Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,059 results · page 16 of 22

Dec 26, 2019In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end andCVE-2019-16789 · Other software · Pylons · reported by GitHubHigh 7.1
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.
Product
Waitress
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com docs.pylonsproject.org
Nov 8, 2019A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests.CVE-2019-10222 · Other software · The Ceph Project · reported by Red HatHigh 7.5
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients.
Product
ceph
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com lists.debian.org
Nov 5, 2019TYPO3 before 4.4.1 allows XSS in the frontend search box.CVE-2010-3674 · Other software · Typo3 · reported by MITREMedium 6.1
TYPO3 before 4.4.1 allows XSS in the frontend search box.
Product
Typo3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org security-tracker.debian.org
Nov 4, 2019TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login box.CVE-2010-3669 · Other software · Typo3 · reported by MITREMedium 5.4
TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login box.
Product
Typo3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org security-tracker.debian.org
Oct 17, 2019TOPMeeting before version 8.8 (2019/08/19) shows attendees account and password in front end page that allows an attacker to obtain sensitive information by broCVE-2019-13410 · Other software · TOPOO Technology · reported by twcert@cert.org.twHigh 7.5
TOPMeeting before version 8.8 (2019/08/19) shows attendees account and password in front end page that allows an attacker to obtain sensitive information by browsing the source code of the page.
Product
TOPMeeting
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tvn.twcert.org.tw twcert.org.tw
Oct 10, 2019The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1CVE-2015-9479 · WordPress plugins & themes · reported by MITRECritical 9.8
The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php.
Product
ACF-Frontend-Display
Affected
up to 2015-07-03
What to do
Affects up to 2015-07-03. Update ACF-Frontend-Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 5, 2019An exploitable SQL injection vulnerability exists in the unauthenticated portion of eFront LMS, versions v5.2.12 and earlier.CVE-2019-5070 · Other software · Epignosishq · reported by talos-cna@cisco.comMedium 6.5
An exploitable SQL injection vulnerability exists in the unauthenticated portion of eFront LMS, versions v5.2.12 and earlier. Specially crafted web request to login page can cause SQL injections, resulting in data compromise. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.
Product
Efront LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Sep 5, 2019A code execution vulnerability exists in Epignosis eFront LMS v5.2.12.CVE-2019-5069 · Other software · Epignosishq · reported by talos-cna@cisco.comHigh 8.8
A code execution vulnerability exists in Epignosis eFront LMS v5.2.12. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability.
Product
Efront LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Aug 29, 2019Citrix StoreFront Server XML External Entity (XXE) Processing VulnerabilityCVE-2019-13608 · Network & remote access · Citrix · reported by MITREExploitedRansomwareHigh 7.5
Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
Product
StoreFront Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Aug 28, 2019In GNU Chess 6.2.5, there is a stack-based buffer overflow in the cmd_load function in frontend/cmd.cc via a crafted chess position in an EPD file.CVE-2019-15767 · Other software · GNU · reported by MITREHigh 7.8
In GNU Chess 6.2.5, there is a stack-based buffer overflow in the cmd_load function in frontend/cmd.cc via a crafted chess position in an EPD file.
Product
Chess
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Aug 21, 2019The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.CVE-2019-15111 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.
Product
wp-front-end-profile
Fixed in
0.2.2
What to do
Update wp-front-end-profile to 0.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.CVE-2019-15110 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.
Product
wp-front-end-profile
Fixed in
0.2.2
What to do
Update wp-front-end-profile to 0.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.CVE-2017-18540 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.
Product
weblibrarian
Fixed in
3.4.8.7
What to do
Update weblibrarian to 3.4.8.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.CVE-2017-18539 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.
Product
weblibrarian
Fixed in
3.4.8.6
What to do
Update weblibrarian to 3.4.8.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.CVE-2017-18538 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.
Product
weblibrarian
Fixed in
3.4.8.5
What to do
Update weblibrarian to 3.4.8.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 20, 2019Zebra Industrial Printers All Versions, Zebra printers are shipped with unrestricted end-user access to front panel options.CVE-2019-10960 · Other software · Zebra · reported by ics-cert@hq.dhs.govHigh 7.5
Zebra Industrial Printers All Versions, Zebra printers are shipped with unrestricted end-user access to front panel options. If the option to use a passcode to limit the functionality of the front panel is applied, specially crafted packets could be sent over the same network to a port on the printer and the printer will respond with an array of information that includes the front panel passcode for the printer. Once the passcode is retrieved, an attacker must have physical access to the front panel of the printer to enter the passcode to access the full functionality of the front panel.
Product
Zt610 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov us-cert.gov
Aug 16, 2019The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.CVE-2017-18545 · WordPress plugins & themes · reported by MITREHigh 7.5
The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.
