Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41 results
Oct 28, 2026decode-uri-component provides a more robust alternative to decodeURIComponent.CVE-2026-118664 · Other software · SamVerschueren · reported by GitHubHigh 8.2
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.
- Product
- decode-uri-component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication.CVE-2026-73669 · Other software · Signify · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 6.9
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attacker with network access to the MQTT service on a vulnerable system can read data and control connected lights. Fixed in 1.77.2071318010.
- Product
- Philips Hue Bridge Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Jun 30, 2026decode-uri-component through 0.4.1 is vulnerable to denial of service.CVE-2026-45822 · Other software · SamVerschueren · reported by 22e2d327-25fe-45d7-9f0c-dcd23b7108dfMedium 6.6
decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.
- Product
- decode-uri-component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability.CVE-2026-3562 · Other software · Philips · reported by zdi-disclosures@trendmicro.comHigh 8.8
Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ed25519_sign_open function. The issue results from improper verification of a cryptographic signature. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28480.
- Product
- Hue Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Philips Hue Bridge hk_hap characteristics Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2026-3561 · Other software · Philips · reported by zdi-disclosures@trendmicro.comHigh 8
Philips Hue Bridge hk_hap characteristics Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of PUT requests to the characteristics endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28479.
- Product
- Hue Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Philips Hue Bridge HomeKit hk_hap_pair_storage_put Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2026-3560 · Other software · Philips · reported by zdi-disclosures@trendmicro.comHigh 8.8
Philips Hue Bridge HomeKit hk_hap_pair_storage_put Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the hk_hap_pair_storage_put function of the HomeKit implementation, which listens on TCP port 8080 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28469.
- Product
- Hue Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability.CVE-2026-3559 · Other software · Philips · reported by zdi-disclosures@trendmicro.comHigh 8.1
Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the SRP authentication mechanism in the HomeKit Accessory Protocol service, which listens on TCP port 8080 by default. The issue results from the use of a static nonce value. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28451.
- Product
- Hue Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability.CVE-2026-3558 · Other software · Philips · reported by zdi-disclosures@trendmicro.comHigh 8.1
Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the HomeKit Accessory Protocol service, which listens on TCP port 8080 by default. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28374.
- Product
- Hue Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Philips Hue Bridge hap_pair_verify_handler Sub-TLV Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2026-3557 · Other software · Philips · reported by zdi-disclosures@trendmicro.comHigh 8
Philips Hue Bridge hap_pair_verify_handler Sub-TLV Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the hap_pair_verify_handler function of the hk_hap service, which listens on TCP port 8080 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28337.
- Product
- Hue Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2026-3556 · Other software · Philips · reported by zdi-disclosures@trendmicro.comHigh 8.8
Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the hk_hap_pair_storage_put function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the HomeKit service. Was ZDI-CAN-28326.
- Product
- Hue Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2026-3555 · Other software · Philips · reported by zdi-disclosures@trendmicro.comHigh 8
Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. User interaction is required to exploit this vulnerability in that the user must initiate the device pairing process. The specific flaw exists within the handling of custom Zigbee ZCL frames in the Model Info download functionality. The issue results from the lack of proper validation of the size of data prior to copying it to a fixed-size heap buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28276.
- Product
- Hue Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026HTML Injection vulnerability in Isshue by Bdtask, consisting os an HTML injection due to a lack os proper validation of user input by sending a POST request CVE-2025-40679 · Other software · Bdtask · reported by cve-coordination@incibe.esMedium 5.1
HTML Injection vulnerability in Isshue by Bdtask, consisting os an HTML injection due to a lack os proper validation of user input by sending a POST request to '/category_product_search', affecting the 'product_name' parameter.
- Product
- Isshue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules.CVE-2021-47769 · Other software · Bdtask · reported by VulnCheckMedium 5.1
Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules. Attackers with privileged user accounts can inject malicious scripts that execute on preview, potentially enabling session hijacking and persistent phishing attacks.
