Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,117 results · page 62 of 83
Aug 4, 2018The Add page option in my little forum 2.4.12 allows XSS via the Title field.CVE-2018-14936 · Other software · Mylittleforum · reported by MITREMedium 4.8
The Add page option in my little forum 2.4.12 allows XSS via the Title field.
- Product
- MY Little Forum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordowendarlene.comowendarlene.com
Aug 3, 2018PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name, Last name, Address 1, City, State, and Company name fields.CVE-2018-14541 · Other software · Readymadeb2bscript · reported by MITREMedium 5.4
PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name, Last name, Address 1, City, State, and Company name fields.
- Product
- Basic B2b
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgkaim.comexploit-db.com
Aug 3, 2018Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuario.jsf "Nome Completo" (aka user fullname) field.CVE-2018-14924 · Other software · Matera · reported by MITREMedium 6.1
Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuario.jsf "Nome Completo" (aka user fullname) field.
- Product
- Banco
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comexchange.xforce.ibmcloud.com
Jul 30, 2018In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field.CVE-2017-7482 · Other software · [UNKNOWN] · reported by Red HatHigh 7.8
In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation.
- Product
- kernel:
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Jul 27, 2018A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript inCVE-2017-15125 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that CSP (Content Security Policy) prevents exploitation of this XSS however not all browsers support CSP.
- Product
- cloudforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Jul 23, 2018There exists one NULL pointer dereference vulnerability in AP4_JsonInspector::AddField in Ap4Atom.cpp in Bento4 1.5.1-624, which can allow attackers to cause a CVE-2018-14543 · Other software · Axiosys · reported by MITREMedium 5.5
There exists one NULL pointer dereference vulnerability in AP4_JsonInspector::AddField in Ap4Atom.cpp in Bento4 1.5.1-624, which can allow attackers to cause a denial-of-service via a crafted mp4 file. This vulnerability can be triggered by the executable mp4dump.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2018SeaCMS 6.61 has two XSS issues in the admin_config.php file via certain form fields.CVE-2018-14517 · Other software · Seacms · reported by MITREMedium 6.1
SeaCMS 6.61 has two XSS issues in the admin_config.php file via certain form fields.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2018ClipperCMS 1.3.3 has stored XSS via the Full Name field of (1) Security -> Manager Users or (2) Security -> Web Users.CVE-2018-13998 · Other software · Clippercms · reported by MITREMedium 4.8
ClipperCMS 1.3.3 has stored XSS via the Full Name field of (1) Security -> Manager Users or (2) Security -> Web Users.
- Product
- Clippercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2018The mintToken function of a smart contract implementation for DataShieldCoin, an Ethereum token, has an integer overflow that allows the owner of the contract tCVE-2018-13574 · Other software · Datashieldcoin Project · reported by MITREHigh 7.5
The mintToken function of a smart contract implementation for DataShieldCoin, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
- Product
- Datashieldcoin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2018The mintToken function of a smart contract implementation for HashShield, an Ethereum token, has an integer overflow that allows the owner of the contract to seCVE-2018-13545 · Other software · Hashshield Project · reported by MITREHigh 7.5
The mintToken function of a smart contract implementation for HashShield, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
- Product
- Hashshield
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2018TCExam before 14.1.2 has XSS via an ff_ or xl_ field.CVE-2018-13422 · Other software · Tecnick · reported by MITREMedium 6.1
TCExam before 14.1.2 has XSS via an ff_ or xl_ field.
- Product
- Tcexam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2018In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertiCVE-2018-13304 · Other software · Ffmpeg · reported by MITREMedium 6.5
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c, h263dec.c, and mpeg4videodec.c.
- Product
- Ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2018Entrust Datacard Syntera CS 5.x has XSS via the name field of "Domain or Computer Name" in the login page.CVE-2018-13252 · Other software · Entrustdatacard · reported by MITREMedium 6.1
Entrust Datacard Syntera CS 5.x has XSS via the name field of "Domain or Computer Name" in the login page.
- Product
- Syntera Customization Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2018In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction.CVE-2018-3764 · Other software · Nextcloud · reported by support@hackerone.comMedium 4.8
In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.
- Product
- Nextcloud Contacts application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnextcloud.comnextcloud.com
Jul 5, 2018In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interCVE-2018-3763 · Other software · Nextcloud · reported by support@hackerone.comMedium 4.8
In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.
