Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 71 of 87
Jan 10, 2023A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical.CVE-2016-15017 · Other software · fabarea · reported by VulDBMedium 5.5
A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the file Classes/Service/UploadFileService.php. The manipulation leads to pathname traversal. Upgrading to version 0.9.0 is able to address this issue. The patch is identified as b25d42a4981072321c1a363311d8ea2a4ac8763a. It is recommended to upgrade the affected component. VDB-217786 is the identifier assigned to this vulnerability.
- Product
- media_upload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023A vulnerability classified as critical has been found in CherishSin klattr.CVE-2014-125072 · Other software · CherishSin · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in CherishSin klattr. This affects an unknown part. The manipulation leads to sql injection. The patch is named f8e4ecfbb83aef577011b0b4aebe96fb6ec557f1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217719.
- Product
- klattr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023A vulnerability was found in gperson angular-test-reporter and classified as critical.CVE-2015-10035 · Other software · gperson · reported by VulDBMedium 5.5
A vulnerability was found in gperson angular-test-reporter and classified as critical. This issue affects the function getProjectTables/addTest of the file rest-server/data-server.js. The manipulation leads to sql injection. The patch is named a29d8ae121b46ebfa96a55a9106466ab2ef166ae. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217715.
- Product
- angular-test-reporter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023A vulnerability has been found in j-nowak workout-organizer and classified as critical.CVE-2015-10034 · Other software · j-nowak · reported by VulDBMedium 5.5
A vulnerability has been found in j-nowak workout-organizer and classified as critical. This vulnerability affects unknown code. The manipulation leads to sql injection. The patch is identified as 13cd6c3d1210640bfdb39872b2bb3597aa991279. It is recommended to apply a patch to fix this issue. VDB-217714 is the identifier assigned to this vulnerability.
- Product
- workout-organizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023A vulnerability, which was classified as problematic, was found in jvvlee MerlinsBoard.CVE-2015-10033 · Other software · jvvlee · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in jvvlee MerlinsBoard. This affects an unknown part of the component Grade Handler. The manipulation leads to improper authorization. The identifier of the patch is 134f5481e2914b7f096cd92a22b1e6bcb8e6dfe5. It is recommended to apply a patch to fix this issue. The identifier VDB-217713 was assigned to this vulnerability.
- Product
- MerlinsBoard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023A vulnerability classified as problematic was found in Talend Open Studio for MDM.CVE-2021-4311 · Other software · Talend · reported by VulDBMedium 5.5
A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The manipulation leads to xml external entity reference. The patch is identified as 31d442b9fb1d518128fd18f6e4d54e06c3d67793. It is recommended to apply a patch to fix this issue. VDB-217666 is the identifier assigned to this vulnerability.
- Product
- Open Studio for MDM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x.CVE-2017-20165 · Other software · debug-js · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
- Product
- debug
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023A vulnerability was found in Information Cards Module on simpleSAMLphp and classified as problematic.CVE-2010-10004 · Other software · Simplesamlphp · reported by VulDBLow 3.5
A vulnerability was found in Information Cards Module on simpleSAMLphp and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.0 is able to address this issue. The identifier of the patch is f6bfea49ae16dc6e179df8306d39c3694f1ef186. It is recommended to upgrade the affected component. The identifier VDB-217661 was assigned to this vulnerability.
- Product
- Information Cards Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability, which was classified as problematic, was found in viafintech Barzahlen Payment Module PHP SDK up to 2.0.0.CVE-2016-15015 · Other software · viafintech · reported by VulDBLow 2.6
A vulnerability, which was classified as problematic, was found in viafintech Barzahlen Payment Module PHP SDK up to 2.0.0. Affected is the function verify of the file src/Webhook.php. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 2.0.1 is able to address this issue. The patch is identified as 3e7d29dc0ca6c054a6d6e211f32dae89078594c1. It is recommended to upgrade the affected component. VDB-217650 is the identifier assigned to this vulnerability.
