Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,570 results · page 16 of 32
Jun 27, 2022The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to maliCVE-2022-1028 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
- Product
- WordPress Security Firewall, Malware Scanner, Secure Login and Backup
- Fixed in
- 4.2.1
- What to do
- Update WordPress Security Firewall, Malware Scanner, Secure Login and Backup to 4.2.1 or newer.
Jun 27, 2022Backup, Restore and Migrate WordPress Sites With the XCloner: Does not have authorisation and CSRF checksCVE-2022-0444 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup encryption key.
- Product
- Backup, Restore and Migrate WordPress Sites With the XCloner
- Fixed in
- 4.3.6
- What to do
- Update Backup, Restore and Migrate WordPress Sites With the XCloner to 4.3.6 or newer.
Jun 24, 2022Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic CVE-2022-29330 · Other software · Vitalpbx · reported by MITREMedium 4.9
Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic keys and voicemails files via unspecified vectors.
- Product
- Vitalpbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarsouyes.orgarsouyes.org
Jun 13, 2022Keep Backup Daily: Reflected Cross-Site ScriptingCVE-2022-1820 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Keep Backup Daily
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Keep Backup Daily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 9, 2022In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validatiCVE-2022-30075 · Network & remote access · Tp-link · reported by MITREHigh 8.8
In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation.
- Product
- Archer Ax50 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 8, 2022Database Backup for: Does not have CSRF check in placeCVE-2022-1577 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule
- Product
- Database Backup for
- Fixed in
- 2.5.2
- What to do
- Update Database Backup for to 2.5.2 or newer.
Jun 2, 2022Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output.CVE-2022-26944 · Other software · Percona · reported by MITREMedium 6.5
Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table. NOTE: this issue exists because of an incomplete fix for CVE-2020-10997.
- Product
- Xtrabackup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.percona.comjira.percona.com
May 11, 2022An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary files.CVE-2020-19228 · Other software · Bludit · reported by MITREHigh 7.2
An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary files.
- Product
- Bludit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2022nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature.CVE-2022-28451 · Websites & servers · Nopcommerce · reported by MITREHigh 7.5
nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature.
- Product
- Nopcommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload CVE-2021-43934 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govCritical 9.8
Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files.
- Product
- SmartPTT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traveCVE-2021-43930 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govMedium 4.9
Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system.
- Product
- SmartPTT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2022dhcms v20170919 was discovered to contain an arbitrary folder deletion vulnerability via /admin.php?r=admin/AdminBackup/del.CVE-2022-28527 · Other software · Dhcms Project · reported by MITREHigh 8.1
dhcms v20170919 was discovered to contain an arbitrary folder deletion vulnerability via /admin.php?r=admin/AdminBackup/del.
- Product
- Dhcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2022Veritas NetBackup OpsCenter Analytics 9.1 allows XSS via the NetBackup Master Server Name, Display Name, NetBackup User Name, or NetBackup Password field duringCVE-2021-41570 · Other software · Veritas · reported by MITREMedium 5.4
Veritas NetBackup OpsCenter Analytics 9.1 allows XSS via the NetBackup Master Server Name, Display Name, NetBackup User Name, or NetBackup Password field during a Settings/Configuration Add operation.
- Product
- Netbackup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordveritas.comveritas.com
Apr 15, 2022Kaseya Unitrends Client/Agent through 10.5,5 allows remote attackers to execute arbitrary code.CVE-2021-40386 · Other software · Kaseya · reported by MITRECritical 9.8
Kaseya Unitrends Client/Agent through 10.5,5 allows remote attackers to execute arbitrary code.
- Product
- Unitrends Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Apr 11, 2022WPvivid Team Migration, Backup, Staging – WPvivid: Arbitrary File ReadCVE-2022-27844 · WordPress plugins & themes · reported by PatchstackLow 2.7
Arbitrary File Read vulnerability in WPvivid Team Migration, Backup, Staging – WPvivid (WordPress plugin) versions <= 0.9.70
- Product
- WPvivid Team Migration, Backup, Staging – WPvivid
- Affected
- up to 0.9.70
- What to do
- Affects up to 0.9.70. Update WPvivid Team Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 11, 2022Migration, Backup, Staging: Does not sanitise and escape the sub_page parameter before outputting it back in the pageCVE-2022-0531 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the sub_page parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting
- Product
- Migration, Backup, Staging
- Fixed in
- 0.9.70
- What to do
- Update Migration, Backup, Staging to 0.9.70 or newer.
Apr 11, 2022settings of the iQ Block Country: Can be exported or imported using its backup functionalityCVE-2022-0246 · WordPress plugins & themes · reported by WPScanMedium 4.9
The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to "Zip Slip" vulnerability.
