Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list
36added in the last 30 days
587new WordPress flaws this week
391,288entries in the database

805 results · page 13 of 17

  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2.CVE-2017-18921 · Other software · Mattermost · reported by MITREMedium 6.1

    An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.6.2.CVE-2017-18920 · Other software · Mattermost · reported by MITRECritical 9.8

    An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3.CVE-2017-18919 · Other software · Mattermost · reported by MITREMedium 5.3

    An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5.CVE-2017-18918 · Other software · Mattermost · reported by MITREMedium 4.9

    An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18917 · Other software · Mattermost · reported by MITREHigh 7.5

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18916 · Other software · Mattermost · reported by MITREMedium 5.3

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18915 · Other software · Mattermost · reported by MITRECritical 9.8

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18914 · Other software · Mattermost · reported by MITREMedium 5.3

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18913 · Other software · Mattermost · reported by MITREMedium 6.1

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2.CVE-2017-18908 · Other software · Mattermost · reported by MITRECritical 9.8

    An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2.CVE-2017-18907 · Other software · Mattermost · reported by MITREMedium 6.1

    An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used.CVE-2017-18906 · Other software · Mattermost · reported by MITREHigh 8.1

    An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.CVE-2017-18905 · Other software · Mattermost · reported by MITREMedium 5.3

    An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 2.1.0.CVE-2016-11084 · Other software · Mattermost · reported by MITREMedium 6.1

    An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 2.2.0.CVE-2016-11083 · Other software · Mattermost · reported by MITREMedium 6.1

    An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 2.2.0.CVE-2016-11082 · Other software · Mattermost · reported by MITREMedium 6.1

    An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 2.2.0.CVE-2016-11081 · Other software · Mattermost · reported by MITREMedium 4.3

    An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11080 · Other software · Mattermost · reported by MITREMedium 4.3

    An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11079 · Other software · Mattermost · reported by MITREMedium 6.1

    An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11078 · Other software · Mattermost · reported by MITREMedium 6.5

    An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11077 · Other software · Mattermost · reported by MITRELow 2.7

    An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11076 · Other software · Mattermost · reported by MITREMedium 5.3

    An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11075 · Other software · Mattermost · reported by MITREMedium 5.3

    An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11074 · Other software · Mattermost · reported by MITRECritical 9.8

    An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11073 · Other software · Mattermost · reported by MITREMedium 6.1

    An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.2.CVE-2016-11072 · Other software · Mattermost · reported by MITREMedium 6.5

    An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.1.0.CVE-2016-11071 · Other software · Mattermost · reported by MITREMedium 6.1

    An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.1.0.CVE-2016-11070 · Other software · Mattermost · reported by MITREMedium 5.4

    An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.2.0.CVE-2016-11069 · Other software · Mattermost · reported by MITREHigh 7.5

    An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.2.0.CVE-2016-11068 · Other software · Mattermost · reported by MITREMedium 5.3

    An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.2.0.CVE-2016-11067 · Other software · Mattermost · reported by MITREMedium 5.3

    An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.2.0.CVE-2016-11066 · Other software · Mattermost · reported by MITREHigh 7.5

    An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.3.0.CVE-2016-11065 · Other software · Mattermost · reported by MITREMedium 4.3

    An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Desktop App before 3.4.0.CVE-2016-11064 · Other software · Mattermost · reported by MITRECritical 9.8

    An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.

    Product
    Mattermost Desktop
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.5.1.CVE-2016-11063 · Other software · Mattermost · reported by MITREMedium 6.1

    An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.5.1.CVE-2016-11062 · Other software · Mattermost · reported by MITREMedium 5.3

    An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 1.2.0.CVE-2015-9548 · Other software · Mattermost · reported by MITREHigh 7.5

    An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file that has a large size when uncompressed.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18912 · Other software · Mattermost · reported by MITRECritical 9.8

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. It allows an attacker to specify a full pathname of a log file.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18911 · Other software · Mattermost · reported by MITRECritical 9.1

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18910 · Other software · Mattermost · reported by MITREMedium 4.3

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. E-mail notifications can have spoofed links.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 3.9.0 when SAML is used.CVE-2017-18909 · Other software · Mattermost · reported by MITREHigh 7.5

    An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2.CVE-2017-18904 · Other software · Mattermost · reported by MITREMedium 6.1

    An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2.CVE-2017-18903 · Other software · Mattermost · reported by MITREHigh 8.8

    An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS is enabled.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3.CVE-2017-18902 · Other software · Mattermost · reported by MITREMedium 5.3

    An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover team invite IDs via team API endpoints.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3.CVE-2017-18901 · Other software · Mattermost · reported by MITREMedium 5.3

    An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover a team invite ID by requesting a JSON document.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3.CVE-2017-18900 · Other software · Mattermost · reported by MITRECritical 9.8

    An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5.CVE-2017-18899 · Other software · Mattermost · reported by MITREMedium 5.3

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based rate limiting.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5.CVE-2017-18898 · Other software · Mattermost · reported by MITREMedium 5.3

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts that potentially cause a web browser to hang.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider.CVE-2017-18897 · Other software · Mattermost · reported by MITREMedium 6.1

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5.CVE-2017-18896 · Other software · Mattermost · reported by MITREMedium 5.3

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to add DEBUG lines to the logs via a REST API version 3 logging endpoint.

    Product
    Mattermost Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.