Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,547 results · page 161 of 391
Oct 5, 2021ARCHIBUS Web Central 21.3.3.815 (a version from 2014) does not properly validate requests for access to data and functionality in these affected endpoints: /arcCVE-2021-41554 · Other software · Archibus · reported by MITREHigh 8.8
ARCHIBUS Web Central 21.3.3.815 (a version from 2014) does not properly validate requests for access to data and functionality in these affected endpoints: /archibus/schema/ab-edit-users.axvw, /archibus/schema/ab-data-dictionary-table.axvw, /archibus/schema/ab-schema-add-field.axvw, /archibus/schema/ab-core/views/process-navigator/ab-my-user-profile.axvw. By not verifying the permissions for access to resources, it allows a potential attacker to view pages that are not allowed. Specifically, it was found that any authenticated user can reach the administrative console for user management by directly requesting access to the page via URL. This allows a malicious user to modify all users' profiles, to elevate any privileges to administrative ones, or to create or delete any type of user. It is also possible to modify the emails of other users, through a misconfiguration of the username parameter, on the user profile page. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020
- Product
- Web Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Oct 4, 2021The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on the flash drive.CVE-2021-38396 · Other software · Boston Scientific · reported by ics-cert@hq.dhs.govMedium 6.5
The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on the flash drive. An attacker could leverage this weakness to install unauthorized software using a specially crafted USB.
- Product
- ZOOM LATITUDE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 4, 2021Modern Events Calendar Lite: Does not escape some of its settings before outputting them in attributesCVE-2021-24687 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.22.2
- What to do
- Update Modern Events Calendar Lite to 5.22.2 or newer.
Oct 4, 2021Bitcoin / AltCoin Payment Gateway for WooCommerce: Does not escape the 's' GET parameter before outputting back in the All Masking Rules pageCVE-2021-24679 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue
- Product
- Bitcoin / AltCoin Payment Gateway for WooCommerce
- Fixed in
- 1.6.1
- What to do
- Update Bitcoin / AltCoin Payment Gateway for WooCommerce to 1.6.1 or newer.
Oct 4, 2021CM Tooltip Glossary: Does not escape some glossary_tooltip shortcode attributesCVE-2021-24678 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CM Tooltip Glossary WordPress plugin before 3.9.21 does not escape some glossary_tooltip shortcode attributes, which could allow users a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- CM Tooltip Glossary
- Fixed in
- 3.9.21
- What to do
- Update CM Tooltip Glossary to 3.9.21 or newer.
Oct 4, 2021Better Find and Replace: Does not escape the 's' GET parameter before outputting back in the All Masking Rules pageCVE-2021-24676 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue
- Product
- Better Find and Replace
- Fixed in
- 1.2.9
- What to do
- Update Better Find and Replace to 1.2.9 or newer.
Oct 4, 2021Appointment Hour Booking: Does not escape some of the Calendar Form settingsCVE-2021-24673 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Appointment Hour Booking
- Fixed in
- 1.3.16
- What to do
- Update Appointment Hour Booking to 1.3.16 or newer.
Oct 4, 2021User Registration: Does not properly sanitise the user_registration_profile_pic_url valueCVE-2021-24654 · WordPress plugins & themes · reported by WPScanMedium 5.4
The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url value when submitted directly via the user_registration_update_profile_details AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attacks when their profile is viewed
- Product
- User Registration
- Fixed in
- 2.0.2
- What to do
- Update User Registration to 2.0.2 or newer.
Oct 4, 2021Meow Gallery: Does not sanitiseCVE-2021-24465 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode (available for users as low as Contributor) before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned values to be manipulated in a way that could lead to data disclosure and arbitrary objects to be deserialized.
- Product
- Meow Gallery
- Fixed in
- 4.1.9
- What to do
- Update Meow Gallery to 4.1.9 or newer.
Oct 3, 2021The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than CVE-2019-16248.CVE-2021-41861 · Other software · Telegram · reported by MITRELow 3.3
The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than CVE-2019-16248. After approximately two to four uses of the self-destruct feature, there is a misleading UI indication that an image was deleted (on both the sender and recipient sides). The images are still present in the /Storage/Emulated/0/Telegram/Telegram Image/ directory.