- Product
- Barzahlen Payment Module PHP SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability has been found in yanheven console and classified as problematic.CVE-2014-125070 · Other software · yanheven · reported by VulDBLow 3.5
A vulnerability has been found in yanheven console and classified as problematic. Affected by this vulnerability is the function get_zone_hosts/AvailabilityZonesTable of the file openstack_dashboard/dashboards/admin/aggregates/tables.py. The manipulation leads to cross site scripting. The attack can be launched remotely. The patch is named ba908ae88d5925f4f6783eb234cc4ea95017472b. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217651.
- Product
- console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability, which was classified as problematic, has been found in 01-Scripts 01ACP.CVE-2021-4309 · Other software · 01-Scripts · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in 01-Scripts 01ACP. This issue affects some unknown processing. The manipulation of the argument $_SERVER['SCRIPT_NAME'] leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is a16eb7da46ed22bc61067c212635394f2571d3c4. It is recommended to apply a patch to fix this issue. The identifier VDB-217649 was assigned to this vulnerability.
- Product
- 01ACP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability classified as critical was found in purpleparrots 491-Project.CVE-2015-10031 · Other software · purpleparrots · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in purpleparrots 491-Project. This vulnerability affects unknown code of the file update.php of the component Highscore Handler. The manipulation leads to sql injection. The name of the patch is a812a5e4cf72f2a635a716086fe1ee2b8fa0b1ab. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217648.
- Product
- 491-Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability classified as critical has been found in lojban jbovlaste.CVE-2018-25072 · Other software · lojban · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in lojban jbovlaste. This affects an unknown part of the file dict/listing.html. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The patch is named 6ff44c2e87b1113eb07d76ea62e1f64193b04d15. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217647.
- Product
- jbovlaste
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability was found in saxman maps-js-icoads and classified as critical.CVE-2014-125068 · Other software · saxman · reported by VulDBMedium 5.5
A vulnerability was found in saxman maps-js-icoads and classified as critical. This issue affects some unknown processing of the file http-server.js. The manipulation leads to path traversal. The patch is named 34b8b0cce2807b119f4cffda2ac48fc8f427d69a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217643.
- Product
- maps-js-icoads
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability, which was classified as critical, was found in pouetnet pouet 2.0.CVE-2020-36648 · Other software · pouetnet · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in pouetnet pouet 2.0. This affects an unknown part. The manipulation of the argument howmany leads to sql injection. The identifier of the patch is 11d615931352066fb2f6dcb07428277c2cd99baf. It is recommended to apply a patch to fix this issue. The identifier VDB-217641 was assigned to this vulnerability.
- Product
- pouet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability classified as critical has been found in YunoHost-Apps transmission_ynh.CVE-2020-36647 · Other software · YunoHost-Apps · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in YunoHost-Apps transmission_ynh. Affected is an unknown function of the file conf/nginx.conf. The manipulation leads to path traversal. The patch is identified as f136dfd44eda128129e5fd2d850a3a3c600e6a4a. It is recommended to apply a patch to fix this issue. VDB-217638 is the identifier assigned to this vulnerability.
- Product
- transmission_ynh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability has been found in SUKOHI Surpass and classified as critical.CVE-2015-10030 · Other software · SUKOHI · reported by VulDBMedium 5.5
A vulnerability has been found in SUKOHI Surpass and classified as critical. This vulnerability affects unknown code of the file src/Sukohi/Surpass/Surpass.php. The manipulation of the argument dir leads to pathname traversal. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as d22337d453a2a14194cdb02bf12cdf9d9f827aa7. It is recommended to upgrade the affected component. VDB-217642 is the identifier assigned to this vulnerability.
