Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,547 results · page 159 of 391
Nov 1, 2021Modern Events Calendar Lite: Does not properly sanitize or escape values set by users with access to adjust settings withing wp-adminCVE-2021-24716 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.22.3
- What to do
- Update Modern Events Calendar Lite to 5.22.3 or newer.
Nov 1, 2021WP Sitemap Page: Does not properly sanitise and escape some of its settingsCVE-2021-24715 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WP Sitemap Page
- Fixed in
- 1.7.0
- What to do
- Update WP Sitemap Page to 1.7.0 or newer.
Nov 1, 2021Flat Preloader: Does not enforce nonce checksCVE-2021-24685 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload (triggered either in the frontend or backend depending on the payload)
- Product
- Flat Preloader
- Fixed in
- 1.5.4
- What to do
- Update Flat Preloader to 1.5.4 or newer.
Nov 1, 2021Cool Tag Cloud: Does not escape the style attribute of the cool_tag_cloud shortcodeCVE-2021-24682 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cool Tag Cloud WordPress plugin before 2.26 does not escape the style attribute of the cool_tag_cloud shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.
- Product
- Cool Tag Cloud
- Fixed in
- 2.26
- What to do
- Update Cool Tag Cloud to 2.26 or newer.
Nov 1, 2021MP3 Audio Player for Music, Radio & Podcast by Sonaar: Does not properly sanitize or escape data in some of its Playlist settingsCVE-2021-24624 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks
- Product
- MP3 Audio Player for Music, Radio & Podcast by Sonaar
- Fixed in
- 2.4.2
- What to do
- Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to 2.4.2 or newer.
Nov 1, 2021Coming Soon, Under Construction & Maintenance Mode By Dazzler: Does not sanitise or escape its description settingCVE-2021-24539 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coming Soon, Under Construction & Maintenance Mode By Dazzler WordPress plugin before 1.6.7 does not sanitise or escape its description setting when outputting it in the frontend when the Coming Soon mode is enabled, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- Coming Soon, Under Construction & Maintenance Mode By Dazzler
- Fixed in
- 1.6.7
- What to do
- Update Coming Soon, Under Construction & Maintenance Mode By Dazzler to 1.6.7 or newer.
Nov 1, 2021WP-Pro-Quiz: Does not have CSRF check in placeCVE-2020-36504 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow an attacker to make a logged in admin delete arbitrary quiz on the blog
- Product
- WP-Pro-Quiz
- Affected
- up to 0.37
- What to do
- Affects up to 0.37. Update WP-Pro-Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2021Connections Business Directory: Does not validate or sanitise some connections' fieldsCVE-2020-36503 · WordPress plugins & themes · reported by WPScanHigh 8
The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields, which could lead to a CSV injection issue
- Product
- Connections Business Directory
- Fixed in
- 9.7
- What to do
- Update Connections Business Directory to 9.7 or newer.
Nov 1, 2021LearnDash LMS: Does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_init() functionCVE-2018-25019 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_init() function, which could allow unauthenticated users to upload arbitrary files to the web server
- Product
- LearnDash LMS
- Fixed in
- 2.5.4
- What to do
- Update LearnDash LMS to 2.5.4 or newer.
Full record and what to do →NVD recordlists.openwall.netwpscan.com
Nov 1, 2021WP Attachment Export: Does not have proper access controlsCVE-2015-20067 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress
- Product
- WP Attachment Export
- Fixed in
- 0.2.4
- What to do
- Update WP Attachment Export to 0.2.4 or newer.
Full record and what to do →NVD recordgithub.comseclists.org
Nov 1, 2021Content text slider on post: Does not sanitise and escape the Title and Message/Content settingsCVE-2015-20019 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content settings, which could lead to Cross-Site Scripting issues
- Product
- Content text slider on post
- Fixed in
- 6.9
- What to do
- Update Content text slider on post to 6.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgseclists.org
Nov 1, 2021WP-Stats: Does not have CSRF checkCVE-2015-10001 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads
- Product
- WP-Stats
- Fixed in
- 2.52
- What to do
- Update WP-Stats to 2.52 or newer.
Full record and what to do →NVD recordwpscan.comopenwall.com
Oct 29, 2021On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller exits, so it does not CVE-2021-22038 · Other software · VMware · reported by security@vmware.comHigh 8.8
On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller exits, so it does not block the installation directory). This temporary location is not randomized and does not restrict access to Administrators only so a potential attacker could plant a binary to replace the copied binary right before it gets called, thus gaining Administrator privileges (if the original uninstaller was executed as Administrator). The vulnerability only affects Windows installers.
- Product
- Installbuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.installbuilder.comblog.installbuilder.com
Oct 26, 2021The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file.CVE-2021-26610 · Other software · NHN COMMERCE · reported by vuln@krcert.or.krHigh 7.2
The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary code.
- Product
- godomall5 Std, godomall5 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2021caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.CVE-2011-4119 · Other software · Inria · reported by Red HatCritical 9.8
caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.
