Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,443 results · page 18 of 29

Jan 2, 2020FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default.CVE-2014-6275 · Other software · Red Hat · reported by security@debian.orgMedium 5.9
FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project webpages are hosted on the same server than FusionForge, it can allow users to incorrectly access on-disk private data in FusionForge.
Product
FusionForge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fusionforge.org security-tracker.debian.org
Dec 31, 2019FiberHome an5506-04-f RP2669 devices have XSS.CVE-2019-9556 · Other software · Fiberhomegroup · reported by MITREMedium 5.4
FiberHome an5506-04-f RP2669 devices have XSS.
Product
An5506-04-f Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 30, 2019IBM Watson Studio Local 1.2.3 stores key files in the user's home directory which could be obtained by another local user.CVE-2019-4335 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM Watson Studio Local 1.2.3 stores key files in the user's home directory which could be obtained by another local user. IBM X-Force ID: 161413.
Product
Watson Studio Local
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Dec 26, 2019The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.CVE-2019-19540 · WordPress plugins & themes · reported by MITREMedium 6.1
The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.
Product
ListingPro
Fixed in
2.0.14.2
What to do
Update ListingPro to 2.0.14.2 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Dec 18, 2019Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an informatiCVE-2019-19724 · Other software · Sylabs · reported by MITREHigh 7.5
Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services.
Product
Singularity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Dec 18, 2019Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited via a DLL Hijack related to a vulnerability on the packer that the prograCVE-2019-19689 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.8
Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited via a DLL Hijack related to a vulnerability on the packer that the program uses.
Product
Trend Micro HouseCall for Home Networks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpcenter.trendmicro.com helpcenter.trendmicro.com
Dec 18, 2019A privilege escalation vulnerability in Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited allowing an attacker to place a mCVE-2019-19688 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.8
A privilege escalation vulnerability in Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited allowing an attacker to place a malicious DLL file into the application directory and elevate privileges.
Product
Trend Micro HouseCall for Home Networks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpcenter.trendmicro.com helpcenter.trendmicro.com
Dec 17, 2019CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx, aCVE-2019-15235 · Other software · Control-webpanel · reported by MITREMedium 6.5
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to gain access to the victim's password (for the OS and phpMyAdmin) via an attacker account. This is different from CVE-2019-14782.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record centos-webpanel.com packetstormsecurity.com
Nov 29, 2019Some Huawei home routers have an input validation vulnerability.CVE-2019-5268 · Other software · Huawei · reported by psirt@huawei.comHigh 8.1
Some Huawei home routers have an input validation vulnerability. Due to input parameter is not correctly verified, an attacker can exploit this vulnerability by sending special constructed packets to obtain files in the device and upload files to some directories.
Product
Cd10-10 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huawei.com huawei.com
Nov 29, 2019Some Huawei home routers have an improper authorization vulnerability.CVE-2019-5269 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
Some Huawei home routers have an improper authorization vulnerability. Due to improper authorization of certain programs, an attacker can exploit this vulnerability to execute uploaded malicious files and escalate privilege.
Product
Cd10-10 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huawei.com huawei.com
Nov 25, 2019libuser has information disclosure when moving user's home directoryCVE-2012-5644 · Other software · libuser · reported by Red HatMedium 5.5
libuser has information disclosure when moving user's home directory
Product
libuser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org access.redhat.com
Nov 14, 2019eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code Execution by unauthenticated attackers with accessCVE-2019-18939 · Other software · Hm-print Project · reported by MITRECritical 9.8
eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi and exec1.cgi scripts, which execute TCL script content from an HTTP POST request.
Product
Hm-print
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psytester.github.io psytester.github.io
Nov 14, 2019eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated attackers with accesCVE-2019-18938 · Other software · HM Email Project · reported by MITRECritical 9.8
eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the save.cgi script for payload upload and the testtcl.cgi script for its execution.
Product
HM Email
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psytester.github.io psytester.github.io
Nov 14, 2019eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote Code Execution by unauthenticated attackers with acCVE-2019-18937 · Other software · Scriptparser Project · reported by MITRECritical 9.8
eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi script, which executes TCL script content from an HTTP POST request.