- Product
- Telegram
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddesktop.telegram.orghabr.com
Sep 30, 2021A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pCVE-2021-33626 · Other software · Siemens · reported by MITREHigh 7.8
A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer(QWORD values for CommBuffer). This can be used by an attacker to corrupt data in SMRAM memory and even lead to arbitrary code execution.
- Product
- RUGGEDCOM APE1808 - BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comsecurity.netapp.com
Sep 27, 2021MX Time Zone Clocks: Does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcodeCVE-2021-24671 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MX Time Zone Clocks WordPress plugin before 3.4.1 does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- MX Time Zone Clocks
- Fixed in
- 3.4.1
- What to do
- Update MX Time Zone Clocks to 3.4.1 or newer.
Sep 27, 2021CoolClock: Does not escape some shortcode attributesCVE-2021-24670 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks
- Product
- CoolClock
- Fixed in
- 4.3.5
- What to do
- Update CoolClock to 4.3.5 or newer.
Sep 27, 2021WP Map Block: Does not escape some attributes of the WP Map BlockCVE-2021-24643 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- WP Map Block
- Fixed in
- 1.2.3
- What to do
- Update WP Map Block to 1.2.3 or newer.
Sep 27, 2021Recipe Card Blocks by WPZOOM: Does not properly sanitise or escape some of the properties of the Recipe Card Block (suchCVE-2021-24634 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings), which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
- Product
- Recipe Card Blocks by WPZOOM
- Fixed in
- 2.8.3
- What to do
- Update Recipe Card Blocks by WPZOOM to 2.8.3 or newer.
Sep 27, 2021Countdown Block: Does not have authorisation in the eb_write_block_css AJAX actionCVE-2021-24633 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users.
- Product
- Countdown Block
- Fixed in
- 1.1.2
- What to do
- Update Countdown Block to 1.1.2 or newer.
Sep 27, 2021Recipe Card Blocks by WPZOOM: Does not escape the message parameter before outputting it back in the admin dashboardCVE-2021-24632 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- Recipe Card Blocks by WPZOOM
- Fixed in
- 2.8.1
- What to do
- Update Recipe Card Blocks by WPZOOM to 2.8.1 or newer.
Sep 27, 2021TranslatePress: Does not implement a proper sanitisation on the translated stringsCVE-2021-24610 · WordPress plugins & themes · reported by WPScanMedium 4.8
The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored Cross-Site Scripting issues.
- Product
- TranslatePress
- Fixed in
- 2.0.9
- What to do
- Update TranslatePress to 2.0.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Sep 27, 2021Cookie Notice & Compliance for GDPR / CCPA: Does not escape the value of its Button Text settingCVE-2021-24569 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outputting it in an attribute in the frontend, allowing high privilege users such as admin to perform Cross-Site Scripting even when the unfiltered_html capability is disallowed.
- Product
- Cookie Notice & Compliance for GDPR / CCPA
- Fixed in
- 2.1.2
- What to do
- Update Cookie Notice & Compliance for GDPR / CCPA to 2.1.2 or newer.
Sep 27, 2021The Zone Controller service in the Zoom On-Premise Meeting Connector Controller before version 4.6.358.20210205 does not verify the cnt field sent in incoming nCVE-2021-34415 · Other software · Zoom · reported by security@zoom.usHigh 7.5
The Zone Controller service in the Zoom On-Premise Meeting Connector Controller before version 4.6.358.20210205 does not verify the cnt field sent in incoming network packets, which leads to exhaustion of resources and system crash.
- Product
- Meeting Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Sep 23, 2021IBM Security Verify Bridge 1.0.5.0 does not properly validate a certificate which could allow a local attacker to obtain sensitive information that could aid inCVE-2021-20435 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM Security Verify Bridge 1.0.5.0 does not properly validate a certificate which could allow a local attacker to obtain sensitive information that could aid in further attacks against the system. IBM X-Force ID: 196355.
- Product
- Security Verify Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 20, 2021Support Board: Does not escape multiple POST parameters (suchCVE-2021-24741 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.
