Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,145 results · page 17 of 23
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21692 · Other software · onionshare · reported by GitHubMedium 4.3
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions anyone with access to the chat environment can write messages disguised as another chat participant.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21690 · Other software · onionshare · reported by GitHubHigh 8.7
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions The path parameter of the requested URL is not sanitized before being passed to the QT frontend. This path is used in all components for displaying the server access history. This leads to a rendered HTML4 Subset (QT RichText editor) in the Onionshare frontend.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21695 · Other software · onionshare · reported by GitHubMedium 4.3
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants. This issue has been resolved in version 2.5.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21693 · Other software · onionshare · reported by GitHubMedium 6.3
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions an adversary with a primitive that allows for filesystem access from the context of the Onionshare process can access sensitive files in the entire user home folder. This could lead to the leaking of sensitive data. Due to the automatic exclusion of hidden folders, the impact is reduced. This can be mitigated by usage of the flatpak release.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21691 · Other software · onionshare · reported by GitHubMedium 4.3
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21689 · Other software · onionshare · reported by GitHubHigh 7.5
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions the receive mode limits concurrent uploads to 100 per second and blocks other uploads in the same second, which can be triggered by a simple script. An adversary with access to the receive mode can block file upload for others. There is no way to block this attack in public mode due to the anonymity properties of the tor network.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21688 · Other software · onionshare · reported by GitHubHigh 7.5
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Affected versions of the desktop application were found to be vulnerable to denial of service via an undisclosed vulnerability in the QT image parsing. Roughly 20 bytes lead to 2GB memory consumption and this can be triggered multiple times. To be abused, this vulnerability requires rendering in the history tab, so some user interaction is required. An adversary with knowledge of the Onion service address in public mode or with authentication in private mode can perform a Denial of Service attack, which quickly results in out-of-memory for the server. This requires the desktop application with rendered history, therefore the impact is only elevated. This issue has been patched in version 2.5.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21696 · Other software · onionshare · reported by GitHubMedium 4.3
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website.CVE-2021-44458 · Other software · Mirantis · reported by psirt@mirantis.comHigh 8.3
Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket connections from the victim's browser to Lens and so operate the local terminal feature. This would allow the attacker to execute arbitrary commands as the Lens user.
- Product
- Lens
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2021The email parameter from ajax.php of Video Sharing Website 1.0 appears to be vulnerable to SQL injection attacks.CVE-2021-45255 · Other software · Video Sharing Website Project · reported by MITRECritical 9.8
The email parameter from ajax.php of Video Sharing Website 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed.
- Product
- Video Sharing Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021Cross Site Request Forgery (CSRF) vulnerability exits in Catfish <=6.1.* when you upload an html file containing CSRF on the website that uses a google editor; CVE-2021-45017 · Other software · Catfish-cms · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) vulnerability exits in Catfish <=6.1.* when you upload an html file containing CSRF on the website that uses a google editor; you can specify the menu url address as your malicious url address in the Add Menu column.
- Product
- Catfish CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing.CVE-2020-18985 · Email & office · Synacor · reported by MITREMedium 6.1
An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPreCVE-2021-36888 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.
- Affected
- up to 9.6.1
- What to do
- Affects up to 9.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Dec 8, 2021WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with theCVE-2021-43540 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension. This vulnerability affects Firefox < 95.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
Dec 7, 2021Admidio is a free open source user management system for websites of organizations and groups.CVE-2021-43810 · Other software · Admidio · reported by GitHubHigh 8.8
Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021Elementor Website Builder: Does not sanitise or escape user input appended to the DOM via a malicious hashCVE-2021-24891 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue.
- Product
- Elementor Website Builder
- Fixed in
- 3.4.8
- What to do
- Update Elementor Website Builder to 3.4.8 or newer.
Full record and what to do →NVD recordwpscan.comjbelamor.com
Nov 10, 2021The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exCVE-2021-33816 · Other software · Dolibarr · reported by MITRECritical 9.8
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgtrovent.github.io
Nov 2, 2021heap buffer overflow in WebRTC in Google Chrome prior to 94.0.4606.81 allowed a remote attacker who convinced a user to browse to a malicious website to potentiCVE-2021-37979 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
heap buffer overflow in WebRTC in Google Chrome prior to 94.0.4606.81 allowed a remote attacker who convinced a user to browse to a malicious website to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Oct 19, 2021InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 website used to control the router is vulnerable to stored cross-site scripting, which may aCVE-2021-38482 · Other software · InHand Networks · reported by ics-cert@hq.dhs.govHigh 8.7
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 website used to control the router is vulnerable to stored cross-site scripting, which may allow an attacker to hijack sessions of users connected to the system.
