Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
979 results · page 17 of 20
Oct 29, 2020Sal is a multi-tenanted reporting dashboard for Munki with the ability to display information from Facter.CVE-2020-26205 · Other software · salopensource · reported by GitHubHigh 7.6
Sal is a multi-tenanted reporting dashboard for Munki with the ability to display information from Facter. In Sal through version 4.1.6 there is an XSS vulnerability on the machine_list view.
- Product
- Sal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2020An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0.CVE-2020-26943 · Other software · Openstack · reported by MITRECritical 9.9
An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.
- Product
- Blazar-dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlaunchpad.net
Sep 30, 2020An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security dashboard.CVE-2020-13320 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security dashboard.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2020Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected dashboard data via imCVE-2020-7297 · Other software · McAfee · reported by trellixpsirt@trellix.comMedium 5.7
Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected dashboard data via improper access control in the user interface.
- Product
- McAfee Web Gateway (MWG)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkc.mcafee.comkc.mcafee.com
Sep 14, 2020Codoforum 4.8.3 allows HTML Injection in the 'admin dashboard Manage users Section.'CVE-2020-21845 · Other software · Codoforum · reported by MITREMedium 6.1
Codoforum 4.8.3 allows HTML Injection in the 'admin dashboard Manage users Section.'
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodoforum.comvyshnavvizz.blogspot.com
Aug 31, 2020The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.CVE-2020-24699 · WordPress plugins & themes · reported by MITREMedium 6.1
The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.
- Affected
- 3.2.8 to 3.2.8
- What to do
- Affects 3.2.8 to 3.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2020Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS.CVE-2020-17465 · Other software · Forgerock · reported by MITREMedium 6.1
Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. The vulnerability affects versions 6.5.0.4, 6.0.0.6.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comnccgroup.com
Aug 27, 2020Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.CVE-2020-23576 · Other software · Laborator · reported by MITREMedium 5.4
Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.
- Product
- Neon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2020In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration.CVE-2020-15102 · Websites & servers · PrestaShop · reported by GitHubMedium 6.5
In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration. The problem is fixed in 2.1.0.
- Product
- dashproducts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2020"HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for users in Dashboard, potentially giving aCVE-2019-4091 · Other software · Hcltech · reported by psirt@hcl.comMedium 5.4
"HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for users in Dashboard, potentially giving an attacker ability to inject malicious code into the system. "
- Product
- Marketing Campaign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 2, 2020In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables.CVE-2020-15082 · Websites & servers · PrestaShop · reported by GitHubHigh 7.1
In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables. The problem is fixed in 1.7.6.6
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2020The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard CVE-2020-10274 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comHigh 7.1
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database.
- Product
- MiR100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2020Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardcodCVE-2020-10270 · Other software · Mobile Industrial Robots A/S · reported by cve@aliasrobotics.comCritical 9.8
Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardcoded IP address. Credentials to such wireless interface default to well known and widely spread users (omitted) and passwords (omitted). This information is also available in past User Guides and manuals which the vendor distributed. This flaw allows cyber attackers to take control of the robot remotely and make use of the default user interfaces MiR has created, lowering the complexity of attacks and making them available to entry-level attackers. More elaborated attacks can also be established by clearing authentication and sending network requests directly. We have confirmed this flaw in MiR100 and MiR200 but according to the vendor, it might also apply to MiR250, MiR500 and MiR1000.
- Product
- MiR100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2020The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php.CVE-2019-19112 · WordPress plugins & themes · reported by MITREMedium 6.1
The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php.
- Affected
- 1.6.5 to 1.6.5
- What to do
- Affects 1.6.5 to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtwitter.comtwitter.com
Jun 10, 2020A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1CVE-2020-13267 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.1
A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2020The dashboard in WhiteSource Application Vulnerability Management (AVM) before version 20.4.1 allows Log Injection via a %0A%0D substring in the idp parameter tCVE-2020-5304 · Other software · Whitesourcesoftware · reported by MITREHigh 7.5
The dashboard in WhiteSource Application Vulnerability Management (AVM) before version 20.4.1 allows Log Injection via a %0A%0D substring in the idp parameter to the /saml/login URI. This closes the current log and creates a new log with one line of data. The attacker can also insert malicious data and false entries.
