Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
971 results · page 15 of 20
Jul 14, 2020An elevation of privilege vulnerability exists when the Windows System Events Broker improperly handles file operations, aka 'Windows System Events Broker ElevaCVE-2020-1357 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
An elevation of privilege vulnerability exists when the Windows System Events Broker improperly handles file operations, aka 'Windows System Events Broker Elevation of Privilege Vulnerability'.
- Product
- Windows 10 Version 2004 for 32-bit Systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 10, 2020Artica Pandora FMS 7.44 allows remote command execution via the events feature.CVE-2020-13851 · Other software · Pandorafms · reported by MITREHigh 8.8
Artica Pandora FMS 7.44 allows remote command execution via the events feature.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcoresecurity.com
Jun 2, 2020NULL exception due to accessing bad pointer while posting events on RT FIFO in Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infrastructure and NetworCVE-2020-3618 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
NULL exception due to accessing bad pointer while posting events on RT FIFO in Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ6018, IPQ8074, QCA8081, SC8180X, SXR2130
- Product
- Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
May 18, 2020app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view.CVE-2020-13153 · Other software · Misp-project · reported by MITREMedium 6.1
app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2020On High-End SRX Series devices, in specific configurations and when specific networking events or operator actions occur, an SPC receiving genuine multicast traCVE-2020-1634 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 7.5
On High-End SRX Series devices, in specific configurations and when specific networking events or operator actions occur, an SPC receiving genuine multicast traffic may core. Subsequently, all FPCs in a chassis may reset causing a Denial of Service. This issue affects both IPv4 and IPv6. This issue affects: Juniper Networks Junos OS 12.3X48 version 12.3X48-D80 and later versions prior to 12.3X48-D95 on High-End SRX Series. This issue does not affect Branch SRX Series devices.
- Product
- Junos OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.juniper.netkb.juniper.net
Apr 7, 2020Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, resulting in an XSS vCVE-2020-2173 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, resulting in an XSS vulnerability exploitable by users able to change report content.
- Product
- Jenkins Gatling Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 9, 2020JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action.CVE-2015-7340 · Other software · Gwesystems · reported by MITREHigh 7.2
JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action.
- Product
- Jevents
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.integrity.ptlabs.integrity.pt
Feb 28, 2020Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticaCVE-2020-9459 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mec_save_notifications and import_settings.
- Product
- Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite
- Affected
- up to 5.1.6
- What to do
- Affects up to 5.1.6. Update Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Dec 12, 2019In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h).CVE-2019-19769 · Computers, phones & browsers · Linux · reported by MITREMedium 6.7
In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h).
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.kernel.orglists.fedoraproject.org
Dec 11, 2019Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventSerCVE-2019-19649 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet function.
- Product
- Manageengine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.commanageengine.com
Dec 2, 2019The Anviz Management System for access control has insufficient logging for device events such as door open requests.CVE-2019-12391 · Other software · Anviz · reported by MITREHigh 7.5
The Anviz Management System for access control has insufficient logging for device events such as door open requests.
- Product
- Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2019A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of sCVE-2019-19072 · Other software · Canonical · reported by MITREMedium 4.4
A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-96c5c6e6a5b6.
- Product
- Ubuntu Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Nov 7, 2019OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server.CVE-2012-0049 · Other software · openttd · reported by Red HatMedium 4.3
OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server.
- Product
- openttd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.openttd.orgdebian.org
Oct 16, 2019The slub_events (aka SLUB: Event Registration) extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver.CVE-2019-16700 · Other software · Slub-dresden · reported by MITRECritical 9.8
The slub_events (aka SLUB: Event Registration) extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For versions 1.2.2 and below, this results in Remote Code Execution. In versions later than 1.2.2, this can result in Denial of Service, since the web space can be filled up with arbitrary files.
- Product
- Slub Events
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.typo3.orgtypo3.org
Oct 16, 2019The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided CVE-2019-16523 · WordPress plugins & themes · reported by MITREMedium 5.4
The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute map_style of shortcodes (locations_map and events_map) provided by the plugin.