- Product
- IR615 Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 14, 2021Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html file on the websiteCVE-2021-42227 · Other software · Kindsoft · reported by MITREMedium 6.1
Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html file on the website that uses this editor (the file suffix is allowed).
- Product
- Kindeditor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2021A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // follCVE-2021-22963 · Other software · Fastify · reported by support@hackerone.comMedium 6.1
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.The issue shows up on all the fastify-static applications that set redirect: true option. By default, it is false.
- Product
- Fastify-static
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Oct 8, 2021Use after free in Selection API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who convinced the user the visit a malicious website to potentiCVE-2021-30625 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Selection API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who convinced the user the visit a malicious website to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Oct 5, 2021A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted website.CVE-2021-33849 · Email & office · Zoho · reported by disclose@cybersecurityworks.comMedium 5.4
A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted website. The attack targets your application's users and not the application itself while using your application as the attack's vehicle. The XSS payload executes whenever the user changes the form values or deletes a created form in Zoho CRM Lead Magnet Version 1.7.2.4.
- Product
- Zoho CRM Lead Magnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybersecurityworks.comcybersecurityworks.com
Oct 4, 2021The IceHrm 30.0.0 OS website was found vulnerable to Session Management Issue.CVE-2021-38823 · Other software · Icehrm · reported by MITRECritical 9.8
The IceHrm 30.0.0 OS website was found vulnerable to Session Management Issue. A signout from an admin account does not invalidate an admin session that is opened in a different browser.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnavidkagalwalla.comnavidkagalwalla.com
Sep 27, 2021There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0.CVE-2021-37270 · Other software · S-cms · reported by MITRECritical 9.8
There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. Attackers can use this vulnerability to directly access the specified background path without logging in to the background to obtain the background administrator authority.
- Product
- CMS Enterprise Website Construction System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2021Custom Website Data: Reflected Cross-Site ScriptingCVE-2021-38347 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in the ~/views/edit.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.
- Product
- Custom Website Data
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Custom Website Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62CVE-2021-35976 · Websites & servers · Plesk · reported by MITREMedium 6.1
The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. The attacker could execute JavaScript code in the victim's browser by using the link to preview sites hosted on the server. Authentication is not required to exploit the vulnerability.
- Product
- Obsidian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.plesk.comtarekbouali.com
Sep 6, 2021JiangQie Official Website Mini Program: Does not escape or validate the id GET parameter before using it in SQL statementsCVE-2021-24303 · WordPress plugins & themes · reported by WPScanHigh 8.8
The JiangQie Official Website Mini Program WordPress plugin before 1.1.1 does not escape or validate the id GET parameter before using it in SQL statements, leading to SQL injection issues
- Product
- JiangQie Official Website Mini Program
- Fixed in
- 1.1.1
- What to do
- Update JiangQie Official Website Mini Program to 1.1.1 or newer.
Sep 1, 2021User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.CVE-2021-35238 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 4.8
User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.
- Product
- Orion Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsupport.solarwinds.com
Aug 26, 2021Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a malicious website to potentially exploit heCVE-2021-30602 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a malicious website to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Aug 26, 2021Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name CVE-2020-18468 · Other software · Qdpm · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name by doing an authenticated POST HTTP request to /qdPM_9.1/index.php/configuration.
- Product
- Qdpm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2021Cross Site Scripting (XSS) vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website naCVE-2020-18467 · Other software · Bigtreecms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website name by doing an authenticated POST HTTP request to admin/tags/create.
- Product
- Bigtree CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021Cross-site scripting vulnerability in Website Management screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 aCVE-2021-20810 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Website Management screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021Next.js is an open source website development framework to be used with the React library.CVE-2021-37699 · Other software · vercel · reported by GitHubMedium 6.9
Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain. We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. The issue has been patched in release 11.1.0.