Product
Scriptparser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psytester.github.io psytester.github.io
Oct 24, 2019PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directoryCVE-2019-18393 · Other software · Igniterealtime · reported by MITREMedium 5.3
PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.
Product
Openfire
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com swarm.ptsecurity.com
Oct 17, 2019eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method.CVE-2019-15850 · Other software · Eq-3 · reported by MITREHigh 8.8
eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method. An authenticated attacker can easily execute code and compromise the system.
Product
Homematic Ccu3 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record noskill1337.github.io eq-3.com
Oct 17, 2019eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation.CVE-2019-15849 · Other software · Eq-3 · reported by MITREHigh 7.3
eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs and send them to the victim. After the victim logs in to the session, the attacker can use that session. The attacker could create SSH logins after a valid session and easily compromise the system.
Product
Homematic Ccu3 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record noskill1337.github.io eq-3.com
Oct 17, 2019A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers tCVE-2019-14424 · Other software · Eq-3 · reported by MITREMedium 6.5
A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to read sensitive files via a simple HTTP Request.
Product
Cux-daemon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record noskill1337.github.io eq-3.com
Oct 17, 2019A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers CVE-2019-14423 · Other software · Eq-3 · reported by MITREHigh 8.8
A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to execute system commands as root remotely via a simple HTTP request.
Product
Cux-daemon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record noskill1337.github.io eq-3.com
Oct 16, 2019The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy (BLE) traffic during one authorized unCVE-2019-17627 · Other software · Yalehome · reported by MITREMedium 6.5
The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy (BLE) traffic during one authorized unlock action, and then calculating the authentication key via simple computations on the hex digits of a valid authentication request. This affects the Yale ZEN-R lock and unspecified other locks.
Product
Yale Bluetooth KEY
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 15, 2019Glue Smart Lock 2.7.8 devices do not properly block guest access in certain situations where the network connection is unavailable.CVE-2019-12944 · Other software · Gluehome · reported by MITREHigh 7.5
Glue Smart Lock 2.7.8 devices do not properly block guest access in certain situations where the network connection is unavailable.
Product
Glue Smart Lock Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kth.se kth.se
Oct 8, 2019/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication remote code execution.CVE-2019-17186 · Other software · Fiberhome · reported by MITREHigh 8.8
/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication remote code execution.
Product
Hg2201t Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Oct 8, 2019/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication Directory Traversal for reading arbitrary fileCVE-2019-17187 · Other software · Fiberhome · reported by MITREHigh 7.5
/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication Directory Traversal for reading arbitrary files.
Product
Hg2201t Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 23, 2019Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via componCVE-2018-21019 · Other software · Home-assistant · reported by MITREHigh 7.5
Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py.
Product
Home-assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 20, 2019App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring.CVE-2019-16644 · Other software · Tuzicms · reported by MITRECritical 9.8
App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring.
Product
Tuzicms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 17, 2019eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via an HTTPCVE-2019-16199 · Other software · Eq-3 · reported by MITRECritical 9.8
eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via an HTTP POST request to certain URLs related to the ReGa core process.
Product
Homematic Ccu2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psytester.github.io psytester.github.io
Sep 17, 2019A CWE-287: Authentication vulnerability exists in spaceLYnk (all versions before 2.4.0) and Wiser for KNX (all versions before 2.4.0 - formerly known as homeLYnCVE-2019-6832 · Other software · Schneider Electric SE · reported by cybersecurity@se.comHigh 8.3
A CWE-287: Authentication vulnerability exists in spaceLYnk (all versions before 2.4.0) and Wiser for KNX (all versions before 2.4.0 - formerly known as homeLYnk), which could cause loss of control when an attacker bypasses the authentication.
Product
spaceLYnk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record schneider-electric.com schneider-electric.com
Sep 13, 2019The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST CVE-2010-5333 · Other software · Integard Home Project · reported by MITRECritical 9.8
The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST request, leading to arbitrary code execution. An SEH-overwrite buffer overflow already existed for the vulnerable software. This CVE is to track an alternate exploitation method, utilizing an EIP-overwrite buffer overflow.
