Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

538 results · page 7 of 11

Mar 16, 2022In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check.CVE-2021-39685 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210292376References: Upstream kernel
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Mar 15, 2022Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not cheCVE-2021-43958 · Websites & servers · Atlassian · reported by security@atlassian.comCritical 9.8
Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials for authentication via a improper restriction of excess authentication attempts vulnerability.
Product
Fisheye
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Mar 14, 2022Simple Quotation: Does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user dataCVE-2022-22735 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user data when using it in SQL statements, allowing any authenticated users, such as subscriber to perform SQL injection attacks
Product
Simple Quotation
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Simple Quotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Flexi: Does not sanitise and escape various parameters before outputting them back in some pages suchCVE-2022-0449 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting
Product
Flexi
Fixed in
4.20
What to do
Update Flexi to 4.20 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 9, 2022Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks.CVE-2022-22511 · Other software · WAGO · reported by info@cert.vde.comMedium 5.4
Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been compromised.
Product
Compact Controller CC100 (751-9301)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Feb 25, 2022This issues due to insufficient verification of the various input values from user’s input.CVE-2021-26617 · Other software · Gabia Co., Ltd · reported by vuln@krcert.or.krHigh 8.1
This issues due to insufficient verification of the various input values from user’s input. The vulnerability allows remote attackers to execute malicious code in Firstmall via navercheckout_add function.
Product
Firstmall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record krcert.or.kr krcert.or.kr
Feb 24, 2022zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash.CVE-2022-24615 · Other software · Zip4j Project · reported by MITREMedium 5.5
zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.
Product
Zip4j
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 24, 2022metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash.CVE-2022-24613 · Other software · Metadata-extractor Project · reported by MITREMedium 5.5
metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor library.
Product
Metadata-extractor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 4, 2022Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to use various functionalities witCVE-2021-29396 · Other software · Globalnorthstar · reported by MITRECritical 9.8
Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to use various functionalities without authentication.
Product
Northstar Club Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ardent-security.com ardent-security.com
Jan 24, 2022Contact Form Entries: Does not sanitise and escape various parametersCVE-2021-25079 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page
Product
Contact Form Entries
Fixed in
1.2.4
What to do
Update Contact Form Entries to 1.2.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022WP125: Does not have CSRF checks in various actionCVE-2021-25073 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to make a logged in admin delete them via a CSRF attack
Product
WP125
Fixed in
1.5.5
What to do
Update WP125 to 1.5.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Mobile Events Manager: Does not sanitise and escape various of its settingsCVE-2021-25049 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Mobile Events Manager
Fixed in
1.4.4
What to do
Update Mobile Events Manager to 1.4.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 29, 2021Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on tCVE-2021-36722 · Other software · Emuse · reported by cna@cyber.gov.ilHigh 7.1
Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on the affected endpoints. The SQLi caused by CWE-209: Generation of Error Message Containig Sensetive Information, showing parts of the aspx code and the webroot location , information an attacker can leverage to further compromise the host.
Product
eServices / eNvoice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gov.il gov.il
Dec 27, 2021WordPress Download Manager: Does not sanitise and escape Template data before outputting it in various pages (suchCVE-2021-24969 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks
Product
WordPress Download Manager
Fixed in
3.2.22
What to do
Update WordPress Download Manager to 3.2.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 22, 2021Stack-based buffer overflow vulnerability exists in how the CMA readfile function of Garrett Metal Detectors iC Module CMA Version 5.0 is used at various locatiCVE-2021-21906 · Other software · Garrett · reported by talos-cna@cisco.comHigh 7.2
Stack-based buffer overflow vulnerability exists in how the CMA readfile function of Garrett Metal Detectors iC Module CMA Version 5.0 is used at various locations. The Garrett iC Module exposes an authenticated CLI over TCP port 6877. This interface is used by a secondary GUI client, called “CMA Connect”, to interact with the iC Module on behalf of the user. Every time a user submits a password to the CLI password prompt, the buffer containing their input is passed as the password parameter to the checkPassword function.
Product
IC Module CMA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Dec 22, 2021Stack-based buffer overflow vulnerability exists in how the CMA readfile function of Garrett Metal Detectors iC Module CMA Version 5.0 is used at various locatiCVE-2021-21905 · Other software · Garrett · reported by talos-cna@cisco.comHigh 7.2
Stack-based buffer overflow vulnerability exists in how the CMA readfile function of Garrett Metal Detectors iC Module CMA Version 5.0 is used at various locations. The Garrett iC Module exposes an authenticated CLI over TCP port 6877. This interface is used by a secondary GUI client, called “CMA Connect”, to interact with the iC Module on behalf of the user. After a client successfully authenticates, they can send plaintext commands to manipulate the device.
Product
IC Module CMA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Nov 19, 2021In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to doCVE-2021-39231 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.
Product
Apache Ozone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com mail-archives.apache.org
Nov 16, 2021In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management syCVE-2021-25976 · Other software · PiranhaCMS · reported by vulnerabilitylab@mend.ioHigh 8.1
In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.
