Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
816 results · page 12 of 17
Oct 11, 2019IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][action] is non-persistent in 10.1.3 and 10.2.0CVE-2010-5338 · Other software · Icewarp · reported by MITREMedium 6.1
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][action] is non-persistent in 10.1.3 and 10.2.0.
- Product
- Webclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comgosecurity.ch
Oct 11, 2019IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][controller] is non-persistent in 10.1.3 and 10CVE-2010-5337 · Other software · Icewarp · reported by MITREMedium 6.1
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][controller] is non-persistent in 10.1.3 and 10.2.0.
- Product
- Webclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comgosecurity.ch
Oct 10, 2019The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter.CVE-2015-9473 · WordPress plugins & themes · reported by MITREHigh 7.5
The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter.
- Product
- estrutura-basica
- Affected
- up to 2015-09-13
- What to do
- Affects up to 2015-09-13. Update estrutura-basica to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Sep 27, 2019In wpa_supplicant, there is a possible man in the middle vulnerability due to improper input validation of the basicConstraints field of intermediary certificatCVE-2019-9414 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.9
In wpa_supplicant, there is a possible man in the middle vulnerability due to improper input validation of the basicConstraints field of intermediary certificates. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-111893041
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Aug 5, 2019Brandy 1.20.1 has a heap-based buffer overflow in define_array in variables.c via crafted BASIC source code.CVE-2019-14665 · Other software · Brandy Project · reported by MITREMedium 5.5
Brandy 1.20.1 has a heap-based buffer overflow in define_array in variables.c via crafted BASIC source code.
- Product
- Brandy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Aug 5, 2019Brandy 1.20.1 has a stack-based buffer overflow in fileio_openin in fileio.c via crafted BASIC source code.CVE-2019-14663 · Other software · Brandy Project · reported by MITREMedium 5.5
Brandy 1.20.1 has a stack-based buffer overflow in fileio_openin in fileio.c via crafted BASIC source code.
- Product
- Brandy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Aug 5, 2019Brandy 1.20.1 has a stack-based buffer overflow in fileio_openout in fileio.c via crafted BASIC source code.CVE-2019-14662 · Other software · Brandy Project · reported by MITREMedium 5.5
Brandy 1.20.1 has a stack-based buffer overflow in fileio_openout in fileio.c via crafted BASIC source code.
- Product
- Brandy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Jul 9, 2019In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token (this is the parameter used by the API).CVE-2019-13337 · Other software · Weseek · reported by MITREHigh 7.5
In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token (this is the parameter used by the API). No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is required.
- Product
- Growi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 22, 2019A Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which coCVE-2018-7823 · Other software · Schneider-electric · reported by cybersecurity@se.comMedium 5.3
A Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause remote launch of SoMachine Basic when sending crafted ethernet message.
- Product
- Somachine Basic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
May 22, 2019An Incorrect Default Permissions (CWE-276) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmwarCVE-2018-7822 · Other software · Schneider-electric · reported by cybersecurity@se.comMedium 5.5
An Incorrect Default Permissions (CWE-276) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause unauthorized access to SoMachine Basic resource files when logged on the system hosting SoMachine Basic.
- Product
- Somachine Basic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
May 22, 2019An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which cCVE-2018-7821 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.5
An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause cycle time impact when flooding the M221 ethernet interface while the Ethernet/IP adapter is activated.
- Product
- Somachine Basic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
May 17, 2019Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to bypass access restriction to browse unauthorized pages via the application 'Management of Basic System'.CVE-2019-5930 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 4.3
Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to bypass access restriction to browse unauthorized pages via the application 'Management of Basic System'.
- Product
- Cybozu Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkb.cybozu.support
May 10, 2019A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display Basic versions prior tCVE-2015-1006 · Other software · Opto 22 · reported by ics-cert@hq.dhs.govCritical 9.8
A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display Basic versions prior to R9.4f, PAC Display Professional versions prior to R9.4f, OptoOPCServer versions prior to R9.4c, and OptoDataLink version R9.4d and prior versions that were installed by PAC Project installer, versions prior to R9.4006, is susceptible to a heap-based buffer overflow condition that may allow remote code execution on the target system. Opto 22 suggests upgrading to the new product version as soon as possible.