Product
Integard Home
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 12, 2019Cross-site request forgery (CSRF) vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONECVE-2019-5986 · Other software · Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier, PR-S300HI/RT-S300HI/RV-S340HI firmware version Ver.19.01.0005 and earlier, PR-S300SE/RT-S300SE/RV-S340SE firmware version Ver.19.40 and earlier, PR-400NE/RT-400NE/RV-440NE firmware version Ver.7.42 and earlier, PR-400KI/RT-400KI/RV-440KI firmware version Ver.07.00.1010 and earlier, PR-400MI/RT-400MI/RV-440MI firmware version Ver. 07.00.1012 and earlier, PR-500KI/RT-500KI firmware version Ver.01.00.0090 and earlier, RS-500KI firmware version Ver.01.00.0070 and earlier, PR-500MI/RT-500MI firmware version Ver.01.01.0014 and earlier, and RS-500MI firmware version Ver.03.01.0019 and earlier, and Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier, PR-S300HI/RT-S300HI/RV-S340HI firmware version Ver.19.01.0005 and earlier, PR-S300SE/RT-S300SE/RV-S340SE firmware version Ver.19.40 and earlier, PR-400NE/RT-400NE/RV-440NE firmware version
Product
Hikari Denwa router/Home GateWay
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp ntt-west.co.jp
Sep 12, 2019Cross-site scripting vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORACVE-2019-5985 · Other software · Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier, PR-S300HI/RT-S300HI/RV-S340HI firmware version Ver.19.01.0005 and earlier, PR-S300SE/RT-S300SE/RV-S340SE firmware version Ver.19.40 and earlier, PR-400NE/RT-400NE/RV-440NE firmware version Ver.7.42 and earlier, PR-400KI/RT-400KI/RV-440KI firmware version Ver.07.00.1010 and earlier, PR-400MI/RT-400MI/RV-440MI firmware version Ver. 07.00.1012 and earlier, PR-500KI/RT-500KI firmware version Ver.01.00.0090 and earlier, RS-500KI firmware version Ver.01.00.0070 and earlier, PR-500MI/RT-500MI firmware version Ver.01.01.0014 and earlier, and RS-500MI firmware version Ver.03.01.0019 and earlier, and Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier, PR-S300HI/RT-S300HI/RV-S340HI firmware version Ver.19.01.0005 and earlier, PR-S300SE/RT-S300SE/RV-S340SE firmware version Ver.19.40 and earlier, PR-400NE/RT-400NE/RV-440NE firmware version Ver.7.42 and
Product
Hikari Denwa router/Home GateWay
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp ntt-west.co.jp
Sep 8, 2019YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.CVE-2019-16130 · Other software · Hgw168cc · reported by MITREMedium 6.1
YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.
Product
Yii-cms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record iwantacve.cn github.com
Aug 29, 2019The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app.CVE-2019-15745 · Other software · Equeshome · reported by MITREHigh 8.8
The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. The communication happens over UDP port 27431. An attacker on the local network can use the same key to encrypt and send commands to discover all smart plugs in a network, take over control of a device, and perform actions such as turning it on and off.
Product
ELF Smart Plug Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com ckn.io
Aug 28, 2019A broken access control vulnerability in SmartHome app (Android versions up to 3.0.42_190515, ios versions up to 2.0.22) allows an attacker in the same local arCVE-2019-11063 · Network & remote access · ASUS · reported by twcert@cert.org.twCritical 10
A broken access control vulnerability in SmartHome app (Android versions up to 3.0.42_190515, ios versions up to 2.0.22) allows an attacker in the same local area network to list user accounts and control IoT devices that connect with its gateway (HG100) via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 (Confidentiality, Integrity and Availability impacts). CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Product
SmartHome Android app
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record surl.twcert.org.tw github.com
Aug 26, 2019GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "homepage title" parameter, aka the adm/config_formCVE-2018-18668 · Other software · SIR · reported by MITREMedium 6.1
GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "homepage title" parameter, aka the adm/config_form_update.php cf_title parameter.
Product
Gnuboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 23, 2019cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injectionCVE-2019-15498 · Other software · Getvera · reported by MITREHigh 8.8
cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh.
Product
Vera Edge Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record distributedcompute.com distributedcompute.com
Aug 14, 2019eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.***Metadata related operations, resulting in tCVE-2019-9585 · Other software · Eq-3 · reported by MITRECritical 9.8
eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.***Metadata related operations, resulting in the ability to read, set and deletion of Metadata.
