Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

570new WordPress flaws this week

391,397entries in the database

5,712 results · page 61 of 115

Aug 9, 2019The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.CVE-2019-14799 · WordPress plugins & themes · reported by MITREMedium 6.1
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.
Product
FV Flowplayer Video Player
Fixed in
7.3.14.727
What to do
Update FV Flowplayer Video Player to 7.3.14.727 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 8, 2019The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys.CVE-2018-20954 · Other software · Mailpile · reported by MITREHigh 7.5
The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys.
Product
Mailpile
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 8, 2019A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthentiCVE-2019-1955 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device. The vulnerability is due to incomplete input and validation checking mechanisms for certain SPF messages that are sent to an affected device. An attacker could exploit this vulnerability by sending a customized SPF packet to an affected device. A successful exploit could allow the attacker to bypass the header filters that are configured for the affected device, which could allow malicious content to pass through the device.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Aug 7, 2019In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115).CVE-2016-10810 · Websites & servers · Cpanel · reported by MITREHigh 8.8
In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 6, 2019cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF scripts (SEC-152).CVE-2016-10793 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF scripts (SEC-152).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141).CVE-2016-10792 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email.CVE-2019-14664 · Other software · Enigmail · reported by MITREMedium 6.5
In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, he unknowingly leaks the plaintext of the encrypted message part(s) back to the attacker. This attack variant bypasses protection mechanisms implemented after the "EFAIL" attacks.
Product
Enigmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Aug 5, 2019In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).CVE-2017-18479 · Websites & servers · Cpanel · reported by MITREMedium 6.5
In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).CVE-2017-18473 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 5, 2019cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162).CVE-2016-10769 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159).CVE-2016-10767 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 5, 2019cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).CVE-2017-18466 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).CVE-2017-18437 · Websites & servers · Cpanel · reported by MITREMedium 4.4
cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).CVE-2017-18433 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302).CVE-2017-18415 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).CVE-2017-18403 · Websites & servers · Cpanel · reported by MITREMedium 6.3
cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).CVE-2017-18393 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306).CVE-2017-18382 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).CVE-2016-10816 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).CVE-2016-10815 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96).CVE-2016-10827 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts (SEC-411).CVE-2018-20934 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts (SEC-411).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80).CVE-2016-10847 · Websites & servers · Cpanel · reported by MITREHigh 8.1
cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65).CVE-2016-10859 · Websites & servers · Cpanel · reported by MITREHigh 8.1
cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).CVE-2016-10857 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396).CVE-2018-20898 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445).CVE-2018-20880 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).CVE-2019-14410 · Websites & servers · Cpanel · reported by MITRELow 3.3
Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).CVE-2019-14403 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452).CVE-2018-20863 · Websites & servers · Cpanel · reported by MITRECritical 9.8
cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).CVE-2019-14387 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name.CVE-2017-18380 · Other software · EDX · reported by MITREHigh 7.5
edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name.
Product
Edx-platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com groups.google.com
Jul 29, 2019edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.CVE-2016-10765 · Other software · EDX · reported by MITREMedium 5.3
edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.
Product
Edx-platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open.edx.org open.edx.org
Jul 29, 2019A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages.CVE-2019-1105 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4
A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user. The security update addresses the vulnerability by correcting how Outlook for Android parses specially crafted email messages.
Product
Microsoft Outlook for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com portal.msrc.microsoft.com
Jul 29, 2019Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link.CVE-2019-1020018 · Other software · Discourse · reported by josh@bress.netHigh 7.3
Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link.
Product
Discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 28, 2019An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicCVE-2019-14364 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpx_name wp-admin/admin-ajax.php POST parameter.
Product
Email Subscribers & Newsletters
Affected
4.1.6 to 4.1.6
What to do
Affects 4.1.6 to 4.1.6. Update Email Subscribers & Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 23, 2019Vulnerability in the Siebel Core - Common Components component of Oracle Siebel CRM (subcomponent: Email).CVE-2019-2779 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.2
Vulnerability in the Siebel Core - Common Components component of Oracle Siebel CRM (subcomponent: Email). Supported versions that are affected are 19.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel Core - Common Components. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Core - Common Components accessible data. CVSS 3.0 Base Score 4.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N).
Product
Siebel Core - Common Components
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Jul 23, 2019A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resultinCVE-2019-11706 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulting in a crash. This vulnerability affects Thunderbird < 60.7.1.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org security.gentoo.org
Jul 23, 2019A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in aCVE-2019-11705 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org security.gentoo.org
Jul 23, 2019A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting CVE-2019-11704 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org security.gentoo.org
Jul 23, 2019A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a poteCVE-2019-11703 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org security.gentoo.org
Jul 19, 2019A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress.CVE-2019-13569 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
Product
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters
Affected
up to 4.1.7
What to do
Affects up to 4.1.7. Update A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jul 19, 2019MDaemon Webmail (formerly WorldClient) has CSRF.CVE-2018-17792 · Other software · Altn · reported by MITREHigh 8.8
MDaemon Webmail (formerly WorldClient) has CSRF.
Product
Mdaemon Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 19, 2019index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=create, tg=site&item=4, tg=admdir&idx=mdb&idCVE-2019-13977 · Other software · Ovidentia · reported by MITREMedium 5.4
index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=create, tg=site&item=4, tg=admdir&idx=mdb&id=1, tg=notes&idx=Create, tg=admfaqs&idx=Add, or tg=admoc&idx=addoc&item=.
Product
Ovidentia
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jul 18, 2019MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure.CVE-2019-1010246 · Other software · MailCleaner · reported by josh@bress.netHigh 7.5
MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure (e.g. username, password). The component is: The API call in the function allowAction() in NewslettersController.php. The attack vector is: HTTP Get request. The fixed version is: c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9.
Product
MailCleaner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 17, 2019Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application.CVE-2019-8932 · Other software · Rdbrck · reported by MITREHigh 7.5
Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application.
Product
Shift
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.tryshift.com support.tryshift.com
Jul 17, 2019Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application.CVE-2019-8931 · Other software · Rdbrck · reported by MITREHigh 7.5
Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application.
Product
Shift
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.tryshift.com support.tryshift.com
Jul 17, 2019Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application.CVE-2019-12914 · Other software · Rdbrck · reported by MITREHigh 7.5
Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application.
Product
Shift
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.tryshift.com support.tryshift.com
Jul 17, 2019Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application.CVE-2019-12913 · Other software · Rdbrck · reported by MITREMedium 5.5
Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application.
Product
Shift
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.tryshift.com support.tryshift.com
Jul 17, 2019Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application.CVE-2019-12912 · Other software · Rdbrck · reported by MITREMedium 5.5
Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application.
Product
Shift
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.tryshift.com support.tryshift.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.