Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
410 results · page 6 of 9
Jun 16, 2020In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge).CVE-2020-14213 · Other software · Zammad · reported by MITREMedium 5.4
In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge).
- Product
- Zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2020GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget.CVE-2020-10976 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Feb 14, 2020GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint.CVE-2019-15594 · Websites & servers · Gitlab · reported by support@hackerone.comMedium 4.3
GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comhackerone.com
Feb 14, 2020GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via tCVE-2019-15592 · Websites & servers · Gitlab · reported by support@hackerone.comMedium 4.3
GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comhackerone.com
Feb 13, 2020SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module.CVE-2020-8804 · Other software · Salesagility · reported by MITREMedium 6.5
SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 27, 2020An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriCVE-2019-5474 · Websites & servers · GitLab · reported by support@hackerone.comMedium 6.5
An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions.
- Product
- GitLab EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comgitlab.com
Jan 27, 2020An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.CVE-2019-5466 · Websites & servers · Gitlab · reported by support@hackerone.comMedium 4.3
An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comgitlab.com
Jan 27, 2020An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests aCVE-2019-15590 · Websites & servers · GitLab · reported by support@hackerone.comHigh 7.5
An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration
- Product
- GitLab EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comhackerone.com
Dec 18, 2019An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge CVE-2019-15591 · Websites & servers · Gitlab · reported by support@hackerone.comMedium 6.5
An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Dec 18, 2019An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for CVE-2019-15580 · Websites & servers · Gitlab · reported by support@hackerone.comMedium 6.5
An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Nov 19, 2019In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.CVE-2019-10768 · Other software · Angularjs · reported by report@snyk.ioHigh 7.5
In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.
- Product
- Angularjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgsnyk.io
Nov 1, 2019The Wireless Emergency Alerts (WEA) protocol allows remote attackers to spoof a Presidential Alert because cryptographic authentication is not used, as demonstrCVE-2019-18659 · Other software · Ready · reported by MITREMedium 5.3
The Wireless Emergency Alerts (WEA) protocol allows remote attackers to spoof a Presidential Alert because cryptographic authentication is not used, as demonstrated by MessageIdentifier 4370 in LTE System Information Block 12 (aka SIB12). NOTE: testing inside an RF-isolated shield box suggested that all LTE phones are affected by design (e.g., use of Android versus iOS does not matter); testing in an open RF environment is, of course, contraindicated.
- Product
- Wireless Emergency Alerts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2019SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user.CVE-2019-17305 · Other software · Sugarcrm · reported by MITREHigh 8.8
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user.
- Product
- Sugarcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sugarcrm.comsupport.sugarcrm.com
Oct 7, 2019SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by an Admin user.CVE-2019-17304 · Other software · Sugarcrm · reported by MITREHigh 7.2
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by an Admin user.
- Product
- Sugarcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sugarcrm.comsupport.sugarcrm.com
Oct 7, 2019SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Developer user.CVE-2019-17303 · Other software · Sugarcrm · reported by MITREHigh 8.8
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Developer user.
- Product
- Sugarcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sugarcrm.comsupport.sugarcrm.com
Sep 6, 2019A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beCVE-2016-7398 · Websites & servers · PHP · reported by MITRECritical 9.8
A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.
- Product
- Ext-http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.php.netbugs.php.net
Sep 5, 2019IBM Intelligent Operations Center V5.1.0 - V5.2.0, IBM Intelligent Operations Center for Emergency Management V5.1.0 - V5.1.0.6, and IBM Water Operations for WaCVE-2019-4321 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Intelligent Operations Center V5.1.0 - V5.2.0, IBM Intelligent Operations Center for Emergency Management V5.1.0 - V5.1.0.6, and IBM Water Operations for Waternamics V5.1.0 - V5.2.1.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 161201.
- Product
- Intelligent Operations Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Jul 15, 2019Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c.CVE-2019-1010304 · Other software · Saleor · reported by josh@bress.netMedium 5.3
Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorrect Access Control. The impact is: Important. The component is: ProductVariant type in GraphQL API. The attack vector is: Unauthenticated user can access the GraphQL API (which is by default publicly exposed under `/graphql/` URL) and fetch products data which may include admin-restricted shop's revenue data. The fixed version is: 2.3.1.
- Product
- Saleor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2019Linear eMerge E3-Series devices allow Privilege Escalation.CVE-2019-7258 · Other software · Nortekcontrol · reported by MITREHigh 8.8
Linear eMerge E3-Series devices allow Privilege Escalation.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow Unrestricted File Upload.CVE-2019-7257 · Other software · Nortekcontrol · reported by MITRECritical 10
Linear eMerge E3-Series devices allow Unrestricted File Upload.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Nice Linear eMerge E3-Series OS Command Injection VulnerabilityCVE-2019-7256 · Other software · Nice · reported by MITREExploitedCritical 9.8
Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution.
