Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

401 results · page 7 of 9

Nov 27, 2017The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of aCVE-2017-16962 · Other software · Communigate · reported by MITREMedium 6.1
The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of a Google Calendar invitation, (2) a crafted Outlook.com calendar (aka Hotmail Calendar) invitation, (3) e-mail granting access to a directory that has JavaScript in its name, (4) JavaScript in a note name, (5) JavaScript in a task name, or (6) HTML e-mail that is mishandled in the Inbox component.
Product
Communigate Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Nov 15, 2017MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has XSS when the $wgShowExceptionDetails setting is false and the browser sends non-stanCVE-2017-8808 · Other software · Mediawiki · reported by security@debian.orgMedium 6.1
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has XSS when the $wgShowExceptionDetails setting is false and the browser sends non-standard URL escaping.
Product
Mediawiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com lists.wikimedia.org
Oct 29, 2017Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.CVE-2017-15964 · Other software · Nicephpscripts · reported by MITRECritical 9.8
Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.
Product
JOB Board Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Oct 19, 2017In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized usCVE-2016-8748 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.
Product
Apache NiFi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com nifi.apache.org
Oct 4, 2017The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scripting vulnerability: CVE-2017-1000109 · Websites & servers · Jenkins · reported by MITREMedium 6.1
The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin could insert arbitrary HTML into this view.
Product
Owasp Dependency-check
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jenkins.io
Oct 4, 2017The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users ablCVE-2017-1000103 · Websites & servers · Jenkins · reported by MITREMedium 5.4
The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin could insert arbitrary HTML into this view.
Product
DRY
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jenkins.io
Oct 4, 2017The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to inflCVE-2017-1000102 · Websites & servers · Jenkins · reported by MITREMedium 5.4
The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to these plugins, for example the console output which is parsed to extract build warnings (Warnings Plugin), could insert arbitrary HTML into this view.
Product
Static Analysis Utilities
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jenkins.io
Sep 18, 2017In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.CVE-2017-12157 · Other software · Moodle · reported by Red HatMedium 4.3
In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Aug 29, 2017IBM Sametime 8.5.2 and 9.0 under certain conditions provides an error message to a user that is too detailed and may reveal details about the application.CVE-2016-2964 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Sametime 8.5.2 and 9.0 under certain conditions provides an error message to a user that is too detailed and may reveal details about the application. IBM X-Force ID: 113813.
Product
Sametime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com securityfocus.com
Aug 28, 2017IBM Sametime 8.5 and 9.0 meetings server may provide detailed information in an error message that may provide details about the application to possible attackeCVE-2016-2970 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Sametime 8.5 and 9.0 meetings server may provide detailed information in an error message that may provide details about the application to possible attackers. IBM X-Force ID: 113851.
Product
Sametime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com securityfocus.com
Jul 17, 2017The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, which may result in the disclosure of sensiCVE-2017-1000066 · Other software · Keepass · reported by MITREHigh 7.5
The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, which may result in the disclosure of sensitive information.
Product
Keepass
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record keepass.info keepass.info
Jul 12, 2017Pulse Connect Secure 8.3R1 has Reflected XSS in adminservercacertdetails.cgi.CVE-2017-11194 · Other software · Pulsesecure · reported by MITREMedium 6.1
Pulse Connect Secure 8.3R1 has Reflected XSS in adminservercacertdetails.cgi. In the admin panel, the certid parameter of adminservercacertdetails.cgi is reflected in the application's response and is not properly sanitized, allowing an attacker to inject tags. An attacker could come up with clever payloads to make the system run commands such as ping, ping6, traceroute, nslookup, arp, etc.
Product
Pulse Connect Secure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sxcurity.pro twitter.com
Jun 2, 2017WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php.CVE-2017-9361 · Other software · Websitebaker · reported by MITREMedium 6.1
WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php.
Product
Websitebaker
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jgj212.blogspot.tw jgj212.blogspot.tw
Jun 2, 2017WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php.CVE-2017-9360 · Other software · Websitebaker · reported by MITRECritical 9.8
WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php.
Product
Websitebaker
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jgj212.blogspot.tw jgj212.blogspot.tw
Apr 20, 2017Cross-site scripting (XSS) vulnerability in the "User details" function in Cybozu Garoon before 4.2.2.CVE-2016-1215 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in the "User details" function in Cybozu Garoon before 4.2.2.
Product
Garoon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Apr 14, 2017Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in VtigeCVE-2016-1713 · Other software · Vtiger · reported by MITREHigh 7.3
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in test/logo/. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6000.