- Product
- events-manager
- Affected
- up to 5.9.5
- What to do
- Affects up to 5.9.5. Update events-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordopenwall.comgithub.com
Sep 27, 2019Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts aCVE-2019-11743 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgLow 3.7
Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts access to detailed timing attributes to only be same-origin. This resulted in potential cross-origin information exposure of history through timing side-channel attacks. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Sep 6, 2019LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc.CVE-2019-9854 · Other software · Document Foundation · reported by security@documentfoundation.orgHigh 7.8
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2019-9852, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed by employing a URL encoding attack to defeat the path verification step. However this protection could be bypassed by taking advantage of a flaw in how LibreOffice assembled the final script URL location directly from components of the passed in path as opposed to solely from the sanitized output of the path verification step. This issue affects: Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Aug 22, 2019The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.CVE-2013-7480 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
- Product
- events-manager
- Fixed in
- 5.3.6.1
- What to do
- Update events-manager to 5.3.6.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.CVE-2013-7479 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
- Product
- events-manager
- Fixed in
- 5.3.9
- What to do
- Update events-manager to 5.3.9 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.CVE-2013-7478 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.
- Product
- events-manager
- Fixed in
- 5.5
- What to do
- Update events-manager to 5.5 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.CVE-2013-7477 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.
- Product
- events-manager
- Fixed in
- 5.5.2
- What to do
- Update events-manager to 5.5.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.CVE-2012-6716 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.
- Product
- events-manager
- Fixed in
- 5.1.7
- What to do
- Update events-manager to 5.1.7 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.CVE-2019-15109 · WordPress plugins & themes · reported by MITREMedium 6.1
The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.
- Product
- the-events-calendar
- Fixed in
- 4.8.2
- What to do
- Update the-events-calendar to 4.8.2 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 15, 2019xtrlock through 2.10 does not block multitouch events.CVE-2016-10894 · Other software · Xtrlock Project · reported by MITREMedium 4.6
xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks (by depressing the touchpad once and then clicking with a different finger).
- Product
- Xtrlock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orglists.debian.org
Aug 15, 2019LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc.CVE-2019-9852 · Other software · Document Foundation · reported by security@documentfoundation.orgHigh 7.8
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Aug 13, 2019The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.CVE-2015-9300 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.
- Product
- events-manager
- Fixed in
- 5.5.7
- What to do
- Update events-manager to 5.5.7 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 13, 2019The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.CVE-2015-9299 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.
- Product
- events-manager
- Fixed in
- 5.5.7.1
- What to do
- Update events-manager to 5.5.7.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 13, 2019The events-manager plugin before 5.6 for WordPress has code injection.CVE-2015-9298 · WordPress plugins & themes · reported by MITRECritical 9.8
The events-manager plugin before 5.6 for WordPress has code injection.
- Product
- events-manager
- Fixed in
- 5.6
- What to do
- Update events-manager to 5.6 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 13, 2019The events-manager plugin before 5.6 for WordPress has XSS.CVE-2015-9297 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.6 for WordPress has XSS.
- Product
- events-manager
- Fixed in
- 5.6
- What to do
- Update events-manager to 5.6 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Jul 30, 2019A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events.CVE-2019-5449 · Other software · Nextcloud · reported by support@hackerone.comMedium 4.3
A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events.
- Product
- Nextcloud Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Jul 29, 2019Tridactyl before 1.16.0 allows fake key events.CVE-2019-1020004 · Other software · Tridactyl · reported by josh@bress.netHigh 7.5
Tridactyl before 1.16.0 allows fake key events.
- Product
- Tridactyl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2019Elcom CMS before 10.7 has SQL Injection via EventSearchByState.aspx and EventSearchAdv.aspx.CVE-2019-12946 · Other software · Elcom · reported by MITREHigh 7.5
Elcom CMS before 10.7 has SQL Injection via EventSearchByState.aspx and EventSearchAdv.aspx.
- Product
- Elcom CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.contentsecurity.com.aublog.contentsecurity.com.au
Jul 17, 2019LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc.CVE-2019-9848 · Other software · Document Foundation · reported by security@documentfoundation.orgCritical 9.8
LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python commands silently without warning. In the fixed versions, LibreLogo cannot be called from a document event handler. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jul 3, 2019In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user.CVE-2019-12847 · Other software · Jetbrains · reported by MITREHigh 7.2
In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. It is only relevant in cases where a password has not changed since 2017, and if the audit log still contains events from before that period.