- Product
- settings of the iQ Block Country
- Fixed in
- 1.2.13
- What to do
- Update settings of the iQ Block Country to 1.2.13 or newer.
Apr 4, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the updraft_interval parameter before outputting it back in an admin pageCVE-2022-0864 · WordPress plugins & themes · reported by WPScanMedium 6.1
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
- Product
- UpdraftPlus WordPress Backup
- Fixed in
- 1.22.9
- What to do
- Update UpdraftPlus WordPress Backup to 1.22.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Mar 17, 2022Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) alloCVE-2022-26504 · Other software · Veeam · reported by MITREHigh 8.8
Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe
- Product
- Veeam Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022Veeam Backup & Replication Remote Code Execution VulnerabilityCVE-2022-26501 · Other software · Veeam · reported by MITREExploitedRansomwareCritical 9.8
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
- Product
- Backup & Replication
- On CISA’s list since
- Dec 13, 2022 (federal fix deadline Jan 3, 2023)
- What to do
- Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogveeam.comveeam.com
Mar 17, 2022Veeam Backup & Replication Remote Code Execution VulnerabilityCVE-2022-26500 · Other software · Veeam · reported by MITREExploitedRansomwareHigh 8.8
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
- Product
- Backup & Replication
- On CISA’s list since
- Dec 13, 2022 (federal fix deadline Jan 3, 2023)
- What to do
- Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogveeam.comveeam.com
Mar 17, 2022Slims9 Bulian 9.4.2 is affected by SQL injection in /admin/modules/system/backup.php.CVE-2021-45794 · Other software · Slims · reported by MITREHigh 7.5
Slims9 Bulian 9.4.2 is affected by SQL injection in /admin/modules/system/backup.php. User data can be obtained.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the h_primary_ntp_server, h_backup_ntp_sCVE-2022-27000 · Other software · Commscope · reported by MITRECritical 9.8
Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the h_primary_ntp_server, h_backup_ntp_server, and h_time_zone parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Arris Tr3300 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Bareos is open source software for backup, archiving, and recovery of data for operating systems.CVE-2022-24756 · Other software · bareos · reported by GitHubHigh 7.5
Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, a failed PAM authentication will leak a small amount of memory. An attacker that is able to use the PAM Console (i.e. by knowing the shared secret or via the WebUI) can flood the Director with failing login attempts which will eventually lead to an out-of-memory condition in which the Director will not work anymore. Bareos Director versions 21.1.0, 20.0.6 and 19.2.12 contain a Bugfix for this problem. Users who are unable to upgrade may disable PAM authentication as a workaround.
- Product
- bareos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Bareos is open source software for backup, archiving, and recovery of data for operating systems.CVE-2022-24755 · Other software · bareos · reported by GitHubHigh 8.1
Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, it will skip authorization checks completely. Expired accounts and accounts with expired passwords can still login. This problem will affect users that have PAM enabled. Currently there is no authorization (e.g. check for expired or disabled accounts), but only plain authentication (i.e. check if username and password match). Bareos Director versions 21.1.0, 20.0.6 and 19.2.12 implement the authorization check that was previously missing. The only workaround is to make sure that authentication fails if the user is not authorized.
- Product
- bareos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-0921 · Other software · microweber · reported by security@huntr.devMedium 6.7
Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022Veritas System Recovery (VSR) 18 and 21 stores a network destination password in the Windows registry during configuration of the backup configuration.CVE-2022-26778 · Other software · Veritas · reported by MITREMedium 5.3
Veritas System Recovery (VSR) 18 and 21 stores a network destination password in the Windows registry during configuration of the backup configuration. This could allow a Windows user (who has sufficient privileges) to access a network file system that they were not authorized to access.
- Product
- System Recovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordveritas.comveritas.com
Mar 1, 2022An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code vCVE-2022-24254 · Other software · Extensis · reported by MITREHigh 8.8
An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file.
- Product
- Portfolio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsnyk.iowhiteoaksecurity.com
Feb 28, 2022Migration, Backup, Staging: Does not have authorisationCVE-2021-24994 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Migration, Backup, Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages, and does not sanitise as well as escape a parameter from such unauthenticated requests before outputting it in admin page, leading to a Stored Cross-Site Scripting issue
- Product
- Migration, Backup, Staging
- Fixed in
- 0.9.69
- What to do
- Update Migration, Backup, Staging to 0.9.69 or newer.
Feb 21, 2022Database Backup for: Does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboardCVE-2022-0255 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
- Product
- Database Backup for
- Fixed in
- 2.5.1
- What to do
- Update Database Backup for to 2.5.1 or newer.
Feb 17, 2022The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nCVE-2022-0633 · WordPress plugins & themes · reported by WPScanMedium 6.5
The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.