Product
Vtiger CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record b.fl7.de openwall.com
Feb 23, 2017Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject arCVE-2017-6099 · Other software · Paypal · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.
Product
Merchant-sdk-php
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com github.com
Feb 22, 2016Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7,CVE-2015-3274 · Other software · Moodle · reported by Red HatMedium 6.1
Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org openwall.com
Dec 27, 2015Tails before 1.7 includes the wget program but does not prevent automatic fallback from passive FTP to active FTP, which allows remote FTP servers to discover tCVE-2015-7665 · Other software · Tails Project · reported by MITREMedium 5.3
Tails before 1.7 includes the wget program but does not prevent automatic fallback from passive FTP to active FTP, which allows remote FTP servers to discover the Tor client IP address by reading a (1) PORT or (2) EPRT command. NOTE: within wget itself, the automatic fallback is not considered a vulnerability by CVE.
Product
Tails
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.savannah.gnu.org openwall.com
Jan 26, 2015Multiple cross-site scripting (XSS) vulnerabilities in data_point_details.shtm in Mango Automation 2.4.0 and earlier allow remote attackers to inject arbitrary CVE-2015-1179 · Other software · Infinite Automation Systems · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in data_point_details.shtm in Mango Automation 2.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dpid, (2) dpxid, or (3) pid parameter.
Product
Mango Automation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Oct 19, 2014The Hunting Trophy Whitetails (aka com.wHuntingTrophyWhitetails) application 0.75.13441.88885 for Android does not verify X.509 certificates from SSL servers, wCVE-2014-7427 · Other software · Hunting Trophy Whitetails Project · reported by cret@cert.orgMedium 5.4
The Hunting Trophy Whitetails (aka com.wHuntingTrophyWhitetails) application 0.75.13441.88885 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Hunting Trophy Whitetails
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Jun 19, 2014Cross-site scripting (XSS) vulnerability in lua/host_details.lua in ntopng 1.1 allows remote attackers to inject arbitrary web script or HTML via the host paramCVE-2014-4329 · Other software · Ntop · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in lua/host_details.lua in ntopng 1.1 allows remote attackers to inject arbitrary web script or HTML via the host parameter.
Product
Ntopng
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com ntop.org
Jun 11, 2014Cross-site scripting (XSS) vulnerability in booking_details.php in Best Soft Inc.CVE-2014-4035 · Other software · Bestsoftinc · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in booking_details.php in Best Soft Inc. (BSI) Advance Hotel Booking System 2.0 allows remote attackers to inject arbitrary web script or HTML via the title parameter.
Product
Advance Hotel Booking System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Feb 1, 2014Multiple cross-site scripting (XSS) vulnerabilities in configuration-details screens in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before CVE-2014-0832 · Other software · IBM · reported by psirt@us.ibm.comLow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in configuration-details screens in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted text value.
Product
Financial Transaction Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com exchange.xforce.ibmcloud.com
Jul 15, 2013The web interface in Cisco Secure Access Control System (ACS) does not properly suppress error-condition details, which allows remote authenticated users to obtCVE-2013-3428 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4
The web interface in Cisco Secure Access Control System (ACS) does not properly suppress error-condition details, which allows remote authenticated users to obtain sensitive information via an unspecified request that triggers an error, aka Bug ID CSCue65957.
Product
Secure Access Control System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Mar 27, 2013The Java Console in IBM Domino 8.5.x allows remote authenticated users to hijack temporary credentials by leveraging knowledge of configuration details, aka SPRCVE-2013-0487 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
The Java Console in IBM Domino 8.5.x allows remote authenticated users to hijack temporary credentials by leveraging knowledge of configuration details, aka SPR KLYH8TNNDN.
Product
Lotus Domino
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com exchange.xforce.ibmcloud.com
Jan 27, 2013report/outline/index.php in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly enforce the moodle/user:viewhiddendetails caCVE-2012-6100 · Other software · Moodle · reported by Red HatMedium 4
report/outline/index.php in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly enforce the moodle/user:viewhiddendetails capability requirement, which allows remote authenticated users to discover a hidden lastaccess value by reading an activity report.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org openwall.com
Nov 18, 2012Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x befCVE-2012-4533 · Other software · Viewvc · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" line.