- Product
- Surpass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability classified as critical was found in corincerami curiosity.CVE-2014-125067 · Other software · corincerami · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in corincerami curiosity. Affected by this vulnerability is an unknown functionality of the file app/controllers/image_controller.rb. The manipulation of the argument sol leads to sql injection. The patch is named d64fddd74ca72714e73f4efe24259ca05c8190eb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217639.
- Product
- curiosity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability, which was classified as critical, has been found in web-cyradm.CVE-2007-10002 · Other software · Web-cyradm Project · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in web-cyradm. Affected by this issue is some unknown functionality of the file auth.inc.php. The manipulation of the argument login/login_password/LANG leads to sql injection. The attack may be launched remotely. The name of the patch is 2bcbead3bdb5f118bf2c38c541eaa73c29dcc90f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217640.
- Product
- Web-cyradm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical.CVE-2021-4301 · Other software · slackero · reported by VulDBMedium 6.3
A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument $phpwcms['db_prepend'] leads to sql injection. The attack may be launched remotely. Upgrading to version 1.9.27 is able to address this issue. The patch is identified as 77dafb6a8cc1015f0777daeb5792f43beef77a9d. It is recommended to upgrade the affected component. VDB-217418 is the identifier assigned to this vulnerability.
- Product
- phpwcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability classified as problematic has been found in MediaArea ZenLib up to 0.4.38.CVE-2020-36646 · Other software · MediaArea · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in MediaArea ZenLib up to 0.4.38. This affects the function Ztring::Date_From_Seconds_1970_Local of the file Source/ZenLib/Ztring.cpp. The manipulation of the argument Value leads to unchecked return value to null pointer dereference. Upgrading to version 0.4.39 is able to address this issue. The identifier of the patch is 6475fcccd37c9cf17e0cfe263b5fe0e2e47a8408. It is recommended to upgrade the affected component. The identifier VDB-217629 was assigned to this vulnerability.
- Product
- ZenLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability has been found in CESNET theme-cesnet up to 1.x on ownCloud and classified as problematic.CVE-2016-15014 · Other software · CESNET · reported by VulDBLow 3.3
A vulnerability has been found in CESNET theme-cesnet up to 1.x on ownCloud and classified as problematic. Affected by this vulnerability is an unknown functionality of the file cesnet/core/lostpassword/templates/resetpassword.php. The manipulation leads to insufficiently protected credentials. Attacking locally is a requirement. Upgrading to version 2.0.0 is able to address this issue. The identifier of the patch is 2b857f2233ce5083b4d5bc9bfc4152f933c3e4a6. It is recommended to upgrade the affected component. The identifier VDB-217633 was assigned to this vulnerability.
- Product
- theme-cesnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability classified as problematic was found in kelvinmo simplexrd up to 3.1.0.CVE-2015-10029 · Other software · kelvinmo · reported by VulDBMedium 5.5
A vulnerability classified as problematic was found in kelvinmo simplexrd up to 3.1.0. This vulnerability affects unknown code of the file simplexrd/simplexrd.class.php. The manipulation leads to xml external entity reference. Upgrading to version 3.1.1 is able to address this issue. The patch is identified as 4c9f2e028523ed705b555eca2c18c64e71f1a35d. It is recommended to upgrade the affected component. VDB-217630 is the identifier assigned to this vulnerability.
- Product
- simplexrd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability, which was classified as critical, was found in john5223 bottle-auth.CVE-2014-125065 · Other software · john5223 · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in john5223 bottle-auth. Affected is an unknown function. The manipulation leads to sql injection. The name of the patch is 99cfbcc0c1429096e3479744223ffb4fda276875. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217632.
- Product
- bottle-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability was found in DrAzraelTod pyChao and classified as critical.CVE-2013-10009 · Other software · DrAzraelTod · reported by VulDBMedium 5.5
A vulnerability was found in DrAzraelTod pyChao and classified as critical. Affected by this issue is the function klauen/lesen of the file mod_fun/__init__.py. The manipulation leads to sql injection. The patch is identified as 9d8adbc07c384ba51c2583ce0819c9abb77dc648. It is recommended to apply a patch to fix this issue. VDB-217634 is the identifier assigned to this vulnerability.
