Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
887 results · page 18 of 18
Apr 15, 2016An HTTP servlet in vApp Manager in EMC Unisphere for VMAX Virtual Appliance before 8.2.0 allows remote attackers to write to arbitrary files via a crafted pathnCVE-2016-0889 · Other software · Dell · reported by security_alert@emc.comCritical 9.8
An HTTP servlet in vApp Manager in EMC Unisphere for VMAX Virtual Appliance before 8.2.0 allows remote attackers to write to arbitrary files via a crafted pathname.
- Product
- EMC Unisphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecuritytracker.com
Dec 11, 2015IDE SCM in Apple Xcode before 7.2 does not recognize .gitignore files, which allows remote attackers to obtain sensitive information in opportunistic circumstanCVE-2015-7056 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5
IDE SCM in Apple Xcode before 7.2 does not recognize .gitignore files, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging the presence of a file matching an ignore pattern.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comsecuritytracker.com
Dec 9, 2015Integer underflow in Uniscribe in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows remote attackers to execute arbitrary code via a crafted font, aCVE-2015-6130 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 9.3
Integer underflow in Uniscribe in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows remote attackers to execute arbitrary code via a crafted font, aka "Windows Integer Underflow Vulnerability."
- Product
- Windows 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.flexerasoftware.comsecuritytracker.com
Aug 4, 2015GE Healthcare Precision THUNIS-800+ has a default password of (1) 1973 for the factory default System Utilities menu, (2) TH8740 for installation using TH8740_1CVE-2014-7233 · Other software · Gehealthcare · reported by MITREHigh 10
GE Healthcare Precision THUNIS-800+ has a default password of (1) 1973 for the factory default System Utilities menu, (2) TH8740 for installation using TH8740_122_Setup.exe, (3) hrml for "Setup and Activation" using DSASetup, and (4) an empty string for Shutter Configuration, which has unspecified impact and attack vectors. NOTE: since these passwords appear to be used to access functionality during installation, this issue might not cross privilege boundaries and might not be a vulnerability.
- Product
- Precision Thunis-800+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapps.gehealthcare.comforbes.com
Jun 29, 2015EMC Unisphere for VMAX 8.x before 8.0.3.4 sets up the Java Debugging Wire Protocol (JDWP) service, which allows remote attackers to execute arbitrary code via uCVE-2015-0545 · Other software · EMC · reported by security_alert@emc.comHigh 10
EMC Unisphere for VMAX 8.x before 8.0.3.4 sets up the Java Debugging Wire Protocol (JDWP) service, which allows remote attackers to execute arbitrary code via unspecified vectors.
- Product
- Unisphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecuritytracker.com
Feb 1, 2015Open redirect vulnerability in EMC Unisphere Central before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks viCVE-2015-0512 · Other software · EMC · reported by security_alert@emc.comMedium 5.8
Open redirect vulnerability in EMC Unisphere Central before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter.
- Product
- Unisphere Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Jul 7, 2014Active Cloud Engine (ACE) in IBM Storwize V7000 Unified 1.3.0.0 through 1.4.3.x allows remote attackers to bypass intended ACL restrictions in opportunistic cirCVE-2014-0875 · Other software · IBM · reported by psirt@us.ibm.comLow 3.5
Active Cloud Engine (ACE) in IBM Storwize V7000 Unified 1.3.0.0 through 1.4.3.x allows remote attackers to bypass intended ACL restrictions in opportunistic circumstances by leveraging incorrect ACL synchronization over an unreliable NFS connection that requires retransmissions.
- Product
- Storwize Unified V7000 Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Jun 22, 2014cups-browsed in cups-filters before 1.0.53 allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging a malformCVE-2014-4338 · Computers, phones & browsers · Linuxfoundation · reported by Red HatMedium 4
cups-browsed in cups-filters before 1.0.53 allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging a malformed cups-browsed.conf BrowseAllow directive that is interpreted as granting browse access to all IP addresses.
- Product
- Cups-filters
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jun 11, 2014usp10.dll in Uniscribe (aka the Unicode Script Processor) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7CVE-2014-1817 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 9.3
usp10.dll in Uniscribe (aka the Unicode Script Processor) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP1 and SP2, Live Meeting 2007 Console, Lync 2010 and 2013, Lync 2010 Attendee, and Lync Basic 2013 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted EMF+ record in a font file, aka "Unicode Scripts Processor Vulnerability."