- Product
- Isshue Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbdtask.comexploit-db.com
Nov 16, 2025A security vulnerability has been detected in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution 5.CVE-2025-13239 · Websites & servers · Bdtask · reported by VulDBLow 2.1
A security vulnerability has been detected in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution 5. Affected by this issue is some unknown functionality of the file /submit_checkout. Such manipulation of the argument order_total_amount/cart_total_amount leads to enforcement of behavioral workflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Isshue Multi Store eCommerce Shopping Cart Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2025A weakness has been identified in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution up to 4.0.CVE-2025-13186 · Websites & servers · Bdtask · reported by VulDBLow 1.9
A weakness has been identified in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution up to 4.0. This impacts an unknown function of the file /dashboard/Ccustomer/manage_customer. This manipulation of the argument Search causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Isshue Multi Store eCommerce Shopping Cart Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025Razer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability.CVE-2025-9870 · Other software · Razer · reported by zdi-disclosures@trendmicro.comHigh 7.8
Razer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Philips HUE module installer. By creating a symbolic link, an attacker can abuse the installer to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26375.
- Product
- Synapse 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely.CVE-2025-40918 · Other software · EHUELS · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 6.5
Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely. The cnonce (client nonce) is generated from an MD5 hash of the PID, the epoch time and the built-in rand function. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. According to RFC 2831, The cnonce-value is an opaque quoted string value provided by the client and used by both client and server to avoid chosen plaintext attacks, and to provide mutual authentication. The security of the implementation depends on a good choice. It is RECOMMENDED that it contain at least 64 bits of entropy.
- Product
- Authen::SASL::Perl::DIGEST_MD5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orggithub.com
May 21, 2025Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability.CVE-2025-3884 · Other software · Cloudera · reported by zdi-disclosures@trendmicro.comHigh 7.5
Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cloudera Hue. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Ace Editor web application. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-24332.
- Product
- Hue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2024Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0 allows an attacker to lead a user to accCVE-2024-54125 · Other software · SHUEISHA INC. · reported by vultures@jpcert.or.jpLow 3.3
Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0 allows an attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.
- Product
- "Shonen Jump+" App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpshonenjumpplus.com
Jul 10, 2024A vulnerability classified as critical was found in mhuertos phpLDAPadmin up to 665dbc2690ebeb5392d38f1fece0a654225a0b38.CVE-2016-15039 · Other software · mhuertos · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in mhuertos phpLDAPadmin up to 665dbc2690ebeb5392d38f1fece0a654225a0b38. Affected by this vulnerability is the function makeHttpRequest of the file htdocs/js/ajax_functions.js. The manipulation leads to http request smuggling. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named dd6e9583a2eb2ca085583765e8a63df5904cb036. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-270523.
- Product
- phpLDAPadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2024Hueman: Cross-Site Request Forgery (CSRF)CVE-2024-35772 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in presscustomizr Hueman.This issue affects Hueman: from n/a through 3.7.24.
- Product
- Hueman
- Affected
- up to 3.7.24
- What to do
- Affects up to 3.7.24. Update Hueman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 2, 2024A vulnerability, which was classified as problematic, was found in Bdtask Isshue Multi Store eCommerce Shopping Cart Solution 4.0.CVE-2024-2133 · Websites & servers · Bdtask · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, was found in Bdtask Isshue Multi Store eCommerce Shopping Cart Solution 4.0. This affects an unknown part of the file /dashboard/Cinvoice/manage_invoice of the component Manage Sale Page. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255495.
- Product
- Isshue Multi Store eCommerce Shopping Cart Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jannis Thuemmig Email Encoder plugin <= 2.1.8 versions.CVE-2023-47821 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jannis Thuemmig Email Encoder plugin <= 2.1.8 versions.
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 20, 2023Hueman: Cross-Site Request ForgeryCVE-2020-36753 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Hueman theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation on the save_meta_box() function. This makes it possible for unauthenticated attackers to save metabox data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Hueman
- Affected
- up to 3.6.3
- What to do
- Affects up to 3.6.3. Update Hueman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Aug 11, 2023Directory Traversal vulnerability in Foddy node-red-contrib-huemagic version 3.0.0, allows remote attackers to gain sensitive information via crafted request inCVE-2021-26504 · Other software · Dgtl · reported by MITREHigh 7.5
Directory Traversal vulnerability in Foddy node-red-contrib-huemagic version 3.0.0, allows remote attackers to gain sensitive information via crafted request in res.sendFile API in hue-magic.js.
