Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
316 results · page 6 of 7
Feb 5, 2019Insufficient output sanitization in the Automic Web Interface (AWI), in CA Automic Workload Automation 12.0 to 12.2, allow attackers to potentially conduct persCVE-2019-6504 · Other software · CA Technologies - A Broadcom Company · reported by vuln@ca.comMedium 6.1
Insufficient output sanitization in the Automic Web Interface (AWI), in CA Automic Workload Automation 12.0 to 12.2, allow attackers to potentially conduct persistent cross site scripting (XSS) attacks via a crafted object.
- Product
- CA Automic Workload Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comcommunities.ca.com
Jan 9, 2019SQL injection vulnerability in the RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH InteCVE-2018-16188 · Other software · RICOH COMPANY, LTD. · reported by vultures@jpcert.or.jpCritical 9.8
SQL injection vulnerability in the RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.3 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- RICOH Interactive Whiteboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019The RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive Whiteboard Controller TCVE-2018-16187 · Other software · RICOH COMPANY, LTD. · reported by vultures@jpcert.or.jpMedium 5.9
The RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.3 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) does not verify its server certificates, which allows man-in-the-middle attackers to eversdrop on encrypted communication.
- Product
- RICOH Interactive Whiteboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1CVE-2018-16186 · Other software · RICOH COMPANY, LTD. · reported by vultures@jpcert.or.jpHigh 8.8
RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.1 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) uses hard-coded credentials, which may allow an attacker on the same network segments to login to the administrators settings screen and change the configuration.
- Product
- RICOH Interactive Whiteboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1CVE-2018-16185 · Other software · RICOH COMPANY, LTD. · reported by vultures@jpcert.or.jpHigh 7.8
RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.1 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) allows remote attackers to execute a malicious program.
- Product
- RICOH Interactive Whiteboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019RICOH Interactive Whiteboard D2200 V1.6 to V2.2, D5500 V1.6 to V2.2, D5510 V1.6 to V2.2, and the display versions with RICOH Interactive Whiteboard Controller TCVE-2018-16184 · Other software · RICOH COMPANY, LTD. · reported by vultures@jpcert.or.jpCritical 9.8
RICOH Interactive Whiteboard D2200 V1.6 to V2.2, D5500 V1.6 to V2.2, D5510 V1.6 to V2.2, and the display versions with RICOH Interactive Whiteboard Controller Type1 V1.6 to V2.2 attached (D5520, D6500, D6510, D7500, D8400) allows remote attackers to execute arbitrary commands via unspecified vectors.
- Product
- RICOH Interactive Whiteboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2018PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896.CVE-2018-20530 · Other software · Website Seller Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896.
- Product
- Website Seller Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuku90.wordpress.comsuku90.wordpress.com
Dec 23, 2018In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creatiCVE-2018-20420 · Other software · Weberp · reported by MITREMedium 4.9
In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the TemplateName parameter.
- Product
- Weberp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2018An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06.CVE-2018-19925 · Other software · Sales & Company Management System Project · reported by MITRECritical 9.8
An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. It has SQL injection via the member/member_order.php type parameter, related to the O_state parameter.
- Product
- Sales & Company Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2018An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06.CVE-2018-19924 · Other software · Sales & Company Management System Project · reported by MITREMedium 6.1
An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. An email address can be modified in between the request for a validation code and the entry of the validation code, leading to storage of an XSS payload contained in the modified address.
- Product
- Sales & Company Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2018An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06.CVE-2018-19923 · Other software · Sales & Company Management System Project · reported by MITREHigh 8.8
An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. There is member/member_email.php?action=edit CSRF.
- Product
- Sales & Company Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2018An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06.CVE-2018-19654 · Other software · Sales & Company Management System Project · reported by MITREHigh 7.5
An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. There is a discrepancy in username checking between a component that does string validation, and a component that is supposed to query a MySQL database. Thus, it is possible to register a new account with a duplicate username, as demonstrated by use of the test%c2 string when a test account already exists.
- Product
- Sales & Company Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2018PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name.CVE-2018-15896 · Other software · Website Seller Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name.
- Product
- Website Seller Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2018Becton, Dickinson and Company (BD) Alaris Plus medical syringe pumps (models Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA) versions 2.3.6 and prior are affeCVE-2018-14786 · Other software · Becton, Dickinson and Company · reported by ics-cert@hq.dhs.govCritical 9.4
Becton, Dickinson and Company (BD) Alaris Plus medical syringe pumps (models Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA) versions 2.3.6 and prior are affected by an improper authentication vulnerability where the software does not perform authentication for functionality that requires a provable user identity, where it may allow a remote attacker to gain unauthorized access to various Alaris Syringe pumps and impact the intended operation of the pump when it is connected to a terminal server via the serial port.