- Product
- Windows 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.technet.comsecunia.com
Apr 24, 2014Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified CVE-2012-3946 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.
- Product
- IOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2013IBM InfoSphere Information Server 8.0, 8.1, 8.5, 8.7, and 9.1 allows local users to obtain sensitive information in opportunistic circumstances by leveraging thCVE-2013-5440 · Other software · IBM · reported by psirt@us.ibm.comLow 2.1
IBM InfoSphere Information Server 8.0, 8.1, 8.5, 8.7, and 9.1 allows local users to obtain sensitive information in opportunistic circumstances by leveraging the presence of file content after a failed installation.
- Product
- Infosphere Information Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww-01.ibm.comwww-01.ibm.com
Nov 2, 2013EMC Unisphere for VMAX before 1.6.1.6, when using an unspecified level of debug logging in LDAP configurations, allows local users to discover the cleartext LDACVE-2013-3287 · Other software · Dell · reported by security_alert@emc.comLow 1.9
EMC Unisphere for VMAX before 1.6.1.6, when using an unspecified level of debug logging in LDAP configurations, allows local users to discover the cleartext LDAP bind password by reading the console.
- Product
- EMC Unisphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Aug 15, 2013Cybozu Mailwise 5.0.4 and 5.0.5 allows remote authenticated users to obtain sensitive e-mail content intended for different persons in opportunistic circumstancCVE-2013-4698 · Other software · Cybozu · reported by vultures@jpcert.or.jpLow 3.5
Cybozu Mailwise 5.0.4 and 5.0.5 allows remote authenticated users to obtain sensitive e-mail content intended for different persons in opportunistic circumstances by reading Subject header lines within the user's own mailbox.
- Product
- Mailwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2013Buffer overflow in the atodn function in strongSwan 2.0.0 through 4.3.4, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote atCVE-2013-2054 · Other software · Strongswan · reported by Red HatMedium 5.1
Buffer overflow in the atodn function in strongSwan 2.0.0 through 4.3.4, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this might be the same vulnerability as CVE-2013-2053 and CVE-2013-2054.
- Product
- Strongswan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.strongswan.orgsecurityfocus.com
Jul 9, 2013Buffer overflow in the atodn function in Openswan before 2.6.39, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers CVE-2013-2053 · Other software · Xelerance · reported by Red HatMedium 6.8
Buffer overflow in the atodn function in Openswan before 2.6.39, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this might be the same vulnerability as CVE-2013-2052 and CVE-2013-2054.
- Product
- Openswan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgrhn.redhat.com
Jul 9, 2013Buffer overflow in the atodn function in libreswan 3.0 and 3.1, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers tCVE-2013-2052 · Other software · Libreswan · reported by Red HatMedium 5.1
Buffer overflow in the atodn function in libreswan 3.0 and 3.1, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this might be the same vulnerability as CVE-2013-2053 and CVE-2013-2054.
- Product
- Libreswan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlibreswan.orglists.libreswan.org
Mar 22, 2013OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances byCVE-2013-0335 · Other software · Red Hat · reported by Red HatHigh 7.6
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port.
- Product
- OpenStack Folsom for RHEL 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.comsecunia.com
Sep 14, 2012ISC DHCP 4.1.x before 4.1-ESV-R7 and 4.2.x before 4.2.4-P2 allows remote attackers to cause a denial of service (daemon crash) in opportunistic circumstances byCVE-2012-3955 · Other software · ISC · reported by MITREHigh 7.1
ISC DHCP 4.1.x before 4.1-ESV-R7 and 4.2.x before 4.2.4-P2 allows remote attackers to cause a denial of service (daemon crash) in opportunistic circumstances by establishing an IPv6 lease in an environment where the lease expiration time is later reduced.
- Product
- Dhcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Sep 4, 2012Cross-site scripting (XSS) vulnerability in theme/views_lang_switch.theme.inc in the Views Language Switcher module before 7.x-1.2 for Drupal allows remote attaCVE-2012-2064 · Other software · Mark Theunissen · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in theme/views_lang_switch.theme.inc in the Views Language Switcher module before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter.
