Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
816 results · page 11 of 17
Sep 9, 2021BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability.CVE-2021-28910 · Other software · Bab-technologie · reported by MITREHigh 7.5
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. It allow unauthenticated attackers to request to any internal and external server.
- Product
- Eibport Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsytester.github.iopsytester.github.io
Sep 7, 2021The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in raCVE-2021-31610 · Other software · MI · reported by MITREMedium 6.5
The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (either restart or deadlock the device) by flooding a device with LMP_AU_rand data.
- Product
- MI True Wireless Earbuds Basic 2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbluetrum.combluetrum.com
Aug 26, 2021SQL Injection vulnerability in Hucart CMS 5.7.4 via the basic information field found in the avatar usd_image field.CVE-2020-18476 · Other software · Hucart · reported by MITREHigh 8.8
SQL Injection vulnerability in Hucart CMS 5.7.4 via the basic information field found in the avatar usd_image field.
- Product
- Hucart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2021Cross Site Scripting (XSS) vulnerability exists in EyouCMS1.3.6 in the basic_information area.CVE-2020-20645 · Other software · Eyoucms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability exists in EyouCMS1.3.6 in the basic_information area.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2021SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php.CVE-2020-18175 · Other software · Metinfo · reported by MITRECritical 9.8
SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2021basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pCVE-2021-33910 · Other software · Siemens · reported by MITREMedium 5.5
basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Jun 8, 2021In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.CVE-2020-26136 · Other software · Silverstripe · reported by MITREMedium 6.5
In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.
- Product
- Silverstripe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.silverstripe.orgsilverstripe.org
Jun 6, 2021The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_authCVE-2021-33880 · Other software · Websockets Project · reported by MITREMedium 5.9
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
- Product
- Websockets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2021SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the server.CVE-2021-27601 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the server. When a victim tries to open this file, it results in a Cross-Site Scripting (XSS) vulnerability and the attacker can read and modify data. However, the attacker does not have control over kind or degree.
- Product
- SAP NetWeaver AS for Java (Applications based on HTMLB for Java)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Mar 19, 2021A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS CVE-2019-10225 · Other software · Redhat · reported by Red HatMedium 6.3
A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass against leaking of the restuserkey. An attacker with basic-user permissions is able to obtain the value of restuserkey, and use it to authenticate to the GlusterFS REST service, gaining access to read, and modify files.
- Product
- Openshift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Mar 9, 2021Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without veriCVE-2021-21488 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without verification, leading to insecure deserialization which triggers the attacker’s code, therefore impacting Availability.
- Product
- SAP NetWeaver Knowledge Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Mar 8, 2021In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed uCVE-2021-21335 · Other software · stnoonan · reported by GitHubMedium 5.3
In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of spnego-http-auth-nginx-module. As a workaround, one may disable basic authentication.
- Product
- spnego-http-auth-nginx-module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2021Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication details only)" informaCVE-2021-21621 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication details only)" information, which can include the session ID of the user creating the support bundle in some configurations.
- Product
- Jenkins Support Core Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2021HCL OneTest Performance V9.5, V10.0, V10.1 uses basic authentication which is relatively weak.CVE-2020-14246 · Other software · Hcltechsw · reported by psirt@hcl.comHigh 7.5
HCL OneTest Performance V9.5, V10.0, V10.1 uses basic authentication which is relatively weak. An attacker could potentially decode the encoded credentials.
- Product
- Onetest Performance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jan 27, 2021Monitorix 3.13.0 allows remote attackers to bypass Basic Authentication in a default installation (i.e., an installation without a hosts_deny option).CVE-2021-3325 · Other software · Fibranet · reported by MITRECritical 9.8
Monitorix 3.13.0 allows remote attackers to bypass Basic Authentication in a default installation (i.e., an installation without a hosts_deny option). This issue occurred because a new access-control feature was introduced without considering that some exiting installations became unsafe, upon an update to 3.13.0, unless the new feature was immediately configured.
- Product
- Monitorix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust.CVE-2021-25906 · Other software · Basic DSP Matrix Project · reported by MITREHigh 7.5
An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust. When a TransformContent panic occurs, a double drop can be performed.