- Product
- PAC Project Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Mar 21, 2019PHP Scripts Mall Basic B2B Script 2.0.9 has has directory traversal via a direct request for a listing of an image directory such as an uploads/ directory.CVE-2018-20646 · Other software · Basic B2b Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Basic B2B Script 2.0.9 has has directory traversal via a direct request for a listing of an image directory such as an uploads/ directory.
- Product
- Basic B2b Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Basic B2B Script 2.0.9 has HTML injection via the First Name or Last Name field.CVE-2018-20645 · Other software · Basic B2b Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Basic B2B Script 2.0.9 has HTML injection via the First Name or Last Name field.
- Product
- Basic B2b Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Basic B2B Script 2.0.9 has Cross-Site Request Forgery (CSRF) via the Edit profile feature.CVE-2018-20644 · Other software · Basic B2b Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Basic B2B Script 2.0.9 has Cross-Site Request Forgery (CSRF) via the Edit profile feature.
- Product
- Basic B2b Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2019In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP NAT module has insufficient ASN.1 length checks (aka an array index CVE-2019-9162 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP NAT module has insufficient ASN.1 length checks (aka an array index error), making out-of-bounds read and write operations possible, leading to an OOPS or local privilege escalation. This affects snmp_version and snmp_helper.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orgsecurityfocus.com
Jan 10, 2019Imperva SecureSphere gateway (GW) running v13, for both pre-First Time Login or post-First Time Login (FTL), if the attacker knows the basic authentication passCVE-2018-5403 · Other software · Imperva · reported by cret@cert.orgHigh 8.1
Imperva SecureSphere gateway (GW) running v13, for both pre-First Time Login or post-First Time Login (FTL), if the attacker knows the basic authentication passwords, the GW may be vulnerable to RCE through specially crafted requests, from the web access management interface.
- Product
- SecureSphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jan 2, 2019aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensCVE-2019-3500 · Other software · Aria2 Project · reported by MITREHigh 7.8
aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.
- Product
- Aria2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Dec 20, 2018Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker (in the same network CVE-2018-18871 · Other software · Gigasetpro · reported by MITRECritical 9.8
Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker (in the same network as the device) to change the admin password without authentication (and without knowing the original password).
- Product
- Maxwell Basic Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsit.fraunhofer.desit.fraunhofer.de
Nov 30, 2018An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Modicon M340, Premium, CVE-2018-7831 · Other software · Schneider Electric SE · reported by cybersecurity@se.comHigh 8.8
An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a password change on the web server.
- Product
- Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comtenable.com
Nov 15, 2018A remote code execution vulnerability exists when Team Foundation Server (TFS) does not enable basic authorization on the communication between the TFS and SearCVE-2018-8529 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
A remote code execution vulnerability exists when Team Foundation Server (TFS) does not enable basic authorization on the communication between the TFS and Search services, aka "Team Foundation Server Remote Code Execution Vulnerability." This affects Team.
- Product
- Team
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comportal.msrc.microsoft.com
Oct 30, 2018An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5.CVE-2018-18830 · Other software · Mingsoft · reported by MITRECritical 9.8
An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercept the data packet. In the name parameter, change the suffix to jsp. In the response, the server returns the storage path of the file, which can be accessed to execute arbitrary JSP code.
- Product
- Mcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2018An XSS issue was discovered in index.php/admin/system/basic in YUNUCMS 1.1.5.CVE-2018-18720 · Other software · Yunucms · reported by MITREMedium 4.8
An XSS issue was discovered in index.php/admin/system/basic in YUNUCMS 1.1.5.
- Product
- Yunucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2018Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page.CVE-2018-18553 · Other software · Leanote · reported by MITREMedium 6.1
Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page.
- Product
- Leanote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2018A stack-based buffer overflow vulnerability in Opto 22 PAC Control Basic and PAC Control Professional versions R10.0a and prior may allow remote code execution.CVE-2018-14807 · Other software · Opto 22 · reported by ics-cert@hq.dhs.govCritical 9.8
A stack-based buffer overflow vulnerability in Opto 22 PAC Control Basic and PAC Control Professional versions R10.0a and prior may allow remote code execution.