- Product
- next.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021Contao is an open source CMS that allows creation of websites and scalable web applications.CVE-2021-37627 · Other software · contao · reported by GitHubHigh 8
Contao is an open source CMS that allows creation of websites and scalable web applications. In affected versions it is possible to gain privileged rights in the Contao back end. Installations are only affected if they have untrusted back end users who have access to the form generator. All users are advised to update to Contao 4.4.56, 4.9.18 or 4.11.7. As a workaround users may disable the form generator or disable the login for untrusted back end users.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021Contao is an open source CMS that allows you to create websites and scalable web applications.CVE-2021-37626 · Other software · contao · reported by GitHubHigh 7.2
Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they have untrusted back end users who have the rights to modify fields that are shown in the front end. Update to Contao 4.4.56, 4.9.18 or 4.11.7 to resolve. If you cannot update then disable the login for untrusted back end users.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021GetSimpleCMS 3.3.16 contains a cross-site Scripting (XSS) vulnerability, where Function TSL does not filter check settings.php Website URL: "siteURL" parameter.CVE-2021-36601 · Other software · Get-simple · reported by MITREMedium 6.1
GetSimpleCMS 3.3.16 contains a cross-site Scripting (XSS) vulnerability, where Function TSL does not filter check settings.php Website URL: "siteURL" parameter.
- Product
- Getsimplecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component.CVE-2021-33707 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity.
- Product
- SAP NetWeaver (Knowledge Management)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 5, 2021Password autofill was enabled without user interaction on insecure websites on Firefox for Android.CVE-2021-29973 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected to require user interaction with the page before a user's password would be entered by the browser's autofill functionality *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 90.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jul 15, 2021Gatsby is a framework for building websites.CVE-2021-32770 · WordPress plugins & themes · reported by GitHubHigh 7.5
Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected. A patch has been introduced in gatsby-source-wordpress@4.0.8 and gatsby-source-wordpress@5.9.2 which mitigates the issue by filtering all variables specified in the `auth: { }` section. Users that depend on this functionality are advised to upgrade to the latest release of gatsby-source-wordpress, run `gatsby clean` followed by a `gatsby build`. One may manually edit the app.js file post-build as a workaround.
- What to do
- Update the plugin to the newest version.
Jul 14, 2021SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.CVE-2020-18155 · Other software · Intelliants · reported by MITRECritical 9.8
SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.
- Product
- Subrion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2021The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites viCVE-2020-23182 · Websites & servers · Php-fusion · reported by MITREMedium 5.4
The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload entered into the Shoutbox message panel.
- Product
- Php-fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently actCVE-2021-29965 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 24, 2021Firefox for Android would become unstable and hard-to-recover when a website opened too many popups.CVE-2021-29962 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 24, 2021When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from re-enabling it withCVE-2021-29959 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from re-enabling it without an additional prompt. This was only possible if the website kept recording with the microphone until re-enabling the camera. This vulnerability affects Firefox < 89.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
Jun 16, 2021In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for non-website resource tCVE-2021-31857 · Email & office · Zohocorp · reported by MITREMedium 5.9
In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for non-website resource types.
- Product
- Manageengine Password Manager Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jun 1, 2021WP Prayer: Provides the functionality to store requested prayers/praises and list them on a WordPress websiteCVE-2021-24313 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress website. These stored prayer/praise requests can be listed by using the WP Prayer engine. An authenticated WordPress user with any role can fill in the form to request a prayer. The form to request prayers or praises have several fields. The 'prayer request' and 'praise request' fields do not use proper input validation and can be used to store XSS payloads.
- Product
- WP Prayer
- Fixed in
- 1.6.2
- What to do
- Update WP Prayer to 1.6.2 or newer.
Full record and what to do →NVD recordbastijnouwendijk.comwpscan.com
May 20, 2021Admidio is a free, open source user management system for websites of organizations and groups.CVE-2021-32630 · Other software · Admidio · reported by GitHubCritical 9.6
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenticated RCE via .phar file upload. A php web shell can be uploaded via the Documents & Files upload feature. Someone with upload permissions could rename the php shell with a .phar extension, visit the file, triggering the payload for a reverse/bind shell. This can be mitigated by excluding a .phar file extension to be uploaded (like you did with .php .phtml .php5 etc). The vulnerability is patched in version 4.0.4.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2021Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Website SEO Keywords" field on thCVE-2020-18165 · Other software · Laobancms · reported by MITREMedium 4.8
Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Website SEO Keywords" field on the page "admin/info.php?shuyu".
- Product
- Laobancms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2021Cross Site Request Forgery (CSRF) Vulnerability in ForestBlog latest version via the website Management background, which could let a remote malicious gain privCVE-2020-18964 · Other software · Forestblog Project · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) Vulnerability in ForestBlog latest version via the website Management background, which could let a remote malicious gain privileges.
- Product
- Forestblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.