- Product
- Whitesource
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comwhitesourcesoftware.com
Jun 6, 2020The Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in a dashboard.CVE-2020-13890 · Other software · Laborator · reported by MITREMedium 5.4
The Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in a dashboard.
- Product
- Neon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjizen0x01.blogspot.comjizen0x01.blogspot.com
Jun 5, 2020In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload.CVE-2020-11697 · Other software · Combodo · reported by MITREMedium 6.1
In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.
- Product
- Itop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2020IBM Security Guardium 11.1 could allow an attacker on the same network to gain access to the Solr dashboard and cause a denial of service attack.CVE-2020-4307 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Security Guardium 11.1 could allow an attacker on the same network to gain access to the Solr dashboard and cause a denial of service attack. IBM X-Force ID: 176997.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 2, 2020Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen.CVE-2018-18625 · Other software · Grafana · reported by MITREMedium 6.1
Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Jun 2, 2020Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen.CVE-2018-18624 · Other software · Grafana · reported by MITREMedium 6.1
Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Jun 2, 2020Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen.CVE-2018-18623 · Other software · Grafana · reported by MITREMedium 6.1
Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2020CSRF in the /login URI in BlueOnyx 5209R allows an attacker to access the dashboard and perform scraping or other analysis.CVE-2020-5517 · Other software · Blueonyx · reported by MITREMedium 6.5
CSRF in the /login URI in BlueOnyx 5209R allows an attacker to access the dashboard and perform scraping or other analysis.
- Product
- 5209r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevel.blueonyx.itgist.github.com
Apr 21, 2020A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions CVE-2020-1699 · Other software · The Ceph Project · reported by Red HatHigh 7.5
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.
- Product
- ceph
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Apr 20, 2020In PrestaShop between versions 1.6.0.0 and 1.7.6.5, there is a reflected XSS with `date_from` and `date_to` parameters in the dashboard page This problem is fixCVE-2020-5271 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
In PrestaShop between versions 1.6.0.0 and 1.7.6.5, there is a reflected XSS with `date_from` and `date_to` parameters in the dashboard page This problem is fixed in 1.7.6.5
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2020An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack (XSSCVE-2020-6647 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.4
An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack (XSS) via the name parameter.
- Product
- Fortiadc Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Apr 2, 2020Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation of a new dashboard.CVE-2020-11454 · Other software · Microstrategy · reported by MITREMedium 5.4
Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation of a new dashboard. In order to exploit this vulnerability, a user needs to get access to a shared dashboard or have the ability to create a dashboard on the application.
- Product
- Microstrategy Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 17, 2020The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI.CVE-2018-18576 · WordPress plugins & themes · reported by MITREMedium 5.3
The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI.
- Product
- Hustle (aka wordpress-popup)
- Affected
- up to 6.0.5
- What to do
- Affects up to 6.0.5. Update Hustle (aka wordpress-popup) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpastebin.comwordpress.org
Mar 13, 2020In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated CVE-2020-5257 · Other software · thoughtbot · reported by GitHubHigh 7.7
In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the `direction` parameter and bypass ActiveRecord SQL protections. Whilst this does have a high-impact, to exploit this you need access to the Administrate dashboards, which we would expect to be behind authentication. This is patched in wersion 0.13.0.
- Product
- administrate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2020HPE OneView Global Dashboard (OVGD) 1.9 has a remote information disclosure vulnerability.CVE-2020-7130 · Other software · HP · reported by security-alert@hpe.comHigh 7.5
HPE OneView Global Dashboard (OVGD) 1.9 has a remote information disclosure vulnerability. HPE OneView Global Dashboard - After Upgrade or Install of OVGD Version 1.9, Appliance Firewall May Leave Ports Open. This is resolved in OVGD 1.91 or later.
- Product
- Oneview Global Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 26, 2020The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufCVE-2019-19134 · WordPress plugins & themes · reported by MITREMedium 6.1
The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based tokens or to launch other attacks.
- Fixed in
- 2.2.3
- What to do
- Update the plugin to 2.2.3 or newer.