- Product
- pyChao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability, which was classified as critical, was found in square squalor.CVE-2020-36645 · Other software · square · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in square squalor. This affects an unknown part. The manipulation leads to sql injection. Upgrading to version v0.0.0 is able to address this issue. The patch is named f6f0a47cc344711042eb0970cb423e6950ba3f93. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217623.
- Product
- squalor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability has been found in ss15-this-is-sparta and classified as problematic.CVE-2015-10028 · Other software · Pear Programming Project · reported by VulDBLow 3.5
A vulnerability has been found in ss15-this-is-sparta and classified as problematic. This vulnerability affects unknown code of the file js/roomElement.js of the component Main Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is ba2f71ad3a46e5949ee0c510b544fa4ea973baaa. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217624.
- Product
- Pear Programming
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability was found in ada-l0velace Bid and classified as critical.CVE-2014-125063 · Other software · ada-l0velace · reported by VulDBMedium 5.5
A vulnerability was found in ada-l0velace Bid and classified as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is abd71140b8219fa8741d0d8a57ab27d5bfd34222. It is recommended to apply a patch to fix this issue. The identifier VDB-217625 was assigned to this vulnerability.
- Product
- Bid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability classified as problematic has been found in cronvel terminal-kit up to 2.1.7.CVE-2021-4306 · Other software · cronvel · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in cronvel terminal-kit up to 2.1.7. Affected is an unknown function. The manipulation leads to inefficient regular expression complexity. Upgrading to version 2.1.8 is able to address this issue. The name of the patch is a2e446cc3927b559d0281683feb9b821e83b758c. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217620.
- Product
- terminal-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP.CVE-2015-10027 · Other software · hydrian · reported by VulDBMedium 5.5
A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP. Affected by this issue is some unknown functionality of the component Username Handler. The manipulation leads to ldap injection. Upgrading to version 2.0b1 is able to address this issue. The patch is identified as a7f7a5a82d9202a5c40d606a5c519ba61b224eb8. It is recommended to upgrade the affected component. VDB-217622 is the identifier assigned to this vulnerability.
- Product
- TTRSS-Auth-LDAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability classified as critical was found in ananich bitstorm.CVE-2014-125062 · Other software · ananich · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in ananich bitstorm. Affected by this vulnerability is an unknown functionality of the file announce.php. The manipulation of the argument event leads to sql injection. The identifier of the patch is ea8da92f94cdb78ee7831e1f7af6258473ab396a. It is recommended to apply a patch to fix this issue. The identifier VDB-217621 was assigned to this vulnerability.
- Product
- bitstorm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability has been found in luelista miniConf up to 1.7.6 and classified as problematic.CVE-2015-10025 · Other software · luelista · reported by VulDBLow 3.5
A vulnerability has been found in luelista miniConf up to 1.7.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file miniConf/MessageView.cs of the component URL Scanning. The manipulation leads to denial of service. Upgrading to version 1.7.7 and 1.8.0 is able to address this issue. The patch is named c06c2e5116c306e4e1bc79779f0eda2d1182f655. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217615.
- Product
- miniConf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability classified as critical was found in hoffie larasync.CVE-2015-10024 · Other software · hoffie · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in hoffie larasync. This vulnerability affects unknown code of the file repository/content/file_storage.go. The manipulation leads to path traversal. The name of the patch is 776bad422f4bd4930d09491711246bbeb1be9ba5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217612.