- Product
- Basic DSP Matrix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Jan 11, 2021In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check.CVE-2021-0308 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.8
In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-8.1, Android-9, Android-10, Android-11, Android-8.0; Android ID: A-158063095.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgsecurity.gentoo.org
Sep 30, 2020Niushop B2B2C Multi-business basic version V1.11, can bypass the administrator to obtain the background upload interface, through parameter upload, bypass the gCVE-2020-19672 · Other software · Niushop · reported by MITRECritical 9.8
Niushop B2B2C Multi-business basic version V1.11, can bypass the administrator to obtain the background upload interface, through parameter upload, bypass the getimagesize function, upload php file, getshell.
- Product
- Niushop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020In Niushop B2B2C Multi-Business Basic Edition V1.11, authentication can be bypassed, causing administrators to reset any passwords.CVE-2020-19670 · Other software · Niushop · reported by MITREMedium 4.9
In Niushop B2B2C Multi-Business Basic Edition V1.11, authentication can be bypassed, causing administrators to reset any passwords.
- Product
- Niushop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2020A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unauthorized code or coCVE-2020-12811 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.3
A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
- Product
- FortiManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.comfortiguard.com
Sep 9, 2020A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl.CVE-2020-15786 · Other software · Siemens · reported by productcert@siemens.comCritical 9.8
A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions <= V16), SIMATIC HMI Mobile Panels (All versions <= V16), SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently block excessive authentication attempts. This could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack.
- Product
- SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Aug 6, 2020In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access.CVE-2020-15114 · Other software · etcd-io · reported by GitHubHigh 7.7
In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.
- Product
- etcd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Aug 5, 2020CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R5CVE-2020-5608 · Other software · Yokogawa Electric Corporation · reported by vultures@jpcert.or.jpCritical 9.8
CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to bypass authentication and send altered communication packets via unspecified vectors.
- Product
- CAMS for HIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpweb-material3.yokogawa.com
Jul 22, 2020Incorrect security UI in basic auth in Google Chrome on iOS prior to 84.0.4147.89 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via aCVE-2020-6528 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Incorrect security UI in basic auth in Google Chrome on iOS prior to 84.0.4147.89 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jul 14, 2020A vulnerability has been identified in SIMATIC HMI Basic Panels 1st Generation (incl.CVE-2020-7592 · Other software · Siemens AG · reported by productcert@siemens.comMedium 6.5
A vulnerability has been identified in SIMATIC HMI Basic Panels 1st Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions), SIMATIC HMI KTP700F Mobile Arctic (All versions), SIMATIC HMI Mobile Panels 2nd Generation (All versions), SIMATIC WinCC Runtime Advanced (All versions). Unencrypted communication between the configuration software and the respective device could allow an attacker to capture potential plain text communication and have access to sensitive information.
- Product
- SIMATIC HMI Basic Panels 1st Generation (incl. SIPLUS variants)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comus-cert.cisa.gov
Jul 13, 2020An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payloads via the WifiNamCVE-2020-10989 · Network & remote access · Tenda · reported by MITREMedium 6.1
An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payloads via the WifiName POST parameter.
