Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
714 results · page 8 of 15
Jul 14, 2021Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2021-34468 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft SharePoint Server Remote Code Execution Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 30, 2021A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud CrCVE-2021-25321 · Other software · SUSE · reported by meissner@suse.deHigh 7.8
A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions.
- Product
- SUSE Linux Enterprise Server 11-SP4-LTSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.combugzilla.suse.com
Jun 30, 2021A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the CVE-2019-18906 · Other software · SUSE · reported by meissner@suse.deCritical 9.8
A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4.
- Product
- SUSE Linux Enterprise Server for SAP 12-SP5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.combugzilla.suse.com
Jun 10, 2021A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2 CVE-2021-31998 · Other software · SUSE · reported by meissner@suse.deMedium 6.8
A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2 allows local attackers to escalate their privileges from the news user to root. This issue affects: SUSE Linux Enterprise Server 11-SP3 inn version inn-2.4.2-170.21.3.1 and prior versions. openSUSE Backports SLE-15-SP2 inn versions prior to 2.6.2. openSUSE Leap 15.2 inn versions prior to 2.6.2.
- Product
- SUSE Linux Enterprise Server 11-SP3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.combugzilla.suse.com
Jun 8, 2021Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2021-31966 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.2
Microsoft SharePoint Server Remote Code Execution Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 8, 2021Microsoft SharePoint Server Information Disclosure VulnerabilityCVE-2021-31965 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.7
Microsoft SharePoint Server Information Disclosure Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 8, 2021Microsoft SharePoint Server Spoofing VulnerabilityCVE-2021-31964 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.6
Microsoft SharePoint Server Spoofing Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 8, 2021Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2021-31963 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft SharePoint Server Remote Code Execution Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 8, 2021Microsoft SharePoint Server Spoofing VulnerabilityCVE-2021-31950 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.6
Microsoft SharePoint Server Spoofing Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comportal.msrc.microsoft.com
Jun 8, 2021Microsoft SharePoint Server Spoofing VulnerabilityCVE-2021-31948 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.6
Microsoft SharePoint Server Spoofing Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 8, 2021Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2021-26420 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft SharePoint Server Remote Code Execution Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comzerodayinitiative.com
May 14, 2021A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorizaCVE-2021-22866 · Other software · GitHub · reported by product-cna@github.comHigh 8.8
A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this vulnerability, an attacker would need to create a GitHub App on the instance and have a user authorize the application through the web authentication flow. All permissions being granted would properly be shown during the first authorization, but in certain circumstances, if the user revisits the authorization flow after the GitHub App has configured additional user-level permissions, those additional permissions may not be shown, leading to more permissions being granted than the user potentially intended. This vulnerability affected GitHub Enterprise Server 3.0.x prior to 3.0.7 and 2.22.x prior to 2.22.13. It was fixed in versions 3.0.7 and 2.22.13. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
May 11, 2021Microsoft SharePoint Remote Code Execution VulnerabilityCVE-2021-31181 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft SharePoint Remote Code Execution Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comportal.msrc.microsoft.com
May 11, 2021Microsoft SharePoint Server Information Disclosure VulnerabilityCVE-2021-31173 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.3
Microsoft SharePoint Server Information Disclosure Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
May 11, 2021Microsoft SharePoint Server Spoofing VulnerabilityCVE-2021-31172 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft SharePoint Server Spoofing Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
May 11, 2021Microsoft SharePoint Information Disclosure VulnerabilityCVE-2021-31171 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.1
Microsoft SharePoint Information Disclosure Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
May 11, 2021Microsoft SharePoint Server Spoofing VulnerabilityCVE-2021-28478 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.6
Microsoft SharePoint Server Spoofing Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
May 11, 2021Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2021-28474 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comzerodayinitiative.com
May 11, 2021Microsoft SharePoint Server Spoofing VulnerabilityCVE-2021-26418 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.6
Microsoft SharePoint Server Spoofing Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
May 5, 2021A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack ClouCVE-2021-25317 · Other software · SUSE · reported by meissner@suse.deLow 3.3
A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.
- Product
- SUSE Linux Enterprise Server 11-SP4-LTSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comlists.fedoraproject.org
Apr 14, 2021A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows local attackers to prevCVE-2021-25316 · Other software · SUSE · reported by meissner@suse.deLow 3.3
A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows local attackers to prevent VM live migrations This issue affects: SUSE Linux Enterprise Server 12-SP5 s390-tools versions prior to 2.1.0-18.29.1. SUSE Linux Enterprise Server 15-SP2 s390-tools versions prior to 2.11.0-9.20.1.
- Product
- SUSE Linux Enterprise Server 12-SP5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.combugzilla.suse.com
Apr 13, 2021Microsoft Word Remote Code Execution VulnerabilityCVE-2021-28453 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Word Remote Code Execution Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comzerodayinitiative.com
Apr 13, 2021Microsoft SharePoint Denial of Service VulnerabilityCVE-2021-28450 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5
Microsoft SharePoint Denial of Service Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 2, 2021An improper access control vulnerability was identified in GitHub Enterprise Server that allowed access tokens generated from a GitHub App's web authentication CVE-2021-22865 · Other software · GitHub · reported by product-cna@github.comMedium 6.5
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed access tokens generated from a GitHub App's web authentication flow to read private repository metadata via the REST API without having been granted the appropriate permissions. To exploit this vulnerability, an attacker would need to create a GitHub App on the instance and have a user authorize the application through the web authentication flow. The private repository metadata returned would be limited to repositories owned by the user the token identifies. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.0.4 and was fixed in versions 3.0.4, 2.22.10, 2.21.18. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Mar 23, 2021A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site.CVE-2021-22864 · Other software · GitHub · reported by product-cna@github.comHigh 8.8
A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to override environment variables leading to code execution on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.0.3 and was fixed in 3.0.3, 2.22.9, and 2.21.17. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Mar 11, 2021Microsoft SharePoint Server Information Disclosure VulnerabilityCVE-2021-27052 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.3
Microsoft SharePoint Server Information Disclosure Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021Microsoft SharePoint Server Spoofing VulnerabilityCVE-2021-24104 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.6
Microsoft SharePoint Server Spoofing Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 3, 2021CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary coCVE-2021-25315 · Other software · SUSE · reported by meissner@suse.deCritical 9.8
CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.