- Product
- HUB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
May 24, 2019Use-after-free condition due to Improper handling of hrtimers when the PMU driver tries to access its events in Snapdragon Auto, Snapdragon Consumer IOT, SnapdrCVE-2018-13920 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Use-after-free condition due to Improper handling of hrtimers when the PMU driver tries to access its events in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MSM8909W, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 712 / SD 710 / SD 670, SD 820A, SD 845 / SD 850, SD 855, SDM439, SDM630, SDM660, SDX24
- Product
- Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeaurora.orgcodeaurora.org
May 24, 2019Improper authentication can happen on Remote command handling due to inappropriate handling of events in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectCVE-2018-11271 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Improper authentication can happen on Remote command handling due to inappropriate handling of events in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SM7150, Snapdragon_High_Med_2016, SXR1130
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
May 15, 2019The upnp_event_prepare function in upnpevents.c in MiniUPnP MiniUPnPd through 2.1 allows a remote attacker to leak information from the heap due to improper valCVE-2019-12107 · Other software · Miniupnp.free · reported by MITREHigh 7.5
The upnp_event_prepare function in upnpevents.c in MiniUPnP MiniUPnPd through 2.1 allows a remote attacker to leak information from the heap due to improper validation of an snprintf return value.
- Product
- Miniupnpd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
May 8, 2019An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107.CVE-2019-11813 · Other software · Misp-project · reported by MITREMedium 6.1
An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107. There is persistent XSS via link type attributes with javascript:// links.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2019The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-maCVE-2018-13137 · WordPress plugins & themes · reported by MITREMedium 4.8
The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI.
- Affected
- 5.9.4 to 5.9.4
- What to do
- Affects 5.9.4 to 5.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordansawaf.blogspot.comgist.github.com
Mar 10, 2019An XSS issue was discovered in upcoming_events.php in the Upcoming Events plugin before 1.33 for MyBB via a crafted name for an event.CVE-2019-9650 · Other software · Upcoming Events Project · reported by MITREMedium 6.1
An XSS issue was discovered in upcoming_events.php in the Upcoming Events plugin before 1.33 for MyBB via a crafted name for an event.
- Product
- Upcoming Events
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcommunity.mybb.com
Feb 28, 2019A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events.CVE-2018-12396 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Feb 28, 2019When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor eveCVE-2018-12392 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Feb 19, 2019Insufficient restrictions on what can be done with Apple Events in Google Chrome on macOS prior to 72.0.3626.81 allowed a local attacker to execute JavaScript vCVE-2019-5780 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 7.8
Insufficient restrictions on what can be done with Apple Events in Google Chrome on macOS prior to 72.0.3626.81 allowed a local attacker to execute JavaScript via Apple Events.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Feb 17, 2019ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.CVE-2019-8423 · Other software · Zoneminder · reported by MITRECritical 9.8
ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2019While processing radio connection status change events, Radio index is not properly validated in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer ICVE-2018-11899 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
While processing radio connection status change events, Radio index is not properly validated in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile and Snapdragon Voice & Music in versions MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24.
- Product
- Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Feb 4, 2019Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value, withouCVE-2019-7337 · Other software · Zoneminder · reported by MITREMedium 4.8
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value, without applying any proper output filtration. This issue exists because of the function sortHeader() in functions.php, which insecurely returns the value of the limit query string parameter without applying any filtration.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2019A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain paramCVE-2019-3819 · Other software · The Linux Foundation · reported by Red HatMedium 4.4
A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ("root") can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable.
- Product
- kernel:
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgsecurityfocus.com
Jan 9, 2019A missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to download arbitrary files with no userCVE-2018-16088 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
A missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to download arbitrary files with no user input via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comchromereleases.googleblog.com
Dec 11, 2018The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE <tableCVE-2018-2497 · Network & remote access · SAP · reported by cna@sap.comLow 2.7
The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE <table_name> AS SELECT.
- Product
- SAP HANA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comlaunchpad.support.sap.com
Dec 4, 2018Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a cCVE-2018-6095 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.