Product
Viewvc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org osvdb.org
Aug 31, 2012SQL injection vulnerability in phpgwapi/js/dhtmlxtree/samples/with_db/loaddetails.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware CVE-2011-4949 · Other software · Egroupware · reported by Red HatHigh 7.5
SQL injection vulnerability in phpgwapi/js/dhtmlxtree/samples/with_db/loaddetails.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
Egroupware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record comments.gmane.org packetstormsecurity.org
Aug 13, 2012Cross-site scripting (XSS) vulnerability in client_details.php in Proman Xpress 5.0.1 allows remote attackers to inject arbitrary web script or HTML via the cl_CVE-2012-4266 · Other software · Itechscripts · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in client_details.php in Proman Xpress 5.0.1 allows remote attackers to inject arbitrary web script or HTML via the cl_comments parameter. NOTE: some of these details are obtained from third party information.
Product
Proman Xpress
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com exploit-db.com
Jul 17, 2012mod/forum/user.php in Moodle 1.9.x before 1.9.16 allows remote authenticated users to obtain the names and other details of arbitrary user accounts by searchingCVE-2012-0792 · Other software · Moodle · reported by Red HatMedium 4
mod/forum/user.php in Moodle 1.9.x before 1.9.16 allows remote authenticated users to obtain the names and other details of arbitrary user accounts by searching for posts.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org moodle.org
Dec 30, 2011Cross-site scripting (XSS) vulnerability in details_view.php in PHP Booking Calendar 10e allows remote attackers to inject arbitrary web script or HTML via the CVE-2011-5045 · Other software · Jjwdesign · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in details_view.php in PHP Booking Calendar 10e allows remote attackers to inject arbitrary web script or HTML via the page_info_message parameter.
Product
PHP Booking Calendar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com sourceforge.net
Nov 28, 2011Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WCVE-2011-4562 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header in a request to a post that does not exist.
Product
Redirection
What to do
Update Redirection to the newest version.
Full record and what to do →NVD record dotxed.net osvdb.org
Nov 1, 2011SQL injection vulnerability in packagedetails.php in iScripts ReserveLogic 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter.CVE-2010-4980 · Other software · Iscripts · reported by MITREHigh 7.5
SQL injection vulnerability in packagedetails.php in iScripts ReserveLogic 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter.
Product
Reservelogic
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Nov 1, 2011SQL injection vulnerability in articlesdetails.php in BrotherScripts (BS) Business Directory allows remote attackers to execute arbitrary SQL commands via the iCVE-2010-4969 · Other software · Brotherscripts · reported by MITREHigh 7.5
SQL injection vulnerability in articlesdetails.php in BrotherScripts (BS) Business Directory allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
Business Directory
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Oct 8, 2011SQL injection vulnerability in article_details.php in Softbiz Article Directory Script allows remote attackers to execute arbitrary SQL commands via the sbiz_idCVE-2010-4905 · Other software · Softbizscripts · reported by MITREHigh 7.5
SQL injection vulnerability in article_details.php in Softbiz Article Directory Script allows remote attackers to execute arbitrary SQL commands via the sbiz_id parameter.
Product
Article Directory Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Sep 27, 2011SQL injection vulnerability in countrydetails.php in Alibaba Clone B2B 3.4 allows remote attackers to execute arbitrary SQL commands via the es_id parameter.CVE-2010-4849 · Other software · Alibabaclone · reported by MITREHigh 7.5
SQL injection vulnerability in countrydetails.php in Alibaba Clone B2B 3.4 allows remote attackers to execute arbitrary SQL commands via the es_id parameter.
Product
Alibaba Clone B2b
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Sep 27, 2011Multiple SQL injection vulnerabilities in MH Products Projekt Shop allow remote attackers to execute arbitrary SQL commands via the (1) ts parameter to details.CVE-2010-4845 · Other software · Mhproducts · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in MH Products Projekt Shop allow remote attackers to execute arbitrary SQL commands via the (1) ts parameter to details.php and possibly the (2) ilceler parameter to index.php.
Product
Projekt Shop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com exploit-db.com
Mar 16, 2011The service utility in EMC Avamar 5.x before 5.0.4 uses cleartext to transmit event details in (1) service requests and (2) e-mail messages, which might allow rCVE-2011-0442 · Other software · EMC · reported by security_alert@emc.comLow 3.5
The service utility in EMC Avamar 5.x before 5.0.4 uses cleartext to transmit event details in (1) service requests and (2) e-mail messages, which might allow remote attackers to obtain sensitive information by sniffing the network.