- Product
- SUSE Linux Enterprise Server 15 SP 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.combugzilla.suse.com
Mar 2, 2021An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify tCVE-2021-22863 · Other software · GitHub · reported by product-cna@github.comHigh 8.1
An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker would be able to gain access to head branches of pull requests opened on repositories of which they are a maintainer. Forking is disabled by default for organization owned private repositories and would prevent this vulnerability. Additionally, branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.12.22 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Mar 2, 2021An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to CVE-2021-22862 · Other software · GitHub · reported by product-cna@github.comMedium 6.5
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference of a pull request to be updated to point to an arbitrary SHA or another pull request outside of the fork repository. By establishing this incorrect reference in a PR, the restrictions that limit the Actions secrets sent a workflow from forks could be bypassed. This vulnerability affected GitHub Enterprise Server version 3.0.0, 3.0.0.rc2, and 3.0.0.rc1. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Mar 2, 2021An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unaCVE-2021-22861 · Other software · GitHub · reported by product-cna@github.comMedium 6.5
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.4.21 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Mar 2, 2021A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site.CVE-2020-10519 · Other software · GitHub · reported by product-cna@github.comHigh 8.8
A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22.7 and was fixed in 2.22.7, 2.21.15, and 2.20.24. The underlying issues contributing to this vulnerability were identified through the GitHub Security Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Feb 25, 2021Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2021-24072 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Feb 25, 2021Microsoft SharePoint Information Disclosure VulnerabilityCVE-2021-24071 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.3
Microsoft SharePoint Information Disclosure Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Feb 25, 2021Microsoft SharePoint Remote Code Execution VulnerabilityCVE-2021-24066 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft SharePoint Remote Code Execution Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Feb 25, 2021Microsoft SharePoint Server Spoofing VulnerabilityCVE-2021-1726 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8
Microsoft SharePoint Server Spoofing Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Feb 11, 2021A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSCVE-2020-8027 · Other software · SUSE · reported by meissner@suse.deHigh 7.3
A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to overwrite arbitrary files and gain access to the openldap2 configuration This issue affects: SUSE Linux Enterprise Server 15-LTSS openldap2 versions prior to 2.4.46-9.37.1. SUSE Linux Enterprise Server for SAP 15 openldap2 versions prior to 2.4.46-9.37.1. openSUSE Leap 15.1 openldap2 versions prior to 2.4.46-lp151.10.18.1. openSUSE Leap 15.2 openldap2 versions prior to 2.4.46-lp152.14.9.1.
- Product
- SUSE Linux Enterprise Server 15-LTSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.combugzilla.suse.com
Jan 12, 2021Microsoft SharePoint Elevation of Privilege VulnerabilityCVE-2021-1719 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8
Microsoft SharePoint Elevation of Privilege Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Microsoft SharePoint Server Spoofing VulnerabilityCVE-2021-1717 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.6
Microsoft SharePoint Server Spoofing Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Microsoft Word Remote Code Execution VulnerabilityCVE-2021-1715 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Word Remote Code Execution Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Microsoft Excel Remote Code Execution VulnerabilityCVE-2021-1714 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2013 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Microsoft SharePoint Elevation of Privilege VulnerabilityCVE-2021-1712 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8
Microsoft SharePoint Elevation of Privilege Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2021-1707 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Microsoft SharePoint Server Spoofing VulnerabilityCVE-2021-1641 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.6
Microsoft SharePoint Server Spoofing Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Dec 9, 2020Microsoft SharePoint Remote Code Execution VulnerabilityCVE-2020-17121 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft SharePoint Remote Code Execution Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Dec 9, 2020Microsoft SharePoint Information Disclosure VulnerabilityCVE-2020-17120 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.3
Microsoft SharePoint Information Disclosure Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Dec 9, 2020Microsoft SharePoint Remote Code Execution VulnerabilityCVE-2020-17118 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.1
Microsoft SharePoint Remote Code Execution Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Dec 9, 2020Microsoft SharePoint Server Spoofing VulnerabilityCVE-2020-17115 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8
Microsoft SharePoint Server Spoofing Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Dec 9, 2020Microsoft SharePoint Elevation of Privilege VulnerabilityCVE-2020-17089 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft SharePoint Elevation of Privilege Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 19, 2020A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central insCVE-2020-28209 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7
A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central installer V2.0 - V3.1 that could cause any local Windows user who has write permission on at least one of the subfolders of the Connect Agent service binary path, being able to gain the privilege of the user who started the service. By default, the Enterprise Server and Enterprise Central is always installed at a location requiring Administrator privileges so the vulnerability is only valid if the application has been installed on a non-secure location.
- Product
- Enterprise Server Installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.