- Product
- Nextcloud Calendar application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnextcloud.comnextcloud.com
Jul 3, 2018An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field.CVE-2018-12255 · Other software · Invoiceplane · reported by MITREMedium 6.1
An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field.
- Product
- Invoiceplane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevelopment.invoiceplane.comgithub.com
Jul 1, 2018ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/pl_web.cgi/util_configlogin_act URI.CVE-2018-13032 · Other software · Ecessa · reported by MITREHigh 8.8
ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/pl_web.cgi/util_configlogin_act URI.
- Product
- Shieldlink Sl175ehq Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jun 30, 2018phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field.CVE-2018-12990 · Websites & servers · Phpwcms · reported by MITREMedium 5.3
phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field.
- Product
- Phpwcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record3xpl01tc0d3r.blogspot.com3xpl01tc0d3r.blogspot.com
Jun 29, 2018onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecms_username and onefilecms_password fields.CVE-2018-12993 · Other software · Onefilecms · reported by MITRECritical 9.8
onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecms_username and onefilecms_password fields.
- Product
- Onefilecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2018In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcB_register_fields in bootstrap.c.CVE-2018-12918 · Other software · PBC Project · reported by MITRECritical 9.8
In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcB_register_fields in bootstrap.c.
- Product
- PBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieldValidator.java thaCVE-2018-1000605 · Websites & servers · Jenkins · reported by MITREHigh 7.4
A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieldValidator.java that allows attackers to impersonate any service that Jenkins connects to.
- Product
- Collabnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS .CVE-2018-1000529 · Other software · Grails · reported by MITREMedium 6.1
Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fixed in 2.2.8.
- Product
- Grails Fields
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2018Improperly implemented option-field processing in the TCP/IP stack on Allen-Bradley L30ERMS safety devices v30 and earlier causes a denial of service.CVE-2017-9312 · Other software · Rockwellautomation · reported by MITREHigh 7.5
Improperly implemented option-field processing in the TCP/IP stack on Allen-Bradley L30ERMS safety devices v30 and earlier causes a denial of service. When a crafted TCP packet is received, the device reboots immediately.
- Product
- Allen-bradley L30erms Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Jun 22, 2018tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h.CVE-2018-12687 · Other software · Tinyexr Project · reported by MITREHigh 7.5
tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h.
- Product
- Tinyexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2018Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue.CVE-2018-12355 · Other software · ENG · reported by MITREMedium 6.1
Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue.
- Product
- Knowage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2018Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.CVE-2018-12353 · Other software · Knowage-suite · reported by MITREMedium 6.1
Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.
- Product
- Knowage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2018RSS fields can inject new lines into the created email structure, modifying the message body.CVE-2017-7848 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird < 52.5.2.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jun 11, 2018An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result "POINT_AT_INFINITY" when CVE-2017-7781 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.9
An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result "POINT_AT_INFINITY" when it should not. A man-in-the-middle attacker could use this to interfere with a connection, resulting in an attacked party computing an incorrect shared secret. This vulnerability affects Firefox < 55.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jun 11, 2018A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling.CVE-2017-5438 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jun 11, 2018tinyexr 0.9.5 has a heap-based buffer over-read in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code.CVE-2018-12092 · Other software · Tinyexr Project · reported by MITRECritical 9.8
tinyexr 0.9.5 has a heap-based buffer over-read in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code.
- Product
- Tinyexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2018elding is a simple web server.CVE-2017-16222 · Other software · HackerOne · reported by support@hackerone.comMedium 5.3
elding is a simple web server. elding is vulnerable to a directory traversal issue, allowing an attacker to access the filesystem by placing "../" in the url. The files accessible, however, are limited to files with a file extension. Sending a GET request to /../../../etc/passwd, for example, will return a 404 on etc/passwd/index.js.
- Product
- elding node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
Jun 5, 2018Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any filCVE-2018-11808 · Email & office · Zohocorp · reported by MITRECritical 9.1
Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user (which by default is "NT AUTHORITY / SYSTEM") by sending a specially crafted request to the server.
- Product
- Manageengine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jun 1, 2018There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field.CVE-2018-11552 · Other software · NCH · reported by MITREMedium 6.1
There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field. The vulnerability exists due to insufficient filtration of user-supplied data. A remote attacker can execute arbitrary HTML and script code in a browser in the context of the vulnerable application.
- Product
- Axon PBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jun 1, 2018CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, CVE-2018-11652 · Other software · Cirt.net · reported by MITRECritical 9.8
CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report.