- Product
- larasync
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in peel filebroker and classified as critical.CVE-2014-125061 · Other software · peel · reported by VulDBMedium 5.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in peel filebroker and classified as critical. Affected by this issue is the function select_transfer_status_desc of the file lib/common.rb. The manipulation leads to sql injection. The name of the patch is 91097e26a6c84d3208a351afaa52e0f62e5853ef. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217616. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- filebroker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability, which was classified as critical, was found in holdennb CollabCal.CVE-2014-125060 · Other software · holdennb · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in holdennb CollabCal. Affected is the function handleGet of the file calenderServer.cpp. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The patch is identified as b80f6d1893607c99e5113967592417d0fe310ce6. It is recommended to apply a patch to fix this issue. VDB-217614 is the identifier assigned to this vulnerability.
- Product
- CollabCal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability, which was classified as problematic, has been found in sternenseemann sternenblog.CVE-2014-125059 · Other software · sternenseemann · reported by VulDBMedium 5
A vulnerability, which was classified as problematic, has been found in sternenseemann sternenblog. This issue affects the function blog_index of the file main.c. The manipulation of the argument post_path leads to file inclusion. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 0.1.0 is able to address this issue. The identifier of the patch is cf715d911d8ce17969a7926dea651e930c27e71a. It is recommended to upgrade the affected component. The identifier VDB-217613 was assigned to this vulnerability. NOTE: This case is rather theoretical and probably won't happen. Maybe only on obscure Web servers.
- Product
- sternenblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability classified as critical has been found in Fumon trello-octometric.CVE-2015-10023 · Other software · Fumon · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in Fumon trello-octometric. This affects the function main of the file metrics-ui/server/srv.go. The manipulation of the argument num leads to sql injection. The patch is named a1f1754933fbf21e2221fbc671c81a47de6a04ef. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217611.
- Product
- trello-octometric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability has been found in polterguy Phosphorus Five up to 8.2 and classified as critical.CVE-2018-25070 · Other software · polterguy · reported by VulDBMedium 5.5
A vulnerability has been found in polterguy Phosphorus Five up to 8.2 and classified as critical. This vulnerability affects the function csv.Read of the file plugins/extras/p5.mysql/NonQuery.cs of the component CSV Import. The manipulation leads to sql injection. Upgrading to version 8.3 is able to address this issue. The patch is identified as c179a3d0703db55cfe0cb939b89593f2e7a87246. It is recommended to upgrade the affected component. VDB-217606 is the identifier assigned to this vulnerability.
- Product
- Phosphorus Five
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability was found in LearnMeSomeCodes project3 and classified as critical.CVE-2014-125058 · Other software · LearnMeSomeCodes · reported by VulDBMedium 5.5
A vulnerability was found in LearnMeSomeCodes project3 and classified as critical. This issue affects the function search_first_name of the file search.rb. The manipulation leads to sql injection. The patch is named d3efa17ae9f6b2fc25a6bbcf165cefed17c7035e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217607. NOTE: Maintainer is aware of this issue as remarked in the source code.
- Product
- project3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic.CVE-2020-36644 · Other software · jamesmartin · reported by VulDBLow 3.5
A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inline_svg/action_view/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.7.2 is able to address this issue. The identifier of the patch is f5363b351508486021f99e083c92068cf2943621. It is recommended to upgrade the affected component. The identifier VDB-217597 was assigned to this vulnerability.
- Product
- Inline SVG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability was found in Pylons horus and classified as problematic.CVE-2014-125056 · Other software · Pylons · reported by VulDBLow 2.6
A vulnerability was found in Pylons horus and classified as problematic. Affected by this issue is some unknown functionality of the file horus/flows/local/services.py. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as fd56ccb62ce3cbdab0484fe4f9c25c4eda6c57ec. It is recommended to apply a patch to fix this issue. VDB-217598 is the identifier assigned to this vulnerability.
- Product
- horus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability classified as critical has been found in Netis Netcore Router.CVE-2018-25069 · Other software · Netis · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Netis Netcore Router. This affects an unknown part. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The identifier VDB-217593 was assigned to this vulnerability.