- Product
- Caml-light
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgnats.netbsd.orgseclists.org
Oct 25, 2021Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render imaCVE-2021-39220 · Other software · nextcloud · reported by GitHubLow 3.5
Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol. It is recommended that the Nextcloud Mail application is upgraded to 1.10.4 or 1.11.0. There are no known workarounds aside from upgrading.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2021In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.CVE-2021-41035 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgCritical 9.8
In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.
- Product
- Eclipse OMR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.eclipse.orggithub.com
Oct 25, 2021YOP Poll: Does not escape the perpage parameter before outputting it back in an attributeCVE-2021-24885 · WordPress plugins & themes · reported by WPScanMedium 6.1
The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
- Product
- YOP Poll
- Fixed in
- 6.1.2
- What to do
- Update YOP Poll to 6.1.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Oct 25, 2021Great Quotes: Does not sanitise and escape the Quote and Author fields of its QuotesCVE-2021-24785 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Great Quotes WordPress plugin through 1.0.0 does not sanitise and escape the Quote and Author fields of its Quotes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- Great Quotes
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Great Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2021Check & Log Email: Does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statementCVE-2021-24774 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues
- Product
- Check & Log Email
- Fixed in
- 1.0.3
- What to do
- Update Check & Log Email to 1.0.3 or newer.
Oct 25, 2021Permalink Manager Lite: Does not validate and escape the orderby parameter before using it in a SQL statement in the Permalink Manager pageCVE-2021-24769 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Permalink Manager Lite WordPress plugin before 2.2.13.1 does not validate and escape the orderby parameter before using it in a SQL statement in the Permalink Manager page, leading to a SQL Injection
- Product
- Permalink Manager Lite
- Fixed in
- 2.2.13.1
- What to do
- Update Permalink Manager Lite to 2.2.13.1 or newer.
Oct 25, 2021WordPress Contact Forms by Cimatti: Does not sanitise and escape the Form Title before outputting it in some admin pagesCVE-2021-24744 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Contact Forms by Cimatti WordPress plugin before 1.4.12 does not sanitise and escape the Form Title before outputting it in some admin pages. which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- WordPress Contact Forms by Cimatti
- Fixed in
- 1.4.12
- What to do
- Update WordPress Contact Forms by Cimatti to 1.4.12 or newer.
Oct 25, 2021Easy Media Download: Does not escape the text argument of its shortcodeCVE-2021-24699 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Media Download WordPress plugin before 1.1.7 does not escape the text argument of its shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.
- Product
- Easy Media Download
- Fixed in
- 1.1.7
- What to do
- Update Easy Media Download to 1.1.7 or newer.
Oct 25, 2021Game Server Status: Does not validate or escape the server_id parameter before using it in SQL statementCVE-2021-24662 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Game Server Status WordPress plugin through 1.0 does not validate or escape the server_id parameter before using it in SQL statement, leading to an Authenticated SQL Injection in an admin page
- Product
- Game Server Status
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Game Server Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2021Cookie Bar: Doesn't properly sanitise the Cookie Bar Message settingCVE-2021-24653 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Cookie Bar WordPress plugin before 1.8.9 doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Cookie Bar
- Fixed in
- 1.8.9
- What to do
- Update Cookie Bar to 1.8.9 or newer.
Oct 25, 2021Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for: Does not sanitise and escape its Form's LabelsCVE-2021-24608 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for
- Fixed in
- 5.0.07
- What to do
- Update Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for to 5.0.07 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Oct 25, 2021Responsive WordPress Slider: Does not sanitise and escape some of the Slider optionsCVE-2021-24544 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive WordPress Slider WordPress plugin through 2.2.0 does not sanitise and escape some of the Slider options, allowing Cross-Site Scripting payloads to be set in them. Furthermore, as by default any authenticated user is allowed to create Sliders (https://wordpress.org/support/topic/slider-can-be-changed-from-any-user-even-subscriber/, such settings can be changed in the plugin's settings), this would allow user with a role as low as subscriber to perform Cross-Site Scripting attacks against logged in admins viewing the slider list and could lead to privilege escalation by creating a rogue admin account for example.
- Product
- Responsive WordPress Slider
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Responsive WordPress Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2021jQuery Reply to Comment: Does not have any CSRF checkCVE-2021-24543 · WordPress plugins & themes · reported by WPScanMedium 6.1
The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue.
- Product
- jQuery Reply to Comment
- Affected
- up to 1.31
- What to do
- Affects up to 1.31. Update jQuery Reply to Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2021Video Gallery: Does not escape the Title and Description of the videos in a gallery before outputting them in attributesCVE-2021-24515 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Gallery WordPress plugin before 1.1.5 does not escape the Title and Description of the videos in a gallery before outputting them in attributes, leading to Stored Cross-Site Scripting issues
- Product
- Video Gallery
- Fixed in
- 1.1.5
- What to do
- Update Video Gallery to 1.1.5 or newer.
