Updated 24 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

1,569 results · page 15 of 32

Jun 6, 2018cross-env.js was a malicious module published with the intent to hijack environment variables.CVE-2017-16081 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
cross-env.js node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018nodesass was a malicious module published with the intent to hijack environment variables.CVE-2017-16080 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
nodesass node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018smb was a malicious module published with the intent to hijack environment variables.CVE-2017-16079 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
smb node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018shadowsock was a malicious module published with the intent to hijack environment variables.CVE-2017-16078 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
shadowsock node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018mongose was a malicious module published with the intent to hijack environment variables.CVE-2017-16077 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
mongose node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018proxy.js was a malicious module published with the intent to hijack environment variables.CVE-2017-16076 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
proxy.js node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018http-proxy.js was a malicious module published with the intent to hijack environment variables.CVE-2017-16075 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
http-proxy.js node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018crossenv was a malicious module published with the intent to hijack environment variables.CVE-2017-16074 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
crossenv node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018noderequest was a malicious module published with the intent to hijack environment variables.CVE-2017-16073 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
noderequest node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018nodemailer.js was a malicious module published with the intent to hijack environment variables.CVE-2017-16072 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
nodemailer.js node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018nodemailer-js was a malicious module published with the intent to hijack environment variables.CVE-2017-16071 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
nodemailer-js node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018nodecaffe was a malicious module published with the intent to hijack environment variables.CVE-2017-16070 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
nodecaffe node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018nodeffmpeg was a malicious module published with the intent to hijack environment variables.CVE-2017-16069 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
nodeffmpeg node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018ffmepg was a malicious module published with the intent to hijack environment variables.CVE-2017-16068 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
ffmepg node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018node-opencv was a malicious module published with the intent to hijack environment variables.CVE-2017-16067 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
node-opencv node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018opencv.js was a malicious module published with the intent to hijack environment variables.CVE-2017-16066 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
opencv.js node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018openssl.js was a malicious module published with the intent to hijack environment variables.CVE-2017-16065 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
openssl.js node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018node-openssl was a malicious module published with the intent to hijack environment variables.CVE-2017-16064 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
node-openssl node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018node-opensl was a malicious module published with the intent to hijack environment variables.CVE-2017-16063 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
node-opensl node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018babelcli was a malicious module published with the intent to hijack environment variables.CVE-2017-16060 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
babelcli node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018mssql-node was a malicious module published with the intent to hijack environment variables.CVE-2017-16059 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
mssql-node node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018gruntcli was a malicious module published with the intent to hijack environment variables.CVE-2017-16058 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
gruntcli node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018nodemssql was a malicious module published with the intent to hijack environment variables.CVE-2017-16057 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
nodemssql node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 6, 2018mssql.js was a malicious module published with the intent to hijack environment variables.CVE-2017-16056 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
mssql.js node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 5, 2018An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02_passport.js.CVE-2018-10966 · Other software · Gamerpolls · reported by MITREHigh 7.3
An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02_passport.js. An attacker can edit the Passport.js contents of the session cookie to contain the ID number of the account they wish to take over, and re-sign it using the hard coded secret.
Product
Gamerpolls
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 4, 2018`sqlserver` was a malicious module published with the intent to hijack environment variables.CVE-2017-16055 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
sqlserver node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 4, 2018`nodefabric` was a malicious module published with the intent to hijack environment variables.CVE-2017-16054 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
nodefabric node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 4, 2018`fabric-js` was a malicious module published with the intent to hijack environment variables.CVE-2017-16053 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
fabric-js node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 4, 2018`node-fabric` was a malicious module published with the intent to hijack environment variables.CVE-2017-16052 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
node-fabric node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 4, 2018`sqliter` was a malicious module published with the intent to hijack environment variables.CVE-2017-16051 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
sqliter node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 4, 2018`sqlite.js` was a malicious module published with the intent to hijack environment variables.CVE-2017-16050 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
sqlite.js node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 4, 2018`nodesqlite` was a malicious module published with the intent to hijack environment variables.CVE-2017-16049 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
nodesqlite node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 4, 2018`node-sqlite` was a malicious module published with the intent to hijack environment variables.CVE-2017-16048 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
node-sqlite node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 4, 2018`mariadb` was a malicious module published with the intent to hijack environment variables.CVE-2017-16046 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
mariadb node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 4, 2018`jquery.js` was a malicious module published with the intent to hijack environment variables.CVE-2017-16045 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
jquery.js node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 4, 2018`d3.js` was a malicious module published with the intent to hijack environment variables.CVE-2017-16044 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
d3.js node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
May 31, 2018The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP.CVE-2016-10530 · Other software · HackerOne · reported by support@hackerone.comMedium 5.9
The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all the secret keys the user is sending. This goes against common best practice, which is to use HTTPS.