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comise.io
Jun 24, 2020In django-basic-auth-ip-whitelist before 0.3.4, a potential timing attack exists on websites where the basic authentication is used or configured, i.e.CVE-2020-4071 · Other software · tm-kn · reported by GitHubLow 2.2
In django-basic-auth-ip-whitelist before 0.3.4, a potential timing attack exists on websites where the basic authentication is used or configured, i.e. BASIC_AUTH_LOGIN and BASIC_AUTH_PASSWORD is set. Currently the string comparison between configured credentials and the ones provided by users is performed through a character-by-character string comparison. This enables a possibility that attacker may time the time it takes the server to validate different usernames and password, and use this knowledge to work out the valid credentials. This attack is understood not to be realistic over the Internet. However, it may be achieved from within local networks where the website is hosted, e.g. from inside a data centre where a website's server is located. Sites protected by IP address whitelisting only are unaffected by this vulnerability. This vulnerability has been fixed on version 0.3.4 of django-basic-auth-ip-whitelist. Update to version 0.3.4 as soon as possible and change basic authentication username and password configured on a Django project using this package. A workaround without upgrading to version 0.3.4 is to stop using basic authentication and use the IP whitelisting compo
- Product
- django-basic-auth-ip-whitelist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Jun 22, 2020In LoRa Basics Station before 2.0.4, there is a Use After Free vulnerability that leads to memory corruption.CVE-2020-4060 · Other software · LoRa Basics · reported by GitHubMedium 4.1
In LoRa Basics Station before 2.0.4, there is a Use After Free vulnerability that leads to memory corruption. This bug is triggered on 32-bit machines when the CUPS server responds with a message (https://doc.sm.tc/station/cupsproto.html#http-post-response) where the signature length is larger than 2 GByte (never happens in practice), or the response is crafted specifically to trigger this issue (i.e. the length signature field indicates a value larger than (2**31)-1 although the signature actually does not contain that much data). In such a scenario, on 32 bit machines, Basic Station would execute a code path, where a piece of memory is accessed after it has been freed, causing the process to crash and restarted again. The CUPS transaction is typically mutually authenticated over TLS. Therefore, in order to trigger this vulnerability, the attacker would have to gain access to the CUPS server first. If the user chose to operate without authentication over TLS but yet is concerned about this vulnerability, one possible workaround is to enable TLS authentication. This has been fixed in 2.0.4.
- Product
- LoRa Basics Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2020A CWE-798: Use of Hard-coded Credentials vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior) which cCVE-2020-7501 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 8.8
A CWE-798: Use of Hard-coded Credentials vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior) which could cause unauthorized read and write when downloading and uploading project or firmware into Vijeo Designer Basic and Vijeo Designer.
- Product
- Vijeo Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2020Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in basic repeater settings via an SSID.CVE-2019-19514 · Other software · Ayision · reported by MITREMedium 5.4
Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in basic repeater settings via an SSID.
- Product
- Ays-wr01 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 22, 2020A CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior), which could caCVE-2020-7490 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior), which could cause arbitrary code execution on the system running Vijeo Basic when a malicious DLL library is loaded by the Product.
- Product
- Vijeo Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2020There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware.CVE-2020-8966 · Other software · Tiki-Wiki Groupware · reported by cve-coordination@incibe.esMedium 6.5
There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS all versions through 20.0 allows malicious users to cause the injection of malicious code fragments (scripts) into a legitimate web page.
- Product
- Tiki-Wiki CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netincibe-cert.es
Mar 19, 2020NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application.CVE-2019-16067 · Other software · Netsas · reported by MITREHigh 7.5
NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application. The use of weak authentication transmitted over cleartext protocols can allow an attacker to steal username and password combinations by intercepting authentication traffic in transit.
- Product
- Enigma Network Management Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmogozobo.commogozobo.com
Mar 13, 2020The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over cleartext HTTP.CVE-2019-13394 · Network & remote access · Netgear · reported by MITRECritical 9.8
The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over cleartext HTTP.
- Product
- Cg3700b Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2020Technicolor TC7337NET 08.89.17.23.03 devices allow remote attackers to discover passwords by sniffing the network for an "Authorization: Basic" HTTP header.CVE-2020-10376 · Other software · Technicolor · reported by MITRECritical 9.8
Technicolor TC7337NET 08.89.17.23.03 devices allow remote attackers to discover passwords by sniffing the network for an "Authorization: Basic" HTTP header.
- Product
- Tc7337net Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2020SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can bCVE-2020-6208 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.2
SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can be executed by the application and thus allowing the attacker to control the behaviour of the application, leading to Remote Code Execution. Although the mode of attack is only Local, multiple applications can be impacted as a result of the vulnerability.
- Product
- SAP Business Objects Business Intelligence Platform (Crystal Reports)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Feb 18, 2020A Privilege Escalation Vulnerability exists in IBM Maximo Asset Management 7.5, 7.1, and 6.2, when WebSeal with Basic Authentication is used, due to a failure tCVE-2013-3323 · Other software · IBM · reported by MITRECritical 9.8
A Privilege Escalation Vulnerability exists in IBM Maximo Asset Management 7.5, 7.1, and 6.2, when WebSeal with Basic Authentication is used, due to a failure to invalidate the authentication session, which could let a malicious user obtain unauthorized access.