- Product
- PAC Control Basic and PAC Control Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govopto22.com
Sep 2, 2018WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic form[statcode] parameter.CVE-2018-16350 · Other software · Wuzhi CMS Project · reported by MITREMedium 6.1
WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic form[statcode] parameter.
- Product
- Wuzhi CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2018A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiTokenAuthenticator.jCVE-2018-1999043 · Websites & servers · Jenkins · reported by MITREHigh 7.5
A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiTokenAuthenticator.java that allows attackers to create ephemeral in-memory user records by attempting to log in using invalid credentials.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2018PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name, Last name, Address 1, City, State, and Company name fields.CVE-2018-14541 · Other software · Readymadeb2bscript · reported by MITREMedium 5.4
PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name, Last name, Address 1, City, State, and Company name fields.
- Product
- Basic B2b
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgkaim.comexploit-db.com
Jul 23, 2018A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote member to upload a .CVE-2018-14570 · Other software · Niushop · reported by MITREHigh 8.8
A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote member to upload a .php file to the web server via a profile avatar field, by using an image Content-Type (e.g., image/jpeg) with a modified filename and file content. This results in arbitrary code execution by requesting that .php file.
- Product
- B2b2c Multi-business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2018Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resultinCVE-2018-7783 · Other software · Schneider Electric SE · reported by cybersecurity@se.comHigh 7.5
Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.
- Product
- SoMachine Basic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
Jul 3, 2018In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if CVE-2018-11746 · Other software · Puppet · reported by security@puppet.comHigh 8.6
In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery.
- Product
- Puppet Discovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgpuppet.com
Jun 28, 2018Brickstream 2300 devices allow remote attackers to obtain potentially sensitive information via a direct request for the basic.html#ipsettings or basic.html#datCVE-2018-12920 · Other software · Flir · reported by MITREHigh 7.5
Brickstream 2300 devices allow remote attackers to obtain potentially sensitive information via a direct request for the basic.html#ipsettings or basic.html#datadelivery URI.
- Product
- Brickstream 2300 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a JenkinCVE-2018-1000601 · Websites & servers · Jenkins · reported by MITREMedium 6.5
A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.
- Product
- SSH Credentials
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2018Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp.CVE-2018-12265 · Other software · Exiv2 · reported by MITREHigh 8.8
Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp.
- Product
- Exiv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgaccess.redhat.com
May 2, 2018Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> WebsitCVE-2018-10680 · Other software · Zblogcn · reported by MITREMedium 6.1
Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor disputes the security relevance, noting it is "just a functional bug.
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2018Vulnerability in the Oracle Financial Services Basel Regulatory Capital Basic component of Oracle Financial Services Applications (subcomponent: Portfolio, AttrCVE-2018-2855 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1
Vulnerability in the Oracle Financial Services Basel Regulatory Capital Basic component of Oracle Financial Services Applications (subcomponent: Portfolio, Attribution). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Basel Regulatory Capital Basic. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Basel Regulatory Capital Basic accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Basel Regulatory Capital Basic accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
- Product
- Financial Services Basel Regulatory Capital Basic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Apr 18, 2018Vulnerability in the Oracle Financial Services Basel Regulatory Capital Basic component of Oracle Financial Services Applications (subcomponent: Portfolio, AttrCVE-2018-2854 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Oracle Financial Services Basel Regulatory Capital Basic component of Oracle Financial Services Applications (subcomponent: Portfolio, Attribution). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Basel Regulatory Capital Basic. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Basel Regulatory Capital Basic, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Basel Regulatory Capital Basic accessible data as well as unauthorized read access to a subset of Oracle Financial Services Basel Regulatory Capital Basic accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- Financial Services Basel Regulatory Capital Basic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Apr 10, 2018Coship RT3052 4.0.0.48 devices allow XSS via a crafted SSID field on the "Wireless Setting - Basic" screen.CVE-2018-8772 · Other software · Coship · reported by MITREMedium 6.1
Coship RT3052 4.0.0.48 devices allow XSS via a crafted SSID field on the "Wireless Setting - Basic" screen.