Product
airbrake node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com nodesecurity.io
May 29, 2018node-tkinter was a malicious module published with the intent to hijack environment variables.CVE-2017-16062 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
node-tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
node-tkinter node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
May 29, 2018tkinter was a malicious module published with the intent to hijack environment variables.CVE-2017-16061 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
tkinter node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
May 29, 2018mysqljs was a malicious module published with the intent to hijack environment variables.CVE-2017-16047 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Product
mysqljs node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
May 29, 2018IBM Security Guardium Big Data Intelligence (SonarG) 3.1 generates an error message that includes sensitive information about its environment, users, or associaCVE-2017-1768 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 136471.
Product
Security Guardium Big Data Intelligence
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com securityfocus.com
May 11, 2018lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows reCVE-2018-10992 · Other software · Lilypond · reported by MITRECritical 9.8
lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument, because the GNU Guile code uses the system Scheme procedure instead of the system* Scheme procedure. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-17523.
Product
Lilypond
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org bugs.debian.org
May 10, 2018In Android before the 2018-05-05 security patch level, NVIDIA Trusted Execution Environment (TEE) contains a memory corruption (due to unusual root cause) vulneCVE-2017-6289 · Other software · Nvidia Corporation · reported by psirt@nvidia.comHigh 7.8
In Android before the 2018-05-05 security patch level, NVIDIA Trusted Execution Environment (TEE) contains a memory corruption (due to unusual root cause) vulnerability, which if run within the speculative execution of the TEE, may lead to local escalation of privileges. This issue is rated as critical. Android: A-72830049. Reference: N-CVE-2017-6289.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
May 10, 2018The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variaCVE-2017-18266 · Other software · Freedesktop · reported by MITREHigh 8.8
The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.
Product
Xdg-utils
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.freedesktop.org cgit.freedesktop.org
May 8, 2018Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities.CVE-2018-1239 · Other software · Dell EMC · reported by security_alert@emc.comHigh 7.2
Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. A remote application admin user could potentially exploit the vulnerabilities to execute arbitrary OS commands as system root on the system where Dell EMC Unity is installed.
Product
Unity Operating Environment (OE)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org securityfocus.com
May 4, 2018Vulnerabilities within the Philips Brilliance CT kiosk environment (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCCVE-2018-8861 · Other software · Philips · reported by ics-cert@hq.dhs.govHigh 8.7
Vulnerabilities within the Philips Brilliance CT kiosk environment (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4 and prior, and Brilliance CT Big Bore 2.3.5 and prior) could enable a limited-access kiosk user or an unauthorized attacker to break-out from the containment of the kiosk environment, attain elevated privileges from the underlying Windows OS, and access unauthorized resources from the operating system.
Product
Brilliance CT Scanners
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
May 2, 2018IBM API Connect 5.0.8.1 and 5.0.8.2 could allow a user to get access to internal environment and sensitive API details to which they are not authorized.CVE-2018-1468 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM API Connect 5.0.8.1 and 5.0.8.2 could allow a user to get access to internal environment and sensitive API details to which they are not authorized. IBM X-Force ID: 140399.
Product
API Connect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com exchange.xforce.ibmcloud.com
May 1, 2018In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments thaCVE-2018-10581 · Other software · Octopus · reported by MITREMedium 5.4
In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments that do not exist within their associated Team scoping. This occurs in situations where this authenticated user also belongs to multiple teams, where one of the Teams has the VariableEdit permission or VariableView permissions for the Environment.
Product
Octopus Deploy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 13, 2018Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevaCVE-2017-0358 · Other software · ntfs-3g · reported by security@debian.orgHigh 7.8
Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.
Product
ntfs-3g
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 22, 2018IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) contains several environment variables that a local attacker could overflow and cause CVE-2018-1427 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.2
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) contains several environment variables that a local attacker could overflow and cause a denial of service. IBM X-Force ID: 139072.
Product
DB2 for Linux, UNIX and Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.