Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
718 results · page 10 of 15
Apr 8, 2021A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to caCVE-2021-1404 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper buffer size tracking that may result in a heap buffer over-read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.
- Product
- ClamAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.clamav.netblog.clamav.net
Apr 8, 2021A vulnerability in the Excel XLM macro parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote atCVE-2021-1252 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the Excel XLM macro parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper error handling that may result in an infinite loop. An attacker could exploit this vulnerability by sending a crafted Excel file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process hang, resulting in a denial of service condition.
- Product
- ClamAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.clamav.netblog.clamav.net
Apr 8, 2021A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV for WindoCVE-2021-1386 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7
A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV for Windows, and Immunet could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected Windows system. To exploit this vulnerability, the attacker would need valid credentials on the system. The vulnerability is due to insufficient validation of directory search paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file on an affected system. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges.
- Product
- Cisco AMP for Endpoints
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Mar 19, 2021The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png fiCVE-2021-27506 · Other software · Netasq Project · reported by MITREMedium 5.5
The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1.
- Product
- Netasq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.stormshield.eublog.clamav.net
Feb 9, 2021An issue was discovered in the calamine crate before 0.17.0 for Rust.CVE-2021-26951 · Other software · Calamine Project · reported by MITRECritical 9.8
An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::set_len is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get.
- Product
- Calamine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Jan 3, 2021Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content CVE-2021-3007 · Other software · Getlaminas · reported by MITRECritical 9.8
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized
- Product
- Laminas-http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2020Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addUser.CVE-2020-35245 · Other software · Flamingo Project · reported by MITRECritical 9.8
Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addUser.
- Product
- Flamingo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2020Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addGroup.CVE-2020-35244 · Other software · Flamingo Project · reported by MITRECritical 9.8
Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addGroup.
- Product
- Flamingo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2020Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserInfoInDb.CVE-2020-35243 · Other software · Flamingo Project · reported by MITRECritical 9.8
Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserInfoInDb.
- Product
- Flamingo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2020Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserTeamInfoInDbAndMemory.CVE-2020-35242 · Other software · Flamingo Project · reported by MITRECritical 9.8
Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserTeamInfoInDbAndMemory.
- Product
- Flamingo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2020Flamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 CVE-2020-35284 · Other software · Flamingoim Project · reported by MITREHigh 7.5
Flamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation details can be easily determined because the product's source code is available.
- Product
- Flamingoim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2020An issue was discovered in ClamXAV 3 before 3.1.1.CVE-2020-26893 · Other software · Clamxav · reported by MITREHigh 7.8
An issue was discovered in ClamXAV 3 before 3.1.1. A malicious actor could use a properly signed copy of ClamXAV 2 (running with an injected malicious dylib) to communicate with ClamXAV 3's helper tool and perform privileged operations. This occurs because of inadequate client verification in the helper tool.
- Product
- Clamxav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Sep 25, 2020Pagure before 5.6 allows XSS via the templates/blame.html blame view.CVE-2019-11556 · Other software · Redhat · reported by MITREMedium 6.1
Pagure before 5.6 allows XSS via the templates/blame.html blame view.
- Product
- Pagure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Aug 13, 2020In C2 flame devices, there is a possible bypass of seccomp due to a missing configuration file.CVE-2020-0261 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In C2 flame devices, there is a possible bypass of seccomp due to a missing configuration file. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-146059841
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jul 20, 2020A vulnerability in the EGG archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.0 - 0.102.3 could allow an unauthenticated, remote attackerCVE-2020-3481 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the EGG archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.0 - 0.102.3 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a null pointer dereference. An attacker could exploit this vulnerability by sending a crafted EGG file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.
- Product
- ClamAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.clamav.netlists.debian.org
Jun 17, 2020A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running softwarCVE-2020-3350 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running software to delete arbitrary files on the system. The vulnerability is due to a race condition that could occur when scanning malicious files. An attacker with local shell access could exploit this vulnerability by executing a script that could trigger the race condition. A successful exploit could allow the attacker to delete arbitrary files on the system that the attacker would not normally have privileges to delete, producing system instability or causing the endpoint software to stop working.
- Product
- Cisco AMP for Endpoints
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
May 12, 2020A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker tCVE-2020-3341 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack buffer overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.
- Product
- ClamAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.clamav.netlists.debian.org
May 12, 2020A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause CVE-2020-3327 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a heap buffer overflow read. An attacker could exploit this vulnerability by sending a crafted ARJ file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.