- Product
- Linear eMerge E3-Series
- On CISA’s list since
- Mar 25, 2024 (federal fix deadline Apr 15, 2024)
- What to do
- Attackers are using this now. Install Nice’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Jul 2, 2019Linear eMerge E3-Series devices allow XSS.CVE-2019-7255 · Other software · Nortekcontrol · reported by MITREMedium 6.1
Linear eMerge E3-Series devices allow XSS.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow File Inclusion.CVE-2019-7254 · Other software · Nortekcontrol · reported by MITREHigh 7.5
Linear eMerge E3-Series devices allow File Inclusion.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow Directory Traversal.CVE-2019-7253 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices allow Directory Traversal.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices have Default Credentials.CVE-2019-7252 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices have Default Credentials.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).CVE-2019-7262 · Other software · Nortekcontrol · reported by MITREHigh 8.8
Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices have Hard-coded Credentials.CVE-2019-7261 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices have Hard-coded Credentials.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices have Cleartext Credentials in a Database.CVE-2019-7260 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices have Cleartext Credentials in a Database.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure.CVE-2019-7259 · Other software · Nortekcontrol · reported by MITREHigh 8.8
Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge 50P/5000P devices allow Cross-Site Request Forgery (CSRF).CVE-2019-7270 · Other software · Nortekcontrol · reported by MITREHigh 8.8
Linear eMerge 50P/5000P devices allow Cross-Site Request Forgery (CSRF).
- Product
- Linear Emerge 50p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Jul 2, 2019Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution.CVE-2019-7269 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution.
- Product
- Linear Emerge 50p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge 50P/5000P devices allow Unauthenticated File Upload.CVE-2019-7268 · Other software · Nortekcontrol · reported by MITRECritical 10
Linear eMerge 50P/5000P devices allow Unauthenticated File Upload.
- Product
- Linear Emerge 50p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge 50P/5000P devices allow Cookie Path Traversal.CVE-2019-7267 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge 50P/5000P devices allow Cookie Path Traversal.
- Product
- Linear Emerge 50p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge 50P/5000P devices allow Authentication Bypass.CVE-2019-7266 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge 50P/5000P devices allow Authentication Bypass.
- Product
- Linear Emerge 50p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH).CVE-2019-7265 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH).
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow a Stack-based Buffer Overflow on the ARM platform.CVE-2019-7264 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices allow a Stack-based Buffer Overflow on the ARM platform.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices have a Version Control Failure.CVE-2019-7263 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices have a Version Control Failure.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Jul 1, 2019Nortek Linear eMerge 50P/5000P devices have Default Credentials.CVE-2019-7271 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Nortek Linear eMerge 50P/5000P devices have Default Credentials.
- Product
- Linear Emerge 50p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Apr 3, 2019SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operationCVE-2018-20506 · Other software · Sqlite · reported by MITREHigh 8.1
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.
- Product
- Sqlite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgseclists.org
Mar 27, 2019A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged.CVE-2019-3817 · Other software · libcomps · reported by Red HatHigh 7.5
A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
- Product
- libcomps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Feb 1, 2019A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying CVE-2018-16487 · Other software · HackerOne · reported by support@hackerone.comMedium 5.6
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
- Product
- lodash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comsecurity.netapp.com
Oct 30, 2018The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype.CVE-2018-16469 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.
- Product
- merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Oct 23, 2018An issue was discovered in the merge_strings function in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31.CVE-2018-18606 · Other software · GNU · reported by MITREMedium 5.5
An issue was discovered in the merge_strings function in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Oct 23, 2018A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), asCVE-2018-18605 · Other software · GNU · reported by MITREMedium 5.5
A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, because _bfd_add_merge_section mishandles section merges when size is not a multiple of entsize. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Oct 16, 2018Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Merge).CVE-2018-3247 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.5
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Merge). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).
- Product
- MySQL Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Oct 16, 2018Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: Emergency Response System).CVE-2018-3166 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: Emergency Response System). The supported version that is affected is 9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Cruise Fleet Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Cruise Fleet Management accessible data. CVSS 3.0 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
- Product
- Hospitality Cruise Fleet Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Oct 16, 2018Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: Emergency Response System).CVE-2018-3163 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: Emergency Response System). The supported version that is affected is 9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Fleet Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hospitality Cruise Fleet Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Cruise Fleet Management. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).
- Product
- Hospitality Cruise Fleet Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Oct 16, 2018Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: Emergency Response System).CVE-2018-3158 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1
Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: Emergency Response System). The supported version that is affected is 9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Cruise Fleet Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Fleet Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Fleet Management accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
- Product
- Hospitality Cruise Fleet Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Oct 5, 2018A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence ServCVE-2018-15403 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an authenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by crafting an HTTP request that causes the web interface to redirect a request to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.
- Product
- Cisco Emergency Responder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsecuritytracker.com
Aug 23, 2018POSIM EVO 15.13 for Windows includes an "Emergency Override" administrative account that may be accessed through POSIM's "override" feature.CVE-2018-15807 · Other software · Posim · reported by MITREHigh 7.8
POSIM EVO 15.13 for Windows includes an "Emergency Override" administrative account that may be accessed through POSIM's "override" feature. This Override prompt expects a code that is computed locally using a deterministic algorithm. This code may be generated by an attacker and used to bypass any POSIM EVO login prompt.
- Product
- EVO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordversprite.comversprite.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.