Full record and what to do →NVD recordheroplugins.comheroplugins.com
Feb 22, 2020fauzantrif eLection 2.0 has XSS via the Admin Dashboard -> Settings -> Election -> "message if election is closed" field.CVE-2020-9336 · Other software · Fauzantrif Election Project · reported by MITREMedium 5.4
fauzantrif eLection 2.0 has XSS via the Admin Dashboard -> Settings -> Election -> "message if election is closed" field.
- Product
- Fauzantrif Election
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2020Western Digital WesternDigitalSSDDashboardSetup.exe before 3.0.2.0 allows DLL Hijacking.CVE-2020-8959 · Other software · Westerndigital · reported by MITREHigh 7.8
Western Digital WesternDigitalSSDDashboardSetup.exe before 3.0.2.0 allows DLL Hijacking.
- Product
- Sandiskssddashboardsetup.exe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.wdc.comwesterndigital.com
Feb 14, 2020In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard.CVE-2019-13966 · Other software · Combodo · reported by MITREMedium 6.1
In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard. This is similar to CVE-2015-6544 (which is only about the dashboard title).
- Product
- Itop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2020index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.CVE-2020-8825 · Other software · Vanillaforums · reported by MITREMedium 5.4
index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 27, 2020An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vCVE-2019-5470 · Websites & servers · GitLab · reported by support@hackerone.comHigh 7.5
An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vulnerability feedback information.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comgitlab.com
Jan 7, 2020Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.CVE-2020-5843 · Other software · Codologic · reported by MITREMedium 4.8
Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodologic.comvyshnavvizz.blogspot.com
Jan 5, 2020Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen.CVE-2020-5305 · Other software · Codologic · reported by MITREMedium 4.8
Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodologic.comvyshnavvizz.blogspot.com
Dec 30, 2019Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin passwordCVE-2012-5476 · Other software · openstack-dashboard · reported by Red HatMedium 5.5
Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin password and token value.
- Product
- openstack-dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Dec 30, 2019The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) isCVE-2012-5474 · Other software · python-django-horizon · reported by Red HatMedium 5.5
The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) is world readable and exposes the secret key value.
- Product
- python-django-horizon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgaccess.redhat.com
Nov 11, 2019WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.CVE-2019-18881 · Other software · Wso2 · reported by MITREMedium 6.1
WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.
- Product
- Identity Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.wso2.comdocs.wso2.com
Oct 9, 2019An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4.CVE-2019-17382 · Other software · Zabbix · reported by MITRECritical 9.1
An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgexploit-db.com
Oct 8, 2019It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.CVE-2019-10756 · Other software · Nodered · reported by report@snyk.ioMedium 5.4
It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.
- Product
- Node-red-dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2019includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated storCVE-2019-17239 · WordPress plugins & themes · reported by MITREMedium 6.1
includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues.
- Product
- includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Sep 30, 2019Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle CVE-2019-13467 · Other software · Sandisk · reported by MITREMedium 5.9
Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute downloaded resources with arbitrary files.
- Product
- SSD Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.wdc.comwesterndigital.com
Sep 30, 2019Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control.CVE-2019-13466 · Other software · Sandisk · reported by MITREHigh 7.5
Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” archive is protected with a hard-coded password. An application update that addresses the protection of archive encryption is available.
- Product
- SSD Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.wdc.comwesterndigital.com
Sep 20, 2019The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.CVE-2015-9399 · WordPress plugins & themes · reported by MITREHigh 7.2
The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.
- Product
- wp-stats-dashboard
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update wp-stats-dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2019Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able toCVE-2019-10396 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able to change build descriptions.
- Product
- Jenkins Dashboard View Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Sep 11, 2019WordPress before 5.2.3 allows reflected XSS in the dashboard.CVE-2019-16221 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.3 allows reflected XSS in the dashboard.
- Fixed in
- 5.2.3
- What to do
- Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD recordlists.debian.orgseclists.org
Aug 26, 2019Status Board 1.1.81 has reflected XSS via dashboard.ts.CVE-2019-15479 · Other software · Status Board Project · reported by MITREMedium 6.1
Status Board 1.1.81 has reflected XSS via dashboard.ts.
- Product
- Status Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.