- Product
- Huemagic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the child_processCVE-2023-29566 · Other software · Dawnsparks-node-tesseract Project · reported by MITRECritical 9.8
huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.
- Product
- Dawnsparks-node-tesseract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023Hueman Addons: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4784 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Hueman Addons WordPress plugin through 2.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Hueman Addons
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Hueman Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2021Cloudera Hue 4.6.0 allows XSS via the type parameter.CVE-2021-32481 · Other software · Cloudera · reported by MITREMedium 6.1
Cloudera Hue 4.6.0 allows XSS via the type parameter.
- Product
- HUE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cloudera.commy.cloudera.com
Nov 8, 2021Cloudera Hue 4.6.0 allows XSS.CVE-2021-29994 · Other software · Cloudera · reported by MITREMedium 6.1
Cloudera Hue 4.6.0 allows XSS.
- Product
- HUE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cloudera.comgithub.com
Jan 26, 2021node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary fiCVE-2021-25864 · Other software · Dgtl · reported by MITREHigh 7.5
node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file.
- Product
- Huemagic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2020Philips Hue is vulnerable to a Denial of Service attack.CVE-2018-7580 · Other software · Philips · reported by MITREHigh 7.5
Philips Hue is vulnerable to a Denial of Service attack. Sending a SYN flood on port tcp/80 will freeze Philips Hue's hub and it will stop responding. The "hub" will stop operating and be frozen until the flood stops. During the flood, the user won't be able to turn on/off the lights, and all of the hub's functionality will be unresponsive. The cloud service also won't work with the hub.
- Product
- HUE Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 23, 2020Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commissiCVE-2020-6007 · Other software · Philips · reported by cve@checkpoint.comHigh 7.9
Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commissioning phase, resulting in a remote code execution.
- Product
- HUE Bridge V2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.checkpoint.comwww2.meethue.com
Nov 26, 2019An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0.CVE-2019-7319 · Other software · Cloudera · reported by MITREHigh 8.3
An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0. When using one of following authentication backends: LdapBackend, PamBackend, SpnegoDjangoBackend, RemoteUserDjangoBackend, SAML2Backend, OpenIDBackend, or OAuthBackend, external users are created with superuser privileges.
- Product
- CDH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cloudera.comcloudera.com
Nov 26, 2019In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used.CVE-2015-7831 · Other software · Cloudera · reported by MITREHigh 8.8
In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used.
- Product
- CDH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cloudera.comdocs.cloudera.com
Jun 1, 2018Hue 3.12 has XSS via the /pig/save/ name and script parameters.CVE-2018-11649 · Other software · Gethue · reported by MITREMedium 6.1
Hue 3.12 has XSS via the /pig/save/ name and script parameters.
- Product
- HUE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2018Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URCVE-2015-8094 · Other software · Cloudera · reported by MITREMedium 6.1
Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter.
- Product
- HUE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudera.github.iogithub.com
Sep 30, 2017Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys (and consequently bypass the CVE-2017-14797 · Other software · Philips · reported by MITREHigh 7.5
Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys (and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories) by leveraging the ability to sniff HTTP traffic on the local intranet network.
- Product
- HUE Bridge Bsb002 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtiferrei.comtiferrei.com
Mar 7, 2017Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete.CVE-2016-4947 · Other software · Cloudera · reported by MITREMedium 5.3
Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete.
- Product
- HUE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record2016.hack.lusecurityfocus.com
Mar 7, 2017Multiple cross-site scripting (XSS) vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) CVE-2016-4946 · Other software · Cloudera · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) First name or (2) Last name field in the HUE Users page.
- Product
- HUE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record2016.hack.lusecurityfocus.com
Oct 19, 2014The HAPPY (aka com.tw.knowhowdesign.sinfonghuei) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middleCVE-2014-7075 · Other software · Happycloud · reported by cret@cert.orgMedium 5.4
The HAPPY (aka com.tw.knowhowdesign.sinfonghuei) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Happy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Dec 11, 2000Buffer overflow in ypbind 3.3 possibly allows an attacker to gain root privileges.CVE-2000-1041 · Other software · Swen Thuemmler · reported by MITREHigh 10
Buffer overflow in ypbind 3.3 possibly allows an attacker to gain root privileges.
- Product
- Ypbind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comcalderasystems.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.