Product
Avamar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
Nov 15, 2010The Symantec Norton Mobile Security application 1.0 Beta for Android records setup details, possibly including wipe/lock credentials, in the device logs, which CVE-2010-0113 · Other software · Symantec · reported by MITREMedium 4.3
The Symantec Norton Mobile Security application 1.0 Beta for Android records setup details, possibly including wipe/lock credentials, in the device logs, which allows user-assisted remote attackers to obtain potentially sensitive information by leveraging the ability of a separate crafted application to read these logs.
Product
Mobile Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org securityfocus.com
Nov 5, 2010NetSupport Manager (NSM) before 11.00.0005 sends HTTP headers with cleartext fields containing details about client machines, which allows remote attackers to oCVE-2010-4184 · Other software · Netsupportsoftware · reported by MITREMedium 5
NetSupport Manager (NSM) before 11.00.0005 sends HTTP headers with cleartext fields containing details about client machines, which allows remote attackers to obtain potentially sensitive information by sniffing the network.
Product
Netsupport Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org netsupportsoftware.com
Jul 28, 2010SQL injection vulnerability in articlesdetails.php in ScriptsFeed and BrotherScripts (BS) Scripts Directory allows remote attackers to execute arbitrary SQL comCVE-2010-2906 · Other software · Brotherscripts · reported by MITREHigh 7.5
SQL injection vulnerability in articlesdetails.php in ScriptsFeed and BrotherScripts (BS) Scripts Directory allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2010-2905.
Product
Scripts Directory
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com exploit-db.com
May 24, 2010SQL injection vulnerability in details.php in Iceberg CMS allows remote attackers to execute arbitrary SQL commands via the p_id parameter.CVE-2010-2016 · Other software · Imagetraders · reported by MITREHigh 7.5
SQL injection vulnerability in details.php in Iceberg CMS allows remote attackers to execute arbitrary SQL commands via the p_id parameter.
Product
Iceberg CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
May 3, 2010SQL injection vulnerability in help-details.php in CLScript Classifieds Script allows remote attackers to execute arbitrary SQL commands via the hpId parameter.CVE-2010-1660 · Other software · Clscript · reported by MITREHigh 7.5
SQL injection vulnerability in help-details.php in CLScript Classifieds Script allows remote attackers to execute arbitrary SQL commands via the hpId parameter.
Product
Clscript Classifieds Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Sep 24, 2009SQL injection vulnerability in details.asp in HotWeb Rentals allows remote attackers to execute arbitrary SQL commands via the PropId parameter.CVE-2009-3343 · Other software · Hotwebscripts · reported by MITREHigh 7.5
SQL injection vulnerability in details.asp in HotWeb Rentals allows remote attackers to execute arbitrary SQL commands via the PropId parameter.
Product
Hotweb Rentals
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com exploit-db.com
Sep 24, 2009SQL injection vulnerability in auction_details.php in PHP Pro Bid allows remote attackers to execute arbitrary SQL commands via the auction_id parameter.CVE-2009-3336 · Websites & servers · Phpprobid · reported by MITREHigh 7.5
SQL injection vulnerability in auction_details.php in PHP Pro Bid allows remote attackers to execute arbitrary SQL commands via the auction_id parameter.
Product
PHP Pro BID
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Sep 9, 2009OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain sensitive information (session details and order history of other users) via aCVE-2009-2266 · Other software · Oxid · reported by MITREMedium 5
OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain sensitive information (session details and order history of other users) via a crafted cookie.
Product
Eshop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oxidforge.org oxidforge.org
Aug 21, 2009Cross-site scripting (XSS) vulnerability in NashTech Easy PHP Calendar 6.3.25 allows remote attackers to inject arbitrary web script or HTML via the Details fieCVE-2008-7018 · Other software · Nashtech · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in NashTech Easy PHP Calendar 6.3.25 allows remote attackers to inject arbitrary web script or HTML via the Details field (descr parameter) in an Add New Event action in an unspecified request as generated by an add action in index.php.
Product
Easy PHP Calendar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Aug 12, 2009mxCamArchive 2.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain configuration detailsCVE-2008-6955 · Other software · Infireal · reported by MITREHigh 7.5
mxCamArchive 2.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain configuration details and passwords via a direct request for archive/config.ini.
Product
Mxcamarchive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Aug 7, 2009Cross-site scripting (XSS) vulnerability in view_prop_details.php in Zeeways ZEEPROPERTY 1.0 allows remote attackers to inject arbitrary web script or HTML via CVE-2008-6915 · Other software · Zeeways · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in view_prop_details.php in Zeeways ZEEPROPERTY 1.0 allows remote attackers to inject arbitrary web script or HTML via the propid parameter.
Product
Zeeproperty
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.