- Product
- Support Board
- Fixed in
- 3.3.4
- What to do
- Update Support Board to 3.3.4 or newer.
Full record and what to do →NVD recordboard.supportmedium.com
Sep 20, 2021Simple Schools Staff Directory: Does not validate uploaded logo pictures to ensure that are indeed imagesCVE-2021-24663 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE
- Product
- Simple Schools Staff Directory
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Simple Schools Staff Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2021Limit Login Attempts: Does not escape the IP addresses (which can be controlled by attacker via headers suchCVE-2021-24657 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.
- Product
- Limit Login Attempts
- Fixed in
- 4.0.50
- What to do
- Update Limit Login Attempts to 4.0.50 or newer.
Sep 20, 2021The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as lCVE-2021-24640 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- WordPress Slider Block Gutenslider
- Fixed in
- 5.2.0
- What to do
- Update WordPress Slider Block Gutenslider to 5.2.0 or newer.
Sep 20, 2021OMGF: Does not enforce path validationCVE-2021-24639 · WordPress plugins & themes · reported by WPScanHigh 8.1
The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.
- Product
- OMGF
- Fixed in
- 4.5.4
- What to do
- Update OMGF to 4.5.4 or newer.
Sep 20, 2021OMGF: Does not escape or validate the handle parameter of the REST APICVE-2021-24638 · WordPress plugins & themes · reported by WPScanCritical 9.1
The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
- Product
- OMGF
- Fixed in
- 4.5.4
- What to do
- Update OMGF to 4.5.4 or newer.
Sep 20, 2021Google Fonts Typography: Does not escape and sanitise some of its block settingsCVE-2021-24637 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType (combined with content), align, color, variant and fontID argument of a Gutenberg block.
- Product
- Google Fonts Typography
- Fixed in
- 3.0.3
- What to do
- Update Google Fonts Typography to 3.0.3 or newer.
Sep 20, 2021Print My Blog: Does not enforce nonce (CSRF) checksCVE-2021-24636 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Print My Blog WordPress Plugin before 3.4.2 does not enforce nonce (CSRF) checks, which allows attackers to make logged in administrators deactivate the Print My Blog plugin and delete all saved data for that plugin by tricking them to open a malicious link
- Product
- Print My Blog
- Fixed in
- 3.4.2
- What to do
- Update Print My Blog to 3.4.2 or newer.
Sep 20, 2021Visual Link Preview: Does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated usersCVE-2021-24635 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user (such as subscriber) to call them and 1) Get and search through title and content of Draft post, 2) Get title of a password-protected post as well as 3) Upload an image from an URL
- Product
- Visual Link Preview
- Fixed in
- 2.2.3
- What to do
- Update Visual Link Preview to 2.2.3 or newer.
Sep 20, 2021Donate With QRCode: Does not sanitise or escape its QRCode Image settingCVE-2021-24618 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS). Furthermore, the plugin also does not have any CSRF and capability checks in place when saving such setting, allowing any authenticated user (as low as subscriber), or unauthenticated user via a CSRF vector to update them and perform such attack.
- Product
- Donate With QRCode
- Fixed in
- 1.4.5
- What to do
- Update Donate With QRCode to 1.4.5 or newer.
Sep 20, 2021Post Views Counter: Does not sanitise or escape its Post Views Label settingsCVE-2021-24613 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which could allow high privilege users to perform Cross-Site Scripting attacks in the frontend even when the unfiltered_html capability is disallowed
- Product
- Post Views Counter
- Fixed in
- 1.3.5
- What to do
- Update Post Views Counter to 1.3.5 or newer.
Sep 20, 2021WP Mapa Politico Espana: Does not sanitise or escape some of its settings before outputting them in attributesCVE-2021-24609 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Mapa Politico Espana WordPress plugin before 3.7.0 does not sanitise or escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- WP Mapa Politico Espana
- Fixed in
- 3.7.0
- What to do
- Update WP Mapa Politico Espana to 3.7.0 or newer.
Sep 20, 2021Availability Calendar: Does not escape the category attribute from its shortcode before using it in a SQL statementCVE-2021-24606 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+
- Product
- Availability Calendar
- Fixed in
- 1.2.1
- What to do
- Update Availability Calendar to 1.2.1 or newer.
