycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2018D-Link DIR-615 2.5.17 devices allow Remote Code Execution via shell metacharacters in the Host field of the System / Traceroute screen.CVE-2018-10431 · Network & remote access · D-link · reported by MITREHigh 7.2
D-Link DIR-615 2.5.17 devices allow Remote Code Execution via shell metacharacters in the Host field of the System / Traceroute screen.
- Product
- Dir-615 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2018Cosmo 1.0.0Beta6 allows attackers to execute arbitrary PHP code via the Database Prefix field on the Database Info screen of install.php.CVE-2018-10429 · Other software · Cosmocms · reported by MITRECritical 9.8
Cosmo 1.0.0Beta6 allows attackers to execute arbitrary PHP code via the Database Prefix field on the Database Info screen of install.php.
- Product
- Cosmo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2018mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field.CVE-2018-10424 · Other software · 1234n · reported by MITRELow 2.7
mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2018The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS.CVE-2018-10309 · WordPress plugins & themes · reported by MITREMedium 5.4
The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS.
- Product
- Responsive Cookie Consent
- Fixed in
- 1.8
- What to do
- Update Responsive Cookie Consent to 1.8 or newer.
Full record and what to do →NVD recordgist.github.comwordpress.org
Apr 23, 2018Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input fieldCVE-2018-10234 · WordPress plugins & themes · reported by MITREMedium 4.8
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options§ion=account page.
- Product
- Authenticated Cross site Scripting exists in the User Profile & Membership
- Fixed in
- 2.0.11
- What to do
- Update Authenticated Cross site Scripting exists in the User Profile & Membership to 2.0.11 or newer.
Full record and what to do →NVD recordgithub.comwordpress.org
Apr 22, 2018The Ericsson-LG iPECS NMS A.1Ac login portal has a SQL injection vulnerability in the User ID and password fields that allows users to bypass the login page andCVE-2018-9245 · Other software · Ericssonlg · reported by MITRECritical 9.8
The Ericsson-LG iPECS NMS A.1Ac login portal has a SQL injection vulnerability in the User ID and password fields that allows users to bypass the login page and execute remote code on the operating system.
- Product
- Ipecs NMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comexploit-db.com
Apr 18, 2018An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPT_NAME field when modifying existing scriptsCVE-2018-5337 · Email & office · Zohocorp · reported by MITRECritical 9.8
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPT_NAME field when modifying existing scripts.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.comnccgroup.trust
Apr 16, 2018iScripts UberforX 2.2 has Stored XSS in the "manage_settings" section of the Admin Panel via a value field to the /cms?section=manage_settings&action=edit URI.CVE-2018-10136 · Other software · Iscripts · reported by MITREMedium 6.1
iScripts UberforX 2.2 has Stored XSS in the "manage_settings" section of the Admin Panel via a value field to the /cms?section=manage_settings&action=edit URI.
- Product
- Uberforx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.compastebin.com
Apr 16, 2018Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admCVE-2018-10118 · Other software · Monstra · reported by MITREMedium 4.8
Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php.
- Product
- Monstra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Apr 13, 2018ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can CVE-2016-9646 · Other software · ikiwiki · reported by security@debian.orgMedium 5.3
ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can be abused to lead to commit metadata forgery.
- Product
- ikiwiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2018PHP Scripts Mall Student Profile Management System Script v2.0.6 has XSS via the Name field to list_student.php.CVE-2018-6935 · Other software · Student Profile Management System Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Student Profile Management System Script v2.0.6 has XSS via the Name field to list_student.php.
- Product
- Student Profile Management System Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.com0day4u.wordpress.com
Apr 12, 2018PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action.CVE-2018-6904 · Other software · CAR Rental Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.com0day4u.wordpress.com
Apr 12, 2018PHP Scripts Mall Image Sharing Script 1.3.3 has XSS via the Full Name field in an Edit Profile action.CVE-2018-6902 · Other software · Image Sharing Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Image Sharing Script 1.3.3 has XSS via the Full Name field in an Edit Profile action.
- Product
- Image Sharing Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.com0day4u.wordpress.com
Apr 12, 2018PHP Scripts Mall Website Broker Script 3.0.6 has XSS via the Last Name field on the My Profile page.CVE-2018-6900 · Other software · Website Broker Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Website Broker Script 3.0.6 has XSS via the Last Name field on the My Profile page.
- Product
- Website Broker Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.com0day4u.wordpress.com
Apr 11, 2018The Near Field Communication (NFC) module in Mate 9 Huawei mobile phones with the versions before MHA-L29B 8.0.0.366(C567) has an information leak vulnerabilityCVE-2018-7930 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.7
The Near Field Communication (NFC) module in Mate 9 Huawei mobile phones with the versions before MHA-L29B 8.0.0.366(C567) has an information leak vulnerability due to insufficient validation on data transfer requests. When an affected mobile phone sends files to an attacker's mobile phone using the NFC function, the attacker can obtain arbitrary files from the mobile phone, causing information leaks.
- Product
- Mate 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2018Frog CMS 0.9.5 has XSS via the name field of a new "File" or "Directory" on the admin/?/plugin/file_manager/browse/ screen.CVE-2018-9992 · Other software · Frog CMS Project · reported by MITREMedium 4.8
Frog CMS 0.9.5 has XSS via the name field of a new "File" or "Directory" on the admin/?/plugin/file_manager/browse/ screen.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 10, 2018Coship RT3052 4.0.0.48 devices allow XSS via a crafted SSID field on the "Wireless Setting - Basic" screen.CVE-2018-8772 · Other software · Coship · reported by MITREMedium 6.1
Coship RT3052 4.0.0.48 devices allow XSS via a crafted SSID field on the "Wireless Setting - Basic" screen.
- Product
- Rt3052 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.com0day4u.wordpress.com
Apr 9, 2018The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.CVE-2018-9864 · WordPress plugins & themes · reported by MITREMedium 6.1
The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.
- Product
- WP Live Chat Support
- Fixed in
- 8.0.06
- What to do
- Update WP Live Chat Support to 8.0.06 or newer.
Full record and what to do →NVD recordwordpress.orggubello.me
Apr 9, 2018PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to searchbyid.php (aka the "View Search By Id" screen).CVE-2018-9857 · Other software · Match Clone Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to searchbyid.php (aka the "View Search By Id" screen).
- Product
- Match Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.comexploit-db.com
Apr 7, 2018register.jsp in Coremail XT3.0 allows stored XSS, as demonstrated by the third form field to a URI under register/, a different vulnerability than CVE-2015-6942CVE-2018-9330 · Other software · Coremail · reported by MITREMedium 5.4
register.jsp in Coremail XT3.0 allows stored XSS, as demonstrated by the third form field to a URI under register/, a different vulnerability than CVE-2015-6942.
- Product
- Coremail XT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyoutube.comyoutube.com
Apr 5, 2018An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1.CVE-2018-1096 · Other software · Foreman Project · reported by Red HatMedium 6.5
An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database.
- Product
- Foreman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprojects.theforeman.orgaccess.redhat.com
Apr 4, 2018In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count thCVE-2018-6918 · Other software · FreeBSD · reported by secteam@freebsd.orgHigh 7.5
In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able to send an arbitrary packet to cause the machine to crash.
- Product
- FreeBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.