- Product
- Rt3052 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.com0day4u.wordpress.com
Jan 25, 2018A vulnerability has been identified in TeleControl Server Basic < V3.1.CVE-2018-4837 · Other software · Siemens AG · reported by productcert@siemens.comHigh 7.5
A vulnerability has been identified in TeleControl Server Basic < V3.1. An attacker with access to the TeleControl Server Basic's webserver (port 80/tcp or 443/tcp) could cause a Denial-of-Service condition on the web server. The remaining functionality of the TeleControl Server Basic is not affected by the Denial-of-Service condition.
- Product
- TeleControl Server Basic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Jan 25, 2018A vulnerability has been identified in TeleControl Server Basic < V3.1.CVE-2018-4836 · Other software · Siemens AG · reported by productcert@siemens.comHigh 8.8
A vulnerability has been identified in TeleControl Server Basic < V3.1. An authenticated attacker with a low-privileged account to the TeleControl Server Basic's port 8000/tcp could escalate his privileges and perform administrative operations.
- Product
- TeleControl Server Basic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Jan 25, 2018A vulnerability has been identified in TeleControl Server Basic < V3.1.CVE-2018-4835 · Other software · Siemens AG · reported by productcert@siemens.comMedium 5.3
A vulnerability has been identified in TeleControl Server Basic < V3.1. An attacker with network access to the TeleControl Server Basic's port 8000/tcp could bypass the authentication mechanism and read limited information.
- Product
- TeleControl Server Basic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Jan 19, 2018In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11CVE-2017-14803 · Other software · Micro Focus · reported by security@opentext.comCritical 9.8
In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11 where an attacker can execute arbitrary code on the system.
- Product
- NetIQ Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2018b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resulting in unauthenticCVE-2017-1000423 · Other software · B2evolution · reported by MITRECritical 9.8
b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup.
- Product
- B2evolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017Readymade Job Site Script has XSS via the keyword parameter to the /job URI.CVE-2017-17896 · Other software · Basic JOB Site Script Project · reported by MITREMedium 6.1
Readymade Job Site Script has XSS via the keyword parameter to the /job URI.
- Product
- Basic JOB Site Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017Readymade Job Site Script has SQL Injection via the location_name array parameter to the /job URI.CVE-2017-17895 · Other software · Basic JOB Site Script Project · reported by MITRECritical 9.8
Readymade Job Site Script has SQL Injection via the location_name array parameter to the /job URI.
- Product
- Basic JOB Site Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017Readymade Job Site Script has CSRF via the /job URI.CVE-2017-17894 · Other software · Basic JOB Site Script Project · reported by MITREHigh 8.8
Readymade Job Site Script has CSRF via the /job URI.
- Product
- Basic JOB Site Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2017Basic Job Site Script 2.0.5 has SQL Injection via the keyword parameter to /job.CVE-2017-17642 · Other software · Basic JOB Site Script Project · reported by MITRECritical 9.8
Basic Job Site Script 2.0.5 has SQL Injection via the keyword parameter to /job.
- Product
- Basic JOB Site Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 13, 2017Basic B2B Script 2.0.8 has SQL Injection via the product_details.php id parameter.CVE-2017-17600 · Other software · Basic B2b Script Project · reported by MITRECritical 9.8
Basic B2B Script 2.0.8 has SQL Injection via the product_details.php id parameter.
- Product
- Basic B2b Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 11, 2017A Cross-site Scripting issue was discovered in PHOENIX CONTACT FL COMSERVER BASIC 232/422/485, FL COMSERVER UNI 232/422/485, FL COMSERVER BAS 232/422/485-T, FL CVE-2017-16723 · Other software · Phoenixcontact · reported by ics-cert@hq.dhs.govMedium 6.1
A Cross-site Scripting issue was discovered in PHOENIX CONTACT FL COMSERVER BASIC 232/422/485, FL COMSERVER UNI 232/422/485, FL COMSERVER BAS 232/422/485-T, FL COMSERVER UNI 232/422/485-T, FL COM SERVER RS232, FL COM SERVER RS485, and PSI-MODEM/ETH (running firmware versions prior to 1.99, 2.20, or 2.40). The cross-site scripting vulnerability has been identified, which may allow remote code execution.
- Product
- FL Comserver Basic 232 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comcert.vde.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.