- Product
- Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbd.comsecurityfocus.com
Aug 6, 2018Xiao5uCompany 1.7 has CSRF via admin/Admin.asp.CVE-2018-14960 · Other software · Xiao5ucompany Project · reported by MITREHigh 8.8
Xiao5uCompany 1.7 has CSRF via admin/Admin.asp.
- Product
- Xiao5ucompany
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.whiterabbitxyj.comgithub.com
Aug 3, 2018PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name, Last name, Address 1, City, State, and Company name fields.CVE-2018-14541 · Other software · Readymadeb2bscript · reported by MITREMedium 5.4
PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name, Last name, Address 1, City, State, and Company name fields.
- Product
- Basic B2b
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgkaim.comexploit-db.com
Jul 23, 2018Feedback.asp in Xiao5uCompany 1.7 has XSS because the XSS protection mechanism in Safe.asp is insufficient (for example, it considers SCRIPT and IMG elements, bCVE-2018-14527 · Other software · Xiao5ucompany Project · reported by MITREMedium 6.1
Feedback.asp in Xiao5uCompany 1.7 has XSS because the XSS protection mechanism in Safe.asp is insufficient (for example, it considers SCRIPT and IMG elements, but does not consider VIDEO elements).
- Product
- Xiao5ucompany
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2018An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03.CVE-2018-14441 · Other software · SSH Companywebsite Project · reported by MITRECritical 9.8
An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03. admin/admin/fileUploadAction_fileUpload.action allows arbitrary file upload, as demonstrated by a .jsp file with the image/jpeg content type.
- Product
- SSH Companywebsite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2018An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03.CVE-2018-14440 · Other software · SSH Companywebsite Project · reported by MITRECritical 9.8
An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03. SQL injection exists via the admin/noticeManageAction_queryNotice.action noticeInfo parameter.
- Product
- SSH Companywebsite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPSimulator EH2, EH3, ES2, SE, SS2 and AHSICVE-2018-10594 · Other software · ICS-CERT · reported by ics-cert@hq.dhs.govCritical 9.8
Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPSimulator EH2, EH3, ES2, SE, SS2 and AHSIM_5x0, AHSIM_5x1) utilize a fixed-length stack buffer where an unverified length value can be read from the network packets via a specific network port, causing the buffer to be overwritten. This may allow remote code execution, cause the application to crash, or result in a denial-of-service condition in the application server.
- Product
- Delta Industrial Automation COMMGR and accompanying PLC Simulators (DVPSimulator EH2, EH3, ES2, SE, SS2 and AHSIM_5x0, AHSIM_5x1)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
May 24, 2018A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, KiestraCVE-2018-10595 · Other software · Becton, Dickinson and Company · reported by ics-cert@hq.dhs.govMedium 6.3
A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in loss or corruption of data.
- Product
- Kiestra and InoqulA systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govbd.com
May 24, 2018A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authorized user with access to a privileged accouCVE-2018-10593 · Other software · Becton, Dickinson and Company · reported by ics-cert@hq.dhs.govMedium 5.6
A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in data corruption.
- Product
- Kiestra and InoqulA systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govbd.com
Apr 30, 2018BigTree before 4.2.22 has XSS in the Users management page via the name or company field.CVE-2018-10364 · Other software · Bigtreecms · reported by MITREMedium 5.4
BigTree before 4.2.22 has XSS in the Users management page via the name or company field.
- Product
- Bigtree CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2018IBOS 4.4.3 has XSS via a company full name.CVE-2018-9130 · Other software · Ibos · reported by MITREMedium 6.1
IBOS 4.4.3 has XSS via a company full name.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcnonce.github.iogithub.com
Feb 9, 2018Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of jaCVE-2017-1000506 · Other software · Mautic · reported by MITREMedium 6.1
Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code.
- Product
- Mautic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2018SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request.CVE-2018-5985 · Other software · Livecrm · reported by MITRECritical 9.8
SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request.
- Product
- Livecrm Saas Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jan 17, 2018Vulnerability in the PeopleSoft Enterprise HCM Human Resources component of Oracle PeopleSoft Products (subcomponent: Company Dir / Org Chart Viewer).CVE-2018-2654 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the PeopleSoft Enterprise HCM Human Resources component of Oracle PeopleSoft Products (subcomponent: Company Dir / Org Chart Viewer). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise HCM Human Resources, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Human Resources accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- PeopleSoft Enterprise HCM Human Resources
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Jan 13, 2018NewsBee allows XSS via the Company Name field in the Settings under admin/admin.php.CVE-2018-5687 · Other software · Newsbee Project · reported by MITREMedium 4.8
NewsBee allows XSS via the Company Name field in the Settings under admin/admin.php.