- Product
- Netcore Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.checkpoint.comvuldb.com
Jan 7, 2023A vulnerability, which was classified as problematic, has been found in foxoverflow MySimplifiedSQL.CVE-2015-10019 · Other software · foxoverflow · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in foxoverflow MySimplifiedSQL. This issue affects some unknown processing of the file MySimplifiedSQL_Examples.php. The manipulation of the argument FirstName/LastName leads to cross site scripting. The attack may be initiated remotely. The patch is named 3b7481c72786f88041b7c2d83bb4f219f77f1293. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217595.
- Product
- MySimplifiedSQL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt.CVE-2014-125055 · Other software · agnivade · reported by VulDBLow 2.6
A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt. Affected is the function VerifyPassphrase of the file scrypt.go. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.0.0 is able to address this issue. The name of the patch is 477c10cf3b144ddf96526aa09f5fdea613f21812. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217596.
- Product
- easy-scrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability classified as critical was found in koroket RedditOnRails.CVE-2014-125054 · Other software · koroket · reported by VulDBMedium 4.3
A vulnerability classified as critical was found in koroket RedditOnRails. This vulnerability affects unknown code of the component Vote Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The patch is identified as 7f3c7407d95d532fcc342b00d68d0ea09ca71030. It is recommended to apply a patch to fix this issue. VDB-217594 is the identifier assigned to this vulnerability.
- Product
- RedditOnRails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical.CVE-2018-25068 · Other software · devent · reported by VulDBMedium 6.3
A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical. This vulnerability affects the function createTmpDir of the file globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java. The manipulation leads to insecure temporary file. The attack can be initiated remotely. Upgrading to version 4.5.1 is able to address this issue. The patch is identified as 77a820bac2f68e662ce261ecb050c643bd7ee560. It is recommended to upgrade the affected component. VDB-217570 is the identifier assigned to this vulnerability.
- Product
- globalpom-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability, which was classified as critical, was found in JoomGallery up to 3.3.3.CVE-2018-25067 · Other software · Joomgallery Project · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in JoomGallery up to 3.3.3. This affects an unknown part of the file administrator/components/com_joomgallery/views/config/tmpl/default.php of the component Image Sort Handler. The manipulation leads to sql injection. Upgrading to version 3.3.4 is able to address this issue. The identifier of the patch is dc414ee954e849082260f8613e15a1c1e1d354a1. It is recommended to upgrade the affected component. The identifier VDB-217569 was assigned to this vulnerability.
- Product
- Joomgallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability was found in JervenBolleman sparql-identifiers and classified as critical.CVE-2014-125052 · Other software · JervenBolleman · reported by VulDBMedium 5.5
A vulnerability was found in JervenBolleman sparql-identifiers and classified as critical. This issue affects some unknown processing of the file src/main/java/org/identifiers/db/RegistryDao.java. The manipulation leads to sql injection. The patch is named 44bb0db91c064e305b192fc73521d1dfd25bde52. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217571.
- Product
- sparql-identifiers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability was found in ScottTZhang voter-js and classified as critical.CVE-2014-125050 · Other software · ScottTZhang · reported by VulDBMedium 5.5
A vulnerability was found in ScottTZhang voter-js and classified as critical. Affected by this issue is some unknown functionality of the file main.js. The manipulation leads to sql injection. The patch is identified as 6317c67a56061aeeaeed3cf9ec665fd9983d8044. It is recommended to apply a patch to fix this issue. VDB-217562 is the identifier assigned to this vulnerability.
- Product
- voter-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability classified as critical was found in Arthmoor QSF-Portal.CVE-2019-25099 · Other software · Arthmoor · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in Arthmoor QSF-Portal. This vulnerability affects unknown code of the file index.php. The manipulation of the argument a leads to path traversal. The patch is identified as ea4f61e23ecb83247d174bc2e2cbab521c751a7d. It is recommended to apply a patch to fix this issue. VDB-217558 is the identifier assigned to this vulnerability.
- Product
- QSF-Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.