Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22 results
Oct 2, 2024The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability.CVE-2024-9441 · Other software · Linear · reported by VulnCheckCritical 9.8
The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary OS commands via the login_id parameter when invoking the forgot_password functionality over HTTP.
- Product
- eMerge e3-Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordssd-disclosure.comvulncheck.com
Jan 3, 2023Nice (formerly Nortek) Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e devices are vulnerable to Stored Cross-SCVE-2022-42710 · Other software · Niceforyou · reported by MITREMedium 5.4
Nice (formerly Nortek) Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e devices are vulnerable to Stored Cross-Site Scripting (XSS).
- Product
- Linear Emerge E3 Access Control Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2023Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL injection vulnerabilityCVE-2022-38627 · Other software · Niceforyou · reported by MITRECritical 9.8
Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL injection vulnerability via the idt parameter.
- Product
- Linear Emerge E3 Access Control Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022Certain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge_template_v0.php component).CVE-2022-46381 · Other software · Niceforyou · reported by MITREMedium 6.1
Certain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge_template_v0.php component). This affects 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e.
- Product
- Linear Emerge E3 Access Control Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a cross-site scripting (XSS) CVE-2022-38628 · Other software · Niceforyou · reported by MITREMedium 6.1
Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a cross-site scripting (XSS) vulnerability which is chained with a local session fixation. This vulnerability allows attackers to escalate privileges via unspecified vectors.
- Product
- Linear Emerge E3 Access Control Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /card_scan.php?CardFormatNo= XSS with session fixation (via PHPSESSID) when they are chained tCVE-2022-31798 · Other software · Nortekcontrol · reported by MITREMedium 6.1
Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /card_scan.php?CardFormatNo= XSS with session fixation (via PHPSESSID) when they are chained together. This would allow an attacker to take over an admin account or a user account.
- Product
- Emerge E3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comeg.linkedin.com
Aug 25, 2022Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo.CVE-2022-31499 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. NOTE: this issue exists because of an incomplete fix for CVE-2019-7256.
- Product
- Emerge E3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comeg.linkedin.com
Aug 25, 2022Nortek Linear eMerge E3-Series devices through 0.32-09c place admin credentials in /test.txt that allow an attacker to open a building's doors.CVE-2022-31269 · Other software · Nortekcontrol · reported by MITREHigh 8.2
Nortek Linear eMerge E3-Series devices through 0.32-09c place admin credentials in /test.txt that allow an attacker to open a building's doors. (This occurs in situations where the CVE-2019-7271 default credentials have been changed.)
- Product
- Emerge E3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comeg.linkedin.com
Jul 2, 2019Linear eMerge E3-Series devices allow Privilege Escalation.CVE-2019-7258 · Other software · Nortekcontrol · reported by MITREHigh 8.8
Linear eMerge E3-Series devices allow Privilege Escalation.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow Unrestricted File Upload.CVE-2019-7257 · Other software · Nortekcontrol · reported by MITRECritical 10
Linear eMerge E3-Series devices allow Unrestricted File Upload.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Nice Linear eMerge E3-Series OS Command Injection VulnerabilityCVE-2019-7256 · Other software · Nice · reported by MITREExploitedCritical 9.8
Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution.
- Product
- Linear eMerge E3-Series
- On CISA’s list since
- Mar 25, 2024 (federal fix deadline Apr 15, 2024)
- What to do
- Attackers are using this now. Install Nice’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Jul 2, 2019Linear eMerge E3-Series devices allow XSS.CVE-2019-7255 · Other software · Nortekcontrol · reported by MITREMedium 6.1
Linear eMerge E3-Series devices allow XSS.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow File Inclusion.CVE-2019-7254 · Other software · Nortekcontrol · reported by MITREHigh 7.5
Linear eMerge E3-Series devices allow File Inclusion.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow Directory Traversal.CVE-2019-7253 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices allow Directory Traversal.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices have Default Credentials.CVE-2019-7252 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices have Default Credentials.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).CVE-2019-7262 · Other software · Nortekcontrol · reported by MITREHigh 8.8
Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices have Hard-coded Credentials.CVE-2019-7261 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices have Hard-coded Credentials.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices have Cleartext Credentials in a Database.CVE-2019-7260 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices have Cleartext Credentials in a Database.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure.CVE-2019-7259 · Other software · Nortekcontrol · reported by MITREHigh 8.8
Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH).CVE-2019-7265 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH).
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow a Stack-based Buffer Overflow on the ARM platform.CVE-2019-7264 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices allow a Stack-based Buffer Overflow on the ARM platform.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices have a Version Control Failure.CVE-2019-7263 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices have a Version Control Failure.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.