- Product
- Newsbee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter.CVE-2017-17956 · Websites & servers · PHP Multivendor Ecommerce Project · reported by MITREMedium 6.1
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter.
- Product
- PHP Multivendor Ecommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2017A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors.CVE-2017-10905 · Other software · The Qt Company · reported by vultures@jpcert.or.jpMedium 5.3
A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors.
- Product
- Qt for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2017Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.CVE-2017-10904 · Other software · The Qt Company · reported by vultures@jpcert.or.jpCritical 9.8
Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
- Product
- Qt for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2017FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or company/index.php c parameter.CVE-2017-17587 · Other software · Indiamart Clone Project · reported by MITRECritical 9.8
FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or company/index.php c parameter.
- Product
- Indiamart Clone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 13, 2017FS Linkedin Clone 1.0 has SQL Injection via the group.php grid parameter, profile.php fid parameter, or company_details.php id parameter.CVE-2017-17580 · Other software · Linkedin Clone Project · reported by MITRECritical 9.8
FS Linkedin Clone 1.0 has SQL Injection via the group.php grid parameter, profile.php fid parameter, or company_details.php id parameter.
- Product
- Linkedin Clone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Aug 8, 2017Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User and Company Profile).CVE-2017-10186 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User and Company Profile). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle iStore accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Product
- iStore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Jun 29, 2017A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA Journal Service, VersionCVE-2017-6022 · Other software · BD · reported by ics-cert@hq.dhs.govCritical 9.8
A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA Journal Service, Version 1.0.51 and prior versions. They use hard-coded passwords to access the BD Kiestra Database, which could be leveraged to compromise the confidentiality of limited PHI/PII information stored in the BD Kiestra Database.
- Product
- Performa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Jun 16, 2017The "Fountain Trust Mobile Banking" by FOUNTAIN TRUST COMPANY app before 3.2.0 -- aka fountain-trust-mobile-banking/id891343006 for iOS does not verify X.509 ceCVE-2017-9599 · Other software · Fountaintrust · reported by MITREMedium 5.9
The "Fountain Trust Mobile Banking" by FOUNTAIN TRUST COMPANY app before 3.2.0 -- aka fountain-trust-mobile-banking/id891343006 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Fountain Trust Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorditunes.apple.commedium.com
Apr 14, 2017Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in VtigeCVE-2016-1713 · Other software · Vtiger · reported by MITREHigh 7.3
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in test/logo/. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6000.
- Product
- Vtiger CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2017An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7.CVE-2016-9355 · Other software · BD · reported by ics-cert@hq.dhs.govMedium 5.3
An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7. An unauthorized user with physical access to an Alaris 8015 PC unit may be able to obtain unencrypted wireless network authentication credentials and other sensitive technical data by disassembling an Alaris 8015 PC unit and accessing the device's flash memory. Older software versions of the Alaris 8015 PC unit, Version 9.5 and prior versions, store wireless network authentication credentials and other sensitive technical data on the affected device's removable flash memory. Being able to remove the flash memory from the affected device reduces the risk of detection, allowing an attacker to extract stored data at the attacker's convenience.
- Product
- Alaris 8015 PC Unit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Feb 13, 2017An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7, and 8000 PC CVE-2016-8375 · Other software · BD · reported by ics-cert@hq.dhs.govMedium 4.9
An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7, and 8000 PC unit. An unauthorized user with physical access to an affected Alaris PC unit may be able to obtain unencrypted wireless network authentication credentials and other sensitive technical data by disassembling the PC unit and accessing the device's flash memory. The Alaris 8015 PC unit, Version 9.7, and the 8000 PC unit store wireless network authentication credentials and other sensitive technical data on internal flash memory. Accessing the internal flash memory of the affected device would require special tools to extract data and carrying out this attack at a healthcare facility would increase the likelihood of detection.
- Product
- Alaris 8015 PC Unit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Feb 8, 2017IBM System Storage TS3100-TS3200 Tape Library could allow an unauthenticated user with access to the company network, to change a user's password and gain remotCVE-2016-9005 · Other software · IBM Corporation · reported by psirt@us.ibm.comCritical 9.8
IBM System Storage TS3100-TS3200 Tape Library could allow an unauthenticated user with access to the company network, to change a user's password and gain remote access to the system.