Sep 20, 2021Availability Calendar: Does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embedCVE-2021-24604 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Availability Calendar
- Fixed in
- 1.2.2
- What to do
- Update Availability Calendar to 1.2.2 or newer.
Sep 20, 2021WP Dialog: Does not sanitise and escape some of its settings before outputting them in pagesCVE-2021-24600 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them in pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WP Dialog
- Affected
- up to 1.2.5.5
- What to do
- Affects up to 1.2.5.5. Update WP Dialog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2021You Shang: Does not escape its qrcode links settingsCVE-2021-24597 · WordPress plugins & themes · reported by WPScanMedium 5.4
The You Shang WordPress plugin through 1.0.1 does not escape its qrcode links settings, which result into Stored Cross-Site Scripting issues in frontend posts and the plugins settings page depending on the payload used
- Product
- You Shang
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update You Shang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2021youForms for: Does not sanitise escape the Button Text field of its TemplatesCVE-2021-24596 · WordPress plugins & themes · reported by WPScanMedium 4.8
The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege users (editors and admins) to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- youForms for
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update youForms for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2021Splash Header: Doesn't sanitise and escape some of its settings while outputting them in the admin dashboardCVE-2021-24587 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.
- Product
- Splash Header
- Fixed in
- 1.20.8
- What to do
- Update Splash Header to 1.20.8 or newer.
Sep 20, 2021Timetable and Event Schedule: Does not have proper access controlCVE-2021-24584 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues
- Product
- Timetable and Event Schedule
- Fixed in
- 2.4.2
- What to do
- Update Timetable and Event Schedule to 2.4.2 or newer.
Sep 20, 2021Timetable and Event Schedule: Does not have proper access controlCVE-2021-24583 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability (contributor+) to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in with such capability
- Product
- Timetable and Event Schedule
- Fixed in
- 2.4.2
- What to do
- Update Timetable and Event Schedule to 2.4.2 or newer.
Sep 20, 2021Alojapro Widget: Doesn't properly sanitise its Custom CSS settingsCVE-2021-24530 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Alojapro Widget WordPress plugin through 1.1.15 doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Alojapro Widget
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update Alojapro Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2021XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.CVE-2021-41317 · Other software · XSS Hunter Express Project · reported by MITRECritical 9.8
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.
- Product
- XSS Hunter Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comgithub.com
Sep 17, 2021The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility.CVE-2021-41316 · Other software · Device42 · reported by MITREHigh 8.1
The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (with permissions to add or edit jobs run by this utility) can inject an extra argument to overwrite arbitrary files as the root user on the Remote Collector.
- Product
- Device42
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.device42.comdocs.device42.com
Sep 17, 2021The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility.CVE-2021-41315 · Other software · Device42 · reported by MITREHigh 8.8
The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility. This allows an authenticated attacker (with access to the console application) to execute arbitrary OS commands and escalate privileges.
- Product
- Remote Collector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.device42.comdocs.device42.com
Sep 16, 2021Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices.CVE-2021-34572 · Other software · Enbra · reported by info@cert.vde.comMedium 6.5
Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by the time of the readout even if the data is a replay of earlier data.
- Product
- EWM 1.7.29
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfit.vutbr.czfit.vutbr.cz
Sep 15, 2021The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page.CVE-2021-37913 · Other software · HGiga · reported by twcert@cert.org.twCritical 9.8
The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in.
- Product
- OAKlouds OAKSv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 15, 2021The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page.CVE-2021-37912 · Other software · HGiga · reported by twcert@cert.org.twCritical 9.8
The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in.
- Product
- OAKlouds OAKSv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 15, 2021WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus CVE-2021-37909 · Other software · CHANGING Inc. · reported by twcert@cert.org.twCritical 9.8
WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code.
- Product
- TSSServiSignAdapter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 15, 2021SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode user controlled inputs and therefore an aCVE-2021-33696 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode user controlled inputs and therefore an authorized attacker can exploit a XSS vulnerability, leading to non-permanently deface or modify displayed content from a Web site.
- Product
- SAP BusinessObjects Business Intelligence Platform (Crystal Report)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.