Product
Piranha
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com whitesourcesoftware.com
Nov 8, 2021Schreikasten: Does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actionsCVE-2021-24630 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actions, leading to authenticated SQL Injections which can be exploited by users as low as author
Product
Schreikasten
Affected
up to 0.14.18
What to do
Affects up to 0.14.18. Update Schreikasten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Nov 8, 2021Translate WordPress – Google Language Translator: Does not sanitise and escape some of its settings before outputting it in various pagesCVE-2021-24594 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Translate WordPress – Google Language Translator WordPress plugin before 6.0.12 does not sanitise and escape some of its settings before outputting it in various pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Translate WordPress – Google Language Translator
Fixed in
6.0.12
What to do
Update Translate WordPress – Google Language Translator to 6.0.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 29, 2021Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure.CVE-2021-41186 · Other software · fluent · reported by GitHubMedium 5.9
Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).
Product
fluentd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 20, 2021Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerabilCVE-2021-39126 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.5
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerability, following an Information Disclosure vulnerability in the referrer headers which discloses a user's CSRF token. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.
Product
Jira Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Oct 18, 2021LearnPress: Does not properly sanitize or escape various inputs within course settingsCVE-2021-24702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed
Product
LearnPress
Fixed in
4.1.3.1
What to do
Update LearnPress to 4.1.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 4, 2021The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details.CVE-2021-41118 · Other software · Universal-Omega · reported by GitHubMedium 5.3
The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. In affected versions unsanitised input of regular expression date within the parameters of the DPL parser function, allowed for the possibility of ReDoS (Regex Denial of Service). This has been resolved in version 3.3.6. If you are unable to update you may also set `$wgDplSettings['functionalRichness'] = 0;` or disable DynamicPageList3 to mitigate.
Product
DynamicPageList3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 21, 2021The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitMCVE-2021-40847 · Network & remote access · Netgear · reported by MITREHigh 8.1
The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled by default. This daemon connects to Circle and NETGEAR to obtain version information and updates to the circled daemon and its filtering database. However, database updates from NETGEAR are unsigned and downloaded via cleartext HTTP. As such, an attacker with the ability to perform a MitM attack on the device can respond to circled update requests with a crafted, compressed database file, the extraction of which gives the attacker the ability to overwrite executable files with attacker-controlled code. This affects R6400v2 1.0.4.106, R6700 1.0.2.16, R6700v3 1.0.4.106, R6900 1.0.2.16, R6900P 1.3.2.134, R7000 1.0.11.123, R7000P 1.3.2.134, R7850 1.0.5.68, R7900 1.0.4.38, R8000 1.0.4.68, and RS400 1.5.0.68.
Product
R6400v2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.grimm-co.com kb.netgear.com
Sep 7, 2021Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo).CVE-2021-36162 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) and retrieved by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers will use SnakeYAML library to load the rules which by default will enable calling arbitrary constructors. An attacker with access to the configuration center he will be able to poison the rule so when retrieved by the consumers, it will get RCE on all of them. This was fixed in Dubbo 2.7.13, 3.0.2
Product
Apache Dubbo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Aug 30, 2021A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various areas such as data-link-creatorCVE-2021-27558 · Other software · Easycorp · reported by MITREMedium 6.1
A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various areas such as data-link-creator.
Product
Zentao
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record privasec.com privasec.com
Aug 24, 2021The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.CVE-2021-23431 · Other software · Joplinapp · reported by report@snyk.ioMedium 5.4
The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.
Product
Joplin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com snyk.io
Aug 13, 2021The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 has incorrect Access Control for confirming various applications.CVE-2021-36792 · Other software · Dated News Project · reported by MITREHigh 7.2
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 has incorrect Access Control for confirming various applications.
Product
Dated News
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org typo3.org
Jul 26, 2021The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the WATO module.CVE-2021-36563 · Other software · Checkmk · reported by MITREMedium 5.4
The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the WATO module. This allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts), the XSS payload will be triggered when the user accesses some specific sections of the application. In the same sense a very dangerous potential way would be when an attacker who has the monitor role (not administrator) manages to get a stored XSS to steal the secretAutomation (for the use of the API in administrator mode) and thus be able to create another administrator user who has high privileges on the CheckMK monitoring web console. Another way is that persistent XSS allows an attacker to modify the displayed content or change the victim's information. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session.
Product
Checkmk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record checkmk.com checkmk.com
Jul 20, 2021The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption conCVE-2021-26095 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.5
The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges.
Product
Fortinet FortiMail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortiguard.com
Jul 14, 2021In various functions in WideVine, there are possible out of bounds writes due to improper input validation.CVE-2021-0592 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.8
In various functions in WideVine, there are possible out of bounds writes due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-188061006
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Jun 21, 2021In various functions of CryptoPlugin.cpp, there is a possible use after free due to a race condition.CVE-2021-0509 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In various functions of CryptoPlugin.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-176444161
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Jun 21, 2021In various functions of DrmPlugin.cpp, there is a possible use after free due to a race condition.CVE-2021-0508 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In various functions of DrmPlugin.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-176444154
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Jun 8, 2021Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family maCVE-2021-26474 · Other software · Vembu · reported by MITREHigh 8.6
Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.)