Product
invite-anyone
Fixed in
1.3.16
What to do
Update invite-anyone to 1.3.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.CVE-2019-1161 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations. To exploit the vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted command that could exploit the vulnerability and delete protected files on an affected system once MpSigStub.exe ran again. The update addresses the vulnerability and blocks the arbitrary deletion.
Product
Microsoft Forefront Endpoint Protection 2010
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Aug 9, 2019In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/specials/MobileSpecialPageFeed.php.CVE-2019-14807 · Other software · Mediawiki · reported by MITREMedium 6.1
In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/specials/MobileSpecialPageFeed.php.
Product
Mobilefrontend
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gerrit.wikimedia.org phabricator.wikimedia.org
Jul 27, 2019In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c.CVE-2015-9289 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org github.com
Jun 3, 2019VFront 0.99.5 has Reflected XSS via the admin/menu_registri.php descrizione_g parameter or the admin/sync_reg_tab.php azzera parameter.CVE-2019-9839 · Other software · Vfront · reported by MITREMedium 6.1
VFront 0.99.5 has Reflected XSS via the admin/menu_registri.php descrizione_g parameter or the admin/sync_reg_tab.php azzera parameter.
Product
Vfront
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com netsparker.com
Jun 3, 2019VFront 0.99.5 has stored XSS via the admin/sync_reg_tab.php azzera parameter, which is mishandled during admin/error_log.php rendering.CVE-2019-9838 · Other software · Vfront · reported by MITREMedium 6.1
VFront 0.99.5 has stored XSS via the admin/sync_reg_tab.php azzera parameter, which is mishandled during admin/error_log.php rendering.
Product
Vfront
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com netsparker.com
Apr 20, 2019app/controllers/frontend/PostController.php in ROCBOSS V2.2.1 has SQL injection via the Post:doReward score paramter, as demonstrated by the /do/reward/3 URI.CVE-2019-11362 · Other software · Rocboss · reported by MITRECritical 9.8
app/controllers/frontend/PostController.php in ROCBOSS V2.2.1 has SQL injection via the Post:doReward score paramter, as demonstrated by the /do/reward/3 URI.
Product
Rocboss
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 18, 2019An XML external entity (XXE) vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to readCVE-2018-17289 · Other software · Kofax · reported by MITREMedium 6.5
An XML external entity (XXE) vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to read arbitrary files via crafted XML inside an imported package configuration (.ZIP file) within the Kofax/KFS/Admin/PackageService/package/upload file parameter.
Product
Front Office Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 18, 2019Kofax Front Office Server version 4.1.1.11.0.5212 (both Thin Client and Administration Console) suffers from multiple authenticated stored XSS vulnerabilities vCVE-2018-17288 · Other software · Kofax · reported by MITREMedium 5.4
Kofax Front Office Server version 4.1.1.11.0.5212 (both Thin Client and Administration Console) suffers from multiple authenticated stored XSS vulnerabilities via the (1) "Filename" field in /Kofax/KFS/ThinClient/document/upload/ - (Thin Client) or (2) "DeviceName" field in /Kofax/KFS/Admin/DeviceService/device/ - (Administration Console).
Product
Front Office Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 18, 2019In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value caCVE-2018-17287 · Other software · Kofax · reported by MITREMedium 4.9
In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end "download" feature, as demonstrated by an mfp.password downloadsettingvalue operation.
Product
Front Office Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 6, 2019Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.CVE-2019-10904 · Other software · Debian · reported by MITREMedium 6.1
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.
Product
Debian Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com bugs.python.org
Mar 27, 2019A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled.CVE-2019-3821 · Other software · [UNKNOWN] · reported by Red HatHigh 7.5
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.
Product
ceph
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com github.com
Mar 15, 2019CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechCVE-2019-5616 · Other software · Broadcastboxes · reported by cve@rapid7.comMedium 5.3
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
Product
Scion-8 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.rapid7.com blog.rapid7.com
Feb 28, 2019By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting.CVE-2018-12395 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.
Product
Firefox ESR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Feb 23, 2019In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hidden form value of the HTML source code, CVE-2014-10079 · Other software · Vembu · reported by MITREMedium 5.3
In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hidden form value of the HTML source code, which is disclosed because of incorrect processing of an index.php/ trailing slash.
Product
Storegrid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxsecurity.com packetstormsecurity.com
Feb 19, 2019Incorrect handling of invalid end character position when front rendering in Blink in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentialCVE-2019-5769 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Incorrect handling of invalid end character position when front rendering in Blink in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com chromereleases.googleblog.com
Jan 8, 2019includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the attacker to grab theCVE-2019-5720 · Other software · Frontaccounting · reported by MITRECritical 9.8
includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the attacker to grab the entire database of the application via the void_transaction.php filterType parameter.