- Product
- Nikto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 30, 2018ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI.CVE-2018-11572 · Other software · Clippercms · reported by MITREMedium 5.4
ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI.
- Product
- Clippercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2018SchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names (aka user_name fields) and group ids (aka gid fields).CVE-2018-10995 · Other software · Schedmd · reported by MITREMedium 5.3
SchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names (aka user_name fields) and group ids (aka gid fields).
- Product
- Slurm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.debian.org
May 28, 2018Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 CVE-2018-11512 · Other software · Creatiwity · reported by MITREMedium 4.8
Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general.
- Product
- Witycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2018Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 allows remote attackerCVE-2018-11332 · Other software · Clippercms · reported by MITREMedium 4.8
Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted site name to the manager/processors/save_settings.processor.php file.
- Product
- Clippercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 22, 2018SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountanCVE-2018-9019 · Other software · Dolibarr · reported by MITRECritical 9.8
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categories_list.php, /accountancy/admin/journals_list.php, /admin/dict.php, /admin/mails_templates.php, or /admin/website.php.
- Product
- Dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2018An issue was discovered in com_fields in Joomla! Core before 3.8.8.CVE-2018-11321 · Websites & servers · Joomla · reported by MITREMedium 6.5
An issue was discovered in com_fields in Joomla! Core before 3.8.8. Inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 17, 2018PrinterOn Enterprise 4.1.3 suffers from multiple authenticated stored XSS vulnerabilities via the (1) department field in the printer configuration, (2) descripCVE-2018-10326 · Other software · Printeron · reported by MITREMedium 5.4
PrinterOn Enterprise 4.1.3 suffers from multiple authenticated stored XSS vulnerabilities via the (1) department field in the printer configuration, (2) description field in the print server configuration, and (3) username field for authentication to print as guest.
- Product
- Printeron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2018A vulnerability in the web-based management interface of Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to conduct aCVE-2018-0270 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.8
A vulnerability in the web-based management interface of Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and alter the data of existing users and groups on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. If the user has administrative privileges, the attacker could create a new, privileged account to obtain full control over the device interface. This vulnerability affects Connected Grid Network Management System, if running a software release prior to IoT-FND Release 3.0; and IoT Field Network Director, if running a software release prior to IoT-FND Release 4.1.1-6 or 4.2.0-123. Cisco Bug IDs: CSCvi02448.
- Product
- IOT Field Network Director
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
May 12, 2018ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.CVE-2018-11011 · Other software · Halo · reported by MITREMedium 6.1
ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2018NULL pointer dereference in the _fields_add function in fields.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service (aCVE-2018-10775 · Other software · Bibutils Project · reported by MITREMedium 6.5
NULL pointer dereference in the _fields_add function in fields.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service (application crash), as demonstrated by end2xml.
- Product
- Bibutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
May 4, 2018The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.CVE-2018-10752 · WordPress plugins & themes · reported by MITREMedium 4.8
The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.
- Affected
- 0.6 to 0.6
- What to do
- Affects 0.6 to 0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpastebin.comexploit-db.com
May 4, 2018In Lantech IDS 2102 2.0 and prior, nearly all input fields allow for arbitrary input on the device.CVE-2018-8869 · Other software · Lantech · reported by ics-cert@hq.dhs.govCritical 9.8
In Lantech IDS 2102 2.0 and prior, nearly all input fields allow for arbitrary input on the device. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Product
- IDS 2102
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Apr 30, 2018BigTree before 4.2.22 has XSS in the Users management page via the name or company field.CVE-2018-10364 · Other software · Bigtreecms · reported by MITREMedium 5.4
BigTree before 4.2.22 has XSS in the Users management page via the name or company field.
- Product
- Bigtree CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2018Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field.CVE-2018-10570 · Other software · Frogcms Project · reported by MITREMedium 4.8
Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field.
- Product
- Frogcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2018EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/indexCVE-2018-10527 · Other software · Easycms Project · reported by MITREMedium 5.4
EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.html#listarticle URI.
- Product
- Easycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2018D-Link DIR-615 2.5.17 devices allow Remote Code Execution via shell metacharacters in the Host field of the System / Traceroute screen.CVE-2018-10431 · Network & remote access · D-link · reported by MITREHigh 7.2
D-Link DIR-615 2.5.17 devices allow Remote Code Execution via shell metacharacters in the Host field of the System / Traceroute screen.
- Product
- Dir-615 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.