- Product
- Change And Configuration Management Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Feb 8, 2020The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users'CVE-2012-5570 · Other software · Basic Webmail Project · reported by Red HatMedium 4.3
The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users' email addresses.
- Product
- Basic Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jan 15, 2020Cisco IronPort Web Security Appliance up to and including 7.5 does not validate the basic constraints of the certificate authority which could lead to MITM attaCVE-2012-1326 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.4
Cisco IronPort Web Security Appliance up to and including 7.5 does not validate the basic constraints of the certificate authority which could lead to MITM attacks
- Product
- IronPort Web Security Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Jan 9, 2020A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenaCVE-2020-6168 · WordPress plugins & themes · reported by MITREHigh 7.6
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenance-mode settings (impacting the availability and confidentiality of a vulnerable site, along with the integrity of the setting).
- Affected
- up to 2.10
- What to do
- Affects up to 2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Jan 9, 2020A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export settings and change CVE-2020-6166 · WordPress plugins & themes · reported by MITREMedium 5.4
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export settings and change maintenance-mode themes.
- Affected
- up to 2.15
- What to do
- Affects up to 2.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Dec 13, 2019Yabasic 2.86.2 has a heap-based buffer overflow in myformat in function.c via a crafted BASIC source file.CVE-2019-19796 · Other software · Yabasic · reported by MITREHigh 7.8
Yabasic 2.86.2 has a heap-based buffer overflow in myformat in function.c via a crafted BASIC source file.
- Product
- Yabasic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2019Yabasic 2.86.1 has a heap-based buffer overflow in the yylex() function in flex.c via a crafted BASIC source file.CVE-2019-19720 · Other software · Yabasic · reported by MITREHigh 8.8
Yabasic 2.86.1 has a heap-based buffer overflow in the yylex() function in flex.c via a crafted BASIC source file.
- Product
- Yabasic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2019haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connectionsCVE-2013-0243 · Other software · haskell-tls-extra · reported by Red HatHigh 7.4
haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections
- Product
- haskell-tls-extra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comaccess.redhat.com
Nov 6, 2019Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access CVE-2019-5644 · Other software · Computing For Good · reported by cve@rapid7.comCritical 10
Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may alter several facets of a user account, including promoting any user to an administrator.
- Product
- Basic Laboratory Information System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.rapid7.comblog.rapid7.com
Nov 6, 2019Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access CVE-2019-5643 · Other software · Computing For Good · reported by cve@rapid7.comMedium 5.3
Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may enumerate the user names and facility names in use on a particular installation.
- Product
- Basic Laboratory Information System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.rapid7.comblog.rapid7.com
Nov 6, 2019Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access CVE-2019-5617 · Other software · Computing For Good · reported by cve@rapid7.comCritical 10
Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may change the password of any administrator-level user.
- Product
- Basic Laboratory Information System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.rapid7.comblog.rapid7.com
Nov 5, 2019Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.CVE-2013-6275 · Other software · Horde · reported by MITREMedium 6.5
Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.
- Product
- Groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comexploit-db.com
Oct 21, 2019In FusionPBX up to v4.5.7, the file app\basic_operator_panel\resources\content.php uses an unsanitized "eavesdrop_dest" variable coming from the URL, which is rCVE-2019-16988 · Other software · Fusionpbx · reported by MITREMedium 6.1
In FusionPBX up to v4.5.7, the file app\basic_operator_panel\resources\content.php uses an unsanitized "eavesdrop_dest" variable coming from the URL, which is reflected on 3 occasions in HTML, leading to XSS.
- Product
- Fusionpbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresp3ctblog.wordpress.com
Oct 11, 2019IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][uid] is non-persistent in 10.1.3 and 10.2.0.CVE-2010-5339 · Other software · Icewarp · reported by MITREMedium 6.1
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][uid] is non-persistent in 10.1.3 and 10.2.0.
- Product
- Webclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comgosecurity.ch
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.