- Product
- Views Lang Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrupal.orgdrupalcode.org
Jul 3, 2012Integer signedness error in attach.c in dtach 0.8 allows remote attackers to obtain sensitive information from daemon stack memory in opportunistic circumstanceCVE-2012-3368 · Other software · Redhat · reported by Red HatLow 2.6
Integer signedness error in attach.c in dtach 0.8 allows remote attackers to obtain sensitive information from daemon stack memory in opportunistic circumstances by reading application data after an improper connection-close request, as demonstrated by running an IRC client in dtach.
- Product
- Dtach
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgsourceforge.net
May 2, 2011Integer overflow in conf.c in Tinyproxy before 1.8.3 might allow remote attackers to bypass intended access restrictions in opportunistic circumstances via a TCCVE-2011-1843 · Other software · Banu · reported by MITREMedium 6.8
Integer overflow in conf.c in Tinyproxy before 1.8.3 might allow remote attackers to bypass intended access restrictions in opportunistic circumstances via a TCP connection, related to improper handling of invalid port numbers.
- Product
- Tinyproxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.combanu.com
Sep 15, 2010The Uniscribe (aka new Unicode Script Processor) implementation in USP10.DLL in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and ServerCVE-2010-2738 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 9.3
The Uniscribe (aka new Unicode Script Processor) implementation in USP10.DLL in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2, and Microsoft Office XP SP3, 2003 SP3, and 2007 SP2, does not properly validate tables associated with malformed OpenType fonts, which allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) Office document, aka "Uniscribe Font Parsing Engine Memory Corruption Vulnerability."
- Product
- Windows Server 2003
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.microsoft.comoval.cisecurity.org
Jun 3, 2010SQL injection vulnerability in the My Car (com_mycar) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the pagina parametCVE-2010-2148 · Other software · Unisoft · reported by MITREHigh 7.5
SQL injection vulnerability in the My Car (com_mycar) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the pagina parameter to index.php.
- Product
- COM Mycar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2010Cross-site scripting (XSS) vulnerability in the My Car (com_mycar) component 1.0 for Joomla! allows remote attackers to inject arbitrary web script or HTML via CVE-2010-2147 · Other software · Unisoft · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the My Car (com_mycar) component 1.0 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the modveh parameter to index.php.
- Product
- COM Mycar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2009Stack-based buffer overflow in mnet.exe in Unisys Business Information Server (BIS) 10 and 10.1 on Windows allows remote attackers to execute arbitrary code viaCVE-2009-1628 · Other software · Unisys · reported by MITREHigh 10
Stack-based buffer overflow in mnet.exe in Unisys Business Information Server (BIS) 10 and 10.1 on Windows allows remote attackers to execute arbitrary code via a crafted TCP packet.
- Product
- Business Information Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.support.unisys.comlabs.idefense.com
Mar 31, 2009Nortel UNIStim protocol, as used in Communication Server 1000 and other products, uses predictable sequence numbers, which allows remote attackers to hijack sesCVE-2008-6564 · Other software · Nortel · reported by MITREHigh 7.6
Nortel UNIStim protocol, as used in Communication Server 1000 and other products, uses predictable sequence numbers, which allows remote attackers to hijack sessions via sniffing or brute force attacks.
- Product
- Communication Server 1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2009Multiple unspecified vulnerabilities in the UNIStim File Transfer Protocol (UFTP) processing in IP Client Manager (IPCM) in Nortel Multimedia Communication ServCVE-2008-5872 · Other software · Nortel · reported by MITREHigh 7.8
Multiple unspecified vulnerabilities in the UNIStim File Transfer Protocol (UFTP) processing in IP Client Manager (IPCM) in Nortel Multimedia Communication Server (MSC) 5100 3.0.13 allow remote attackers to cause a denial of service (device outage) via a UFTP message that has a negative block size or other crafted Connection Details values.
- Product
- Multimedia Communication Server 5100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsupport.nortel.com
Nov 7, 2008Nortel Networks UNIStim IP Phone 0604DAS allows remote attackers to cause a denial of service (crash) via a long ping packet ("ping of death").CVE-2008