Product
Frontaccounting
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 28, 2018FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachments.php that can allow the attacker to gCVE-2018-1000890 · Other software · Frontaccounting · reported by MITREHigh 7.5
FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachments.php that can allow the attacker to grab the entire database of the application.
Product
Frontaccounting
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Dec 11, 2018SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts that are based on the pCVE-2018-2505 · Websites & servers · SAP · reported by cna@sap.comMedium 6.1
SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts that are based on the product. Fixed in versions (SAP Hybris Commerce, versions 6.2, 6.3, 6.4, 6.5, 6.6, 6.7).
Product
SAP Commerce (SAP Hybris Commerce)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com launchpad.support.sap.com
Aug 30, 2018cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/indCVE-2018-16236 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering.
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxsecurity.com cxsecurity.com
Aug 30, 2018The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_doajax_front_template CVE-2018-16159 · WordPress plugins & themes · reported by MITRECritical 9.8
The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_doajax_front_template request.
Product
Gift Vouchers
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Gift Vouchers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Jul 5, 2018uniquesig0/InternalSite/InitParams.aspx in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to trigger outbound DNS queries for arbitraryCVE-2018-12571 · Email & office · Microsoft · reported by MITRECritical 9.8
uniquesig0/InternalSite/InitParams.aspx in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to trigger outbound DNS queries for arbitrary hosts via a comma-separated list of URLs in the orig_url parameter, possibly causing a traffic amplification and/or SSRF outcome.
Product
Forefront Unified Access Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 19, 2018Cross-site scripting (XSS) vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project (PKP) Open Monograph Press (OMP) v1.2.0 throuCVE-2018-12588 · Other software · Public Knowledge Project · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project (PKP) Open Monograph Press (OMP) v1.2.0 through 3.1.1-2 before 3.1.1-3 allows remote attackers to inject arbitrary web script or HTML via the catalog.noTitlesSearch parameter (aka the Search field).
Product
Open Monograph Press
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.pkp.sfu.ca forum.pkp.sfu.ca
Jun 15, 2018The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev20 allows CVE-2018-5753 · Other software · Open-xchange · reported by MITREMedium 6.5
The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev20 allows remote attackers to spoof the origin of e-mails via unicode characters in the "personal part" of a (1) From or (2) Sender address.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 6, 2018node-server-forfront is a simple static file server.CVE-2017-16124 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Product
node-server-forfront node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com nodesecurity.io
Jun 4, 2018js-given is a JavaScript frontend to jgiven.CVE-2016-10638 · Other software · HackerOne · reported by support@hackerone.comHigh 8.1
js-given is a JavaScript frontend to jgiven. js-given downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Product
js-given node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
May 12, 2018ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.CVE-2018-11011 · Other software · Halo · reported by MITREMedium 6.1
ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.
Product
Halo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 25, 2018An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS.CVE-2018-10366 · Other software · User Project · reported by MITREMedium 6.1
An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field.
Product
User
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Apr 18, 2018In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor.CVE-2018-9986 · Other software · Zulip · reported by MITREMedium 6.1
In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor.
Product
Zulip Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.zulip.org blog.zulip.org
Apr 10, 2018The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator.CVE-2018-9985 · Other software · Metinfo · reported by MITREMedium 6.1
The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator.
Product
Metinfo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 15, 2018FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions pagCVE-2018-7176 · Other software · Frontaccounting · reported by MITREHigh 8.8
FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions page).
Product
Frontaccounting
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitywarrior9.blogspot.in exploit-db.com
Feb 5, 2018Absolute path traversal vulnerability in eFront CMS 3.6.15.4 and earlier allows remote Professor users to obtain sensitive information via a full pathname in thCVE-2015-4461 · Other software · Efrontlearning · reported by MITREMedium 6.5
Absolute path traversal vulnerability in eFront CMS 3.6.15.4 and earlier allows remote Professor users to obtain sensitive information via a full pathname in the other parameter.
Product
Efront
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.efrontlearning.net mohankallepalli.blogspot.in
Jan 22, 2018The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php (war_soundy_preview CVE-2018-6002 · WordPress plugins & themes · reported by MITREMedium 6.1
The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php (war_soundy_preview parameter).
Affected
up to 3.9
What to do
Affects up to 3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record defensecode.com defensecode.com
Jan 22, 2018The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war_sdy_pl_preview paraCVE-2018-6001 · WordPress plugins & themes · reported by MITREMedium 6.1
The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war_sdy_pl_preview parameter).
Affected
up to 4.6
What to do
Affects up to 4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record defensecode.com defensecode.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.