- Product
- ClamAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.clamav.netlists.debian.org
Apr 7, 2020clamscan through 1.2.0 is vulnerable to Command Injection.CVE-2020-7613 · Other software · Clamscan Project · reported by report@snyk.ioHigh 8.1
clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the `_is_clamav_binary` function located within `Index.js`. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that will be chained to execute. This lowers the risk of this issue.
- Product
- Clamscan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2020An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component.CVE-2020-10990 · Other software · Accenture · reported by MITRECritical 9.8
An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component.
- Product
- Mercury
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2020Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker.CVE-2020-8137 · Other software · Blamer Project · reported by support@hackerone.comCritical 9.8
Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker.
- Product
- Blamer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Mar 11, 2020Blamer versions prior to 1.0.1 allows execution of arbitrary commands.CVE-2019-10807 · Other software · Blamer Project · reported by report@snyk.ioCritical 9.8
Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer.
- Product
- Blamer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2020A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated, remoteCVE-2020-3123 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to an out-of-bounds read affecting users that have enabled the optional DLP feature. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.
- Product
- ClamAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.clamav.netquickview.cloudapps.cisco.com
Jan 15, 2020A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attackerCVE-2019-15961 · Other software · ClamAV · reported by psirt@cisco.comHigh 7.5
A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to inefficient MIME parsing routines that result in extremely long scan times of specially formatted email files. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to scan the crafted email file indefinitely, resulting in a denial of service condition.
- Product
- ClamAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.clamav.netlists.debian.org
Jan 8, 2020In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitizatiCVE-2019-10777 · Other software · Amazon · reported by report@snyk.ioCritical 9.8
In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName".
- Product
- AWS Lambda
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2020OpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000.CVE-2019-20329 · Other software · Openlambda Project · reported by MITREHigh 8.1
OpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000.
- Product
- Openlambda
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2019A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, and dn parameters to cmd.php.CVE-2012-1115 · Other software · ldap-account-manager · reported by Red HatMedium 6.1
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, and dn parameters to cmd.php.
- Product
- LDAP Account Manager (LAM) Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Dec 5, 2019A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_id action.CVE-2012-1114 · Other software · ldap-account-manager · reported by Red HatMedium 6.1
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_id action. and the filteruid parameter to list.php.
- Product
- LDAP Account Manager (LAM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Nov 15, 2019ClamAV before 0.97.7: dbg_printhex possible information leakCVE-2013-7089 · Other software · Clamav · reported by MITREHigh 7.5
ClamAV before 0.97.7: dbg_printhex possible information leak
- Product
- Clamav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgopenwall.com
Nov 15, 2019ClamAV before 0.97.7 has buffer overflow in the libclamav componentCVE-2013-7088 · Other software · Clamav · reported by MITRECritical 9.8
ClamAV before 0.97.7 has buffer overflow in the libclamav component
- Product
- Clamav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgopenwall.com
Nov 15, 2019ClamAV before 0.97.7 has WWPack corrupt heap memoryCVE-2013-7087 · Other software · Clamav · reported by MITRECritical 9.8
ClamAV before 0.97.7 has WWPack corrupt heap memory
- Product
- Clamav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgopenwall.com
Nov 7, 2019clamav 0.91.2 suffers from a floating point exception when using ScanOLE2.CVE-2007-6745 · Other software · clamav · reported by Red HatCritical 9.8
clamav 0.91.2 suffers from a floating point exception when using ScanOLE2.
- Product
- clamav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comaccess.redhat.com
Nov 5, 2019There is a possible heap overflow in libclamav/fsg.c before 0.100.0.CVE-2007-0899 · Other software · Clamav · reported by MITRECritical 9.8
There is a possible heap overflow in libclamav/fsg.c before 0.100.0.
- Product
- Clamav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-tracker.debian.orgsecurity-tracker.debian.org
Nov 5, 2019ClamAV versions prior to 0.101.2 are susceptible to a denial of service (DoS) vulnerability.CVE-2019-1789 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
ClamAV versions prior to 0.101.2 are susceptible to a denial of service (DoS) vulnerability. An out-of-bounds heap read condition may occur when scanning PE files. An example is Windows EXE and DLL files that have been packed using Aspack as a result of inadequate bound-checking.
- Product
- ClamAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.clamav.netblog.clamav.net
Nov 5, 2019ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sendinCVE-2019-12625 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sending crafted messages to an affected system.