- Fixed in
- 1.22.3
- What to do
- Update the plugin to 1.22.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comjetpack.com
Feb 11, 2022A Directory Traversal vulnerability exists in S-Cart 6.7 via download in sc-admin/backup.CVE-2021-44111 · Other software · S-cart · reported by MITREMedium 4.4
A Directory Traversal vulnerability exists in S-Cart 6.7 via download in sc-admin/backup.
- Product
- S-cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable an escalation of privilege via locaCVE-2021-0156 · Other software · Netapp · reported by secure@intel.comHigh 7.8
Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable an escalation of privilege via local access.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Feb 9, 2022Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via physical acceCVE-2021-0125 · Other software · Netapp · reported by secure@intel.comMedium 6.6
Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via physical access.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Feb 9, 2022Improper access control in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via physical acceCVE-2021-0124 · Other software · Netapp · reported by secure@intel.comMedium 6.6
Improper access control in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via physical access.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Feb 9, 2022Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via physical acceCVE-2021-0119 · Other software · Netapp · reported by secure@intel.comMedium 6.2
Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via physical access.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Feb 9, 2022Out-of-bounds read in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.CVE-2021-0118 · Other software · Netapp · reported by secure@intel.comMedium 6.7
Out-of-bounds read in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Feb 9, 2022Pointer issues in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.CVE-2021-0117 · Other software · Netapp · reported by secure@intel.comHigh 7.8
Pointer issues in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Feb 9, 2022Out-of-bounds write in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.CVE-2021-0116 · Other software · Netapp · reported by secure@intel.comHigh 7.8
Out-of-bounds write in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Feb 1, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the updraft_restore parameter before outputting it back in the Restore pageCVE-2021-25089 · WordPress plugins & themes · reported by WPScanMedium 6.1
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore parameter before outputting it back in the Restore page, leading to a Reflected Cross-Site Scripting
- Product
- UpdraftPlus WordPress Backup
- Fixed in
- 1.16.69
- What to do
- Update UpdraftPlus WordPress Backup to 1.16.69 or newer.
Jan 31, 2022Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration backup file containinCVE-2021-44255 · Other software · Motioneye Project · reported by MITREHigh 7.2
Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server.
- Product
- Motioneye
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compizzapower.me
Jan 24, 2022Backup and Staging by WP Time Capsule: Does not sanitise and escape the error parameter before outputting it back in an admin pageCVE-2021-25035 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Backup and Staging by WP Time Capsule
- Fixed in
- 1.22.7
- What to do
- Update Backup and Staging by WP Time Capsule to 1.22.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022UpdraftPlus WordPress Backup: Does not sanitise its updraft_service settingsCVE-2021-24423 · WordPress plugins & themes · reported by WPScanMedium 4.8
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set malicious JavaScript payload in it and leading to a Stored Cross-Site Scripting issue
- Product
- UpdraftPlus WordPress Backup
- Fixed in
- 1.6.59
- What to do
- Update UpdraftPlus WordPress Backup to 1.6.59 or newer.
Jan 11, 2022Windows BackupKey Remote Protocol Security Feature Bypass VulnerabilityCVE-2022-21925 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
Windows BackupKey Remote Protocol Security Feature Bypass Vulnerability
- Product
- Windows 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 3, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pagesCVE-2021-25022 · WordPress plugins & themes · reported by WPScanMedium 6.1
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues
- Product
- UpdraftPlus WordPress Backup
- Fixed in
- 1.16.66
- What to do
- Update UpdraftPlus WordPress Backup to 1.16.66 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 28, 2021An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards.CVE-2021-37401 · Other software · Idec · reported by MITRECritical 9.8
An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the PLC user program may be uploaded, altered, and/or downloaded.
- Product
- Data File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup.CVE-2021-43388 · Other software · Unisys · reported by MITREHigh 7.5
Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup. The issue is addressed by ensuring that the allowBackup flag (in the manifest) is False.
- Product
- Cargo Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublic.support.unisys.compublic.support.unisys.com
Dec 6, 2021WP Data Access: Does not properly sanitise and escape the backup_date parameter before using it a SQL statementCVE-2021-24866 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion
- Product
- WP Data Access
- Fixed in
- 5.0.0
- What to do
- Update WP Data Access to 5.0.0 or newer.
Dec 5, 2021An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.CVE-2021-43044 · Other software · Kaseya · reported by MITRECritical 9.8
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The SNMP daemon was configured with a weak default community.
- Product
- Unitrends Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpdesk.kaseya.comcyberonesecurity.com
Dec 5, 2021An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.CVE-2021-43043 · Other software · Kaseya · reported by MITREMedium 6.5
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule.
- Product
- Unitrends Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpdesk.kaseya.comcyberonesecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.