Product
BDR Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record csirt.divd.nl csirt.divd.nl
Jun 2, 2021A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests.CVE-2020-10771 · Other software · Infinispan · reported by Red HatHigh 7.1
A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request forgery (CSRF) attack.
Product
Infinispan-server-rest
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com security.netapp.com
May 21, 2021It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator CVE-2008-3280 · Other software · Openid · reported by Red HatMedium 5.9
It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with the DNS Cache Poisoning issue (CVE-2008-1447) and the fact that almost all SSL/TLS implementations do not consult CRLs (currently an untracked issue), this means that it is impossible to rely on these OPs.
Product
Openid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.openid.net exploit-db.com
May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the pluCVE-2021-24282 · WordPress plugins & themes · reported by WPScanMedium 6.3
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7r_reset_settings to reset the plugin’s settings, wpcf7r_add_action to add actions to a form, and more.
Product
Redirection for Contact Form 7
Fixed in
2.3.4
What to do
Update Redirection for Contact Form 7 to 2.3.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 11, 2021Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers witCVE-2021-21650 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled.
Product
Jenkins S3 publisher Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io jenkins.io
Apr 26, 2021A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack.CVE-2021-3494 · Other software · Theforeman · reported by Red HatMedium 5.9
A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if certain conditions are met. The highest threat from this flaw is to system confidentiality. This flaw affects Foreman versions before 2.5.0.
Product
Foreman
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com bugzilla.redhat.com
Mar 18, 2021A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0.CVE-2021-3416 · Other software · Qemu · reported by Red HatMedium 6
A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.
Product
Qemu
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com lists.debian.org
Mar 10, 2021In various methods of WifiNetworkSuggestionsManager.java, there is a possible modification of suggested networks due to a missing permission check.CVE-2021-0390 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In various methods of WifiNetworkSuggestionsManager.java, there is a possible modification of suggested networks due to a missing permission check. This could lead to local escalation of privilege by a background user on the same device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-174749461
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Feb 25, 2021An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar.CVE-2021-23959 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 85.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 25, 2021Depending on configuration of various package managers it is possible for an attacker to insert a malicious package into a package manager's repository whichCVE-2021-24105 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Depending on configuration of various package managers it is possible for an attacker to insert a malicious package into a package manager's repository which can be retrieved and used during development, build, and release processes. This insertion could lead to remote code execution. We believe this vulnerability affects multiple package managers across multiple languages, including but not limited to: Python/pip, .NET/NuGet, Java/Maven, JavaScript/npm. Attack scenarios An attacker could take advantage of this ecosystem-wide issue to cause harm in a variety of ways. The original attack scenarios were discovered by Alex Birsan and are detailed in their whitepaper, <a href="https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610">Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies</a>. <ul> <li>With basic knowledge of the target ecosystems, an attacker could create an empty shell for a package and insert malicious code in the install scripts, give it a high version, and publish it to the public repository. Vulnerable victim machines will download the higher version of the package between the public
Product
Package Manager Configurations
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Feb 4, 2021An improper access control vulnerability in Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain various pieces of settings inforCVE-2021-25245 · Other software · Trend Micro · reported by security@trendmicro.comMedium 5.3
An improper access control vulnerability in Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain various pieces of settings informaiton.
Product
Trend Micro Worry-Free Business Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Feb 4, 2021An improper access control vulnerability in Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain various pieces of configuration CVE-2021-25244 · Other software · Trend Micro · reported by security@trendmicro.comMedium 5.3
An improper access control vulnerability in Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain various pieces of configuration informaiton.
Product
Trend Micro Worry-Free Business Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Feb 3, 2021SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores database credentials to acCVE-2021-25275 · Other software · Solarwinds · reported by MITREHigh 7.8
SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores database credentials to access this backend in a file readable by unprivileged users. As a result, any user having access to the filesystem can read database login details from that file, including the login name and its associated password. Then, the credentials can be used to get database owner access to the SWNetPerfMon.DB database. This gives access to the data collected by SolarWinds applications, and leads to admin access to the applications by inserting or changing authentication data stored in the Accounts table of the database.
Product
Orion Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record trustwave.com trustwave.com
Feb 2, 2021loklak is an open-source server application which is able to collect messages from various sources, including twitter.CVE-2020-15097 · Other software · loklak · reported by GitHubCritical 9.1
loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server contains a search index and a peer-to-peer index sharing interface. All messages are stored in an elasticsearch index. In loklak less than or equal to commit 5f48476, a path traversal vulnerability exists. Insufficient input validation in the APIs exposed by the loklak server allowed a directory traversal vulnerability. Any admin configuration and files readable by the app available on the hosted file system can be retrieved by the attacker. Furthermore, user-controlled content could be written to any admin config and files readable by the application. This has been patched in commit 50dd692. Users will need to upgrade their hosted instances of loklak to not be vulnerable to this exploit.
Product
loklak
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 29, 2021Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests.CVE-2021-25646 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.
Product
Apache Druid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com openwall.com
Jan 13, 2021Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old DaCVE-2021-21604 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects once discarded by an administrator.
Product
Jenkins
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io jenkins.io

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.