- Product
- System Storage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Oct 19, 2014The Taking Your Company Public (aka biz.app4mobile.app_016e43d03ee54d1facd6c9532a00e724.app) application 1.28.44.441 for Android does not verify X.509 certificaCVE-2014-7336 · Other software · Princetoncorporatesolutions · reported by cret@cert.orgMedium 5.4
The Taking Your Company Public (aka biz.app4mobile.app_016e43d03ee54d1facd6c9532a00e724.app) application 1.28.44.441 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Taking Your Company Public
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 9, 2014The Cisco Class Locator Fast Lane (aka com.tabletkings.mycompany.fastlane.cisco) application for Android does not verify X.509 certificates from SSL servers, whCVE-2014-5710 · Other software · Flane · reported by cret@cert.orgMedium 5.4
The Cisco Class Locator Fast Lane (aka com.tabletkings.mycompany.fastlane.cisco) application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Cisco Class Locator Fast Lane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Jun 19, 2014The East Japan Railway Company JR East Japan application before 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-mCVE-2014-2001 · Other software · Jreast · reported by vultures@jpcert.or.jpMedium 5.8
The East Japan Railway Company JR East Japan application before 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information via a crafted certificate.
- Product
- JR East Japan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2014Directory traversal vulnerability in the R-Company Unzipper application 1.0.1 and earlier for Android allows remote attackers to overwrite or create arbitrary fCVE-2014-1975 · Other software · R-company · reported by vultures@jpcert.or.jpMedium 5.8
Directory traversal vulnerability in the R-Company Unzipper application 1.0.1 and earlier for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.
- Product
- Unzipper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2013Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Company theme before 7.x-1.4 for Drupal allows remote authenticated users with the adminiCVE-2013-1786 · Other software · Devsaran · reported by Red HatLow 2.1
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Company theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Company
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2012Intuit QuickBooks 2009 through 2012 might allow remote attackers to obtain pathname information via the qbwc://docontrol/GetCompanyFile functionality.CVE-2012-2422 · Other software · Intuit · reported by MITRELow 2.9
Intuit QuickBooks 2009 through 2012 might allow remote attackers to obtain pathname information via the qbwc://docontrol/GetCompanyFile functionality.
- Product
- Quickbooks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgsecurityfocus.com
Mar 15, 2012Unspecified vulnerability in the NetFront Life Browser (com.access_company.android.nflifebrowser.lite) application 2.2.0 and 2.3.0 for Android has unknown impacCVE-2012-1485 · Other software · Netfrontlife · reported by MITREHigh 10
Unspecified vulnerability in the NetFront Life Browser (com.access_company.android.nflifebrowser.lite) application 2.2.0 and 2.3.0 for Android has unknown impact and attack vectors.
- Product
- Netfront Life Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2010The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function, and does not have accompanying documentation descriCVE-2010-3492 · Other software · Python · reported by MITREMedium 5
The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function, and does not have accompanying documentation describing how daemon applications should handle unsuccessful calls to the accept function, which makes it easier for remote attackers to conduct denial of service attacks that terminate these applications via network connections.
- Product
- Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.python.orgmandriva.com
Jul 22, 2010index.php in AdPeeps 8.5d1 allows remote attackers to obtain sensitive information via (1) a view_adrates action with an invalid uid parameter, which reveals thCVE-2009-4943 · Other software · Impactsoftcompany · reported by MITREMedium 5
index.php in AdPeeps 8.5d1 allows remote attackers to obtain sensitive information via (1) a view_adrates action with an invalid uid parameter, which reveals the installation path in an error message; or (2) an adminlogin action with a crafted uid parameter, which reveals the version number.
- Product
- Adpeeps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.intern0t.netsecurityfocus.com
Jul 22, 2010Multiple cross-site scripting (XSS) vulnerabilities in index.php in AdPeeps 8.5d1 allow remote attackers to inject arbitrary web script or HTML via the (1) uid CVE-2009-4939 · Other software · Impactsoftcompany · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in index.php in AdPeeps 8.5d1 allow remote attackers to inject arbitrary web script or HTML via the (1) uid parameter, (2) uid parameter in a login_lookup action, (3) uid parameter in an adminlogin action, (4) campaignid parameter in a createcampaign action, (5) type parameter in a view_account_stats action, (6) period parameter in a view_account_stats action, (7) uid parameter in a view_adrates action, (8) accname parameter in an account_confirmation action, (9) loginpass parameter in an account_confirmation action, (10) e9 parameter in a setup_account action, (11) from parameter in an email_advertisers action, (12) message parameter in an email_advertisers action, (13) idno parameter in an edit_ad_package action, (14) Advertiser Name field, (15) First Name field, (16) Last Name field, (17) Address field, (18) Phone Number field, (19) Password Hint field, or (20) URL field; and (21) allow remote authenticated users to inject arbitrary web script or HTML via an unspecified form associated with a view_adrates action.
- Product
- Adpeeps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.intern0t.netosvdb.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.