Product
Homematic Ccu2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com psytester.github.io
Aug 14, 2019eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting down the VCVE-2019-9584 · Other software · Eq-3 · reported by MITRECritical 9.8
eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting down the VPN service and to delete the VPN service configuration. This is related to improper access control for all /addons/mh/ pages.
Product
Homematic Ccu2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com psytester.github.io
Aug 14, 2019eQ-3 Homematic CCU3 AddOn 'Mediola NEO Server for Homematic CCU3' prior to 2.4.5 allows uncontrolled admin access to start or stop the Node.js process, resultinCVE-2019-13030 · Other software · Mediola · reported by MITREHigh 8.2
eQ-3 Homematic CCU3 AddOn 'Mediola NEO Server for Homematic CCU3' prior to 2.4.5 allows uncontrolled admin access to start or stop the Node.js process, resulting in the ability to obtain mediola configuration details. This is related to improper access control for addons configuration pages and a missing check in rc.d/97NeoServer.
Product
NEO Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com psytester.github.io
Aug 14, 2019eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login.CVE-2019-9583 · Other software · Eq-3 · reported by MITREHigh 8.2
eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login. This allows a Denial of Service and is a starting point for other attacks. Affected versions for CCU2: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15. Affected versions for CCU3: 3.41.11, 3.43.16, 3.45.5, 3.45.7, 3.47.10, 3.47.15.
Product
Homematic Ccu3 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com psytester.github.io
Aug 14, 2019eQ-3 Homematic CCU2 outdated base software packages allows Denial of Service.CVE-2019-9582 · Other software · Eq-3 · reported by MITREHigh 7.5
eQ-3 Homematic CCU2 outdated base software packages allows Denial of Service. CCU2 affected versions: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15.
Product
Homematic Ccu2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com psytester.github.io
Aug 13, 2019eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web inteCVE-2019-14986 · Other software · Eq-3 · reported by MITREHigh 8.1
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command (as well as "Set root password") are exposed.
Product
Homematic Ccu2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psytester.github.io psytester.github.io
Aug 13, 2019eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because thCVE-2019-14985 · Other software · Eq-3 · reported by MITRECritical 9.8
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because this interface can access the CMD_EXEC virtual device type 28.
Product
Homematic Ccu2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psytester.github.io psytester.github.io
Aug 13, 2019eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web inteCVE-2019-14984 · Other software · Eq-3 · reported by MITREHigh 8.1
eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because the undocumented addons/xmlapi/exec.cgi script uses CMD_EXEC to execute TCL code from a POST request.
Product
Homematic Ccu2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psytester.github.io psytester.github.io
Aug 7, 2019eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic process, resulting in the ability to start a Denial CVE-2019-14474 · Other software · Eq-3 · reported by MITREHigh 7.5
eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic process, resulting in the ability to start a Denial of Service. Due to Improper Authorization an attacker can obtain a session ID from CVE-2019-9583 or a valid guest/user/admin account can start this attack too.
Product
Ccu3 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psytester.github.io psytester.github.io
Aug 6, 2019eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks.CVE-2019-14473 · Other software · Eq-3 · reported by MITREHigh 8.8
eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can create a new admin level account, read the service messages, clear the system protocol or modify/delete internal programs, etc. pp.
Product
Ccu2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psytester.github.io psytester.github.io
Aug 6, 2019cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination (SEC-174).CVE-2016-10776 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination (SEC-174).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks.CVE-2019-14475 · Other software · Eq-3 · reported by MITREHigh 7.5
eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID from CVE-2019-9583, resulting in the ability to read the service messages, clear the system protocol, create a new user in the system, or modify/delete internal programs.
Product
Ccu2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psytester.github.io psytester.github.io
Aug 2, 2019In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).CVE-2017-18413 · Websites & servers · Cpanel · reported by MITREHigh 7.8
In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).CVE-2017-18383 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Jul 22, 2019The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutable but are actually CVE-2019-13097 · Other software · CAT Runner\ · reported by MITREHigh 7.5
The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. Attackers can manipulate users' score parameters exchanged between client and server.
Product
Decorate Home Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pastebin.com youtube.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.