Oct 25, 2021Visual Form Builder: Does not sanitise or escape its Form NameCVE-2021-24514 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
- Product
- Visual Form Builder
- Fixed in
- 3.0.4
- What to do
- Update Visual Form Builder to 3.0.4 or newer.
Oct 25, 2021Request a Quote: Does not sanitiseCVE-2021-24489 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
- Product
- Request a Quote
- Fixed in
- 2.3.9
- What to do
- Update Request a Quote to 2.3.9 or newer.
Oct 25, 2021St-Daily-Tip: Does not have any CSRF check in placeCVE-2021-24487 · WordPress plugins & themes · reported by WPScanHigh 8.8
The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a malicious payload in it, leading to a Stored Cross-Site Scripting issue
- Product
- St-Daily-Tip
- Affected
- up to 4.7
- What to do
- Affects up to 4.7. Update St-Daily-Tip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2021Special Text Boxes: Does not sanitise or escape some of its settingsCVE-2021-24485 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Special Text Boxes WordPress plugin before 5.9.110 does not sanitise or escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- Special Text Boxes
- Fixed in
- 5.9.110
- What to do
- Update Special Text Boxes to 5.9.110 or newer.
Oct 25, 2021Video Player for YouTube: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24414 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
- Product
- Video Player for YouTube
- Fixed in
- 1.4
- What to do
- Update Video Player for YouTube to 1.4 or newer.
Oct 25, 2021Ninja Forms Contact Form: Does not sanitise and escape the custom class name of the form field createdCVE-2021-24381 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.5.8.2
- What to do
- Update Ninja Forms Contact Form to 3.5.8.2 or newer.
Oct 22, 2021The affected product’s web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the inpCVE-2021-42534 · Other software · Trane · reported by ics-cert@hq.dhs.govMedium 6.3
The affected product’s web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the input forms.
- Product
- Tracer SC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 22, 2021The affected product’s code base doesn’t properly control arguments for specific functions, which could lead to a stack overflow.CVE-2021-38473 · Other software · AUVESY · reported by ics-cert@hq.dhs.govHigh 8
The affected product’s code base doesn’t properly control arguments for specific functions, which could lead to a stack overflow.
- Product
- Versiondog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 22, 2021The affected product does not properly control the allocation of resources.CVE-2021-38463 · Other software · AUVESY · reported by ics-cert@hq.dhs.govHigh 7.3
The affected product does not properly control the allocation of resources. A user may be able to allocate unlimited memory buffers using API functions.
- Product
- Versiondog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 22, 2021The affected product’s OS Service does not verify any given parameter.CVE-2021-38455 · Other software · AUVESY · reported by ics-cert@hq.dhs.govHigh 7.3
The affected product’s OS Service does not verify any given parameter. A user can supply any type of parameter that will be passed to inner calls without checking the type of the parameter or the value.
- Product
- Versiondog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 21, 2021IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization tokens or session cookiesCVE-2021-29883 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 207090.
- Product
- Transformation Extender Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 21, 2021The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechCVE-2020-27304 · Other software · civetweb_project · reported by vuln@vdoo.comCritical 9.8
The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal
- Product
- civetweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Oct 20, 2021Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password.CVE-2021-25970 · Other software · camaleon_cms · reported by vulnerabilitylab@mend.ioHigh 8.8
Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed.
- Product
- camaleon_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Oct 19, 2021The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.CVE-2021-37137 · Other software · The Netty project · reported by reefs@jfrog.comHigh 7.5
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
- Product
- Netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Oct 19, 2021The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during CVE-2021-37136 · Other software · The Netty project · reported by reefs@jfrog.comHigh 7.5
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
- Product
- Netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Oct 19, 2021InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an attacker may take advCVE-2021-38472 · Other software · InHand Networks · reported by ics-cert@hq.dhs.govMedium 4.7
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an attacker may take advantage of by sending a link to an administrator that frames the router’s management portal and could lure the administrator to perform changes.
- Product
- IR615 Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 19, 2021InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 does not enforce an efficient password policy.CVE-2021-38462 · Other software · InHand Networks · reported by ics-cert@hq.dhs.govCritical 9.8
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 does not enforce an efficient password policy. This may allow an attacker with obtained user credentials to enumerate passwords and impersonate other application users and perform operations on their behalf.
- Product
- IR615 Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 18, 2021The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYCVE-2021-42576 · Other software · Microco · reported by MITRECritical 9.8
The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
- Product
- Bluemonday
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comdocs.google.com
Oct 18, 2021The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.CVE-2021-42575 · Other software · Owasp · reported by MITRECritical 9.8
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
- Product
- Java Html Sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comoracle.com
Oct 18, 2021Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page.CVE-2021-32609 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html (including scripts) into the page.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Oct 18, 2021Gutenberg PDF Viewer Block: Does not sanitise and escape its blockCVE-2021-24760 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gutenberg PDF Viewer Block WordPress plugin before 1.0.1 does not sanitise and escape its block, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
- Product
- Gutenberg PDF Viewer Block
- Fixed in
- 1.0.1
- What to do
- Update Gutenberg PDF Viewer Block to 1.0.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.