- Product
- ClamAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Sep 14, 2019FlameCMS 3.3.5 has SQL injection in account/login.php via accountName.CVE-2019-16309 · Other software · Flamecms Project · reported by MITRECritical 9.8
FlameCMS 3.3.5 has SQL injection in account/login.php via accountName.
- Product
- Flamecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Aug 2, 2019cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).CVE-2017-18447 · Websites & servers · Cpanel · reported by MITREMedium 6.3
cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 1, 2019cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408).CVE-2018-20902 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 1, 2019cPanel before 74.0.8 allows local users to disable the ClamAV daemon (SEC-409).CVE-2018-20873 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 74.0.8 allows local users to disable the ClamAV daemon (SEC-409).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Jul 2, 2019Calamares versions 3.1 through 3.2.10 copies a LUKS encryption keyfile from /crypto_keyfile.bin (mode 0600 owned by root) to /boot within a globally readable inCVE-2019-13179 · Other software · Calamares · reported by MITREHigh 7.5
Calamares versions 3.1 through 3.2.10 copies a LUKS encryption keyfile from /crypto_keyfile.bin (mode 0600 owned by root) to /boot within a globally readable initramfs image with insecure permissions, which allows this originally protected file to be read by any user, thereby disclosing decryption keys for LUKS containers created with Full Disk Encryption.
- Product
- Calamares
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Jul 2, 2019modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and wCVE-2019-13178 · Other software · Calamares · reported by MITREHigh 8.1
modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.
- Product
- Calamares
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Apr 8, 2019A vulnerability in the Portable Executable (PE) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthCVE-2019-1798 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
A vulnerability in the Portable Executable (PE) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for PE files sent an affected device. An attacker could exploit this vulnerability by sending malformed PE files to the device running an affected version ClamAV Software. An exploit could allow the attacker to cause an out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device.
- Product
- ClamAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.clamav.netsecurity.gentoo.org
Apr 8, 2019A vulnerability in the Object Linking & Embedding (OLE2) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow CVE-2019-1788 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
A vulnerability in the Object Linking & Embedding (OLE2) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for OLE2 files sent an affected device. An attacker could exploit this vulnerability by sending malformed OLE2 files to the device running an affected version ClamAV Software. An exploit could allow the attacker to cause an out-of-bounds write condition, resulting in a crash that could result in a denial of service condition on an affected device.
- Product
- ClamAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Apr 8, 2019A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unautCVE-2019-1787 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an affected device. An attacker could exploit this vulnerability by sending crafted PDF files to an affected device. A successful exploit could allow the attacker to cause a heap buffer out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device.
- Product
- ClamAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Apr 8, 2019A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unaCVE-2019-1786 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an affected device. An attacker could exploit this vulnerability by sending crafted PDF files to an affected device. A successful exploit could allow the attacker to cause an out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device.
- Product
- ClamAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugs.chromium.org
Apr 8, 2019A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote aCVE-2019-1785 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.8
A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper error-handling mechanisms when processing nested RAR files sent to an affected device. An attacker could exploit this vulnerability by sending a crafted RAR file to an affected device. An exploit could allow the attacker to view or create arbitrary files on the targeted system.
- Product
- ClamAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.clamav.netsecurity.gentoo.org
Mar 21, 2019In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator.CVE-2018-19515 · Other software · ENS · reported by MITRECritical 9.8
In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator. However, by using one of the bgsend, atment_sddd1xGz, or xls_bgimport query parameters, most of these methods become available to unauthenticated users.
- Product
- Webgalamb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 21, 2019In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication.CVE-2018-19514 · Other software · ENS · reported by MITRECritical 9.8
In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication. Exploitation requires authentication bypass to access administrative functions of the site to upload a crafted CSV file with a malicious payload that becomes part of a PHP eval() expression in the subscriber.php file.
- Product
- Webgalamb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 21, 2019In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames.CVE-2018-19513 · Other software · ENS · reported by MITREHigh 7.5
In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames. The log file could contain sensitive client data (email addresses) and also facilitates exploitation of SQL injection errors.
- Product
- Webgalamb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 21, 2019In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to arbitrary code execution by authenticated administCVE-2018-19512 · Other software · ENS · reported by MITREHigh 7.2
In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to arbitrary code execution by authenticated administrator users, because PHP files are restored under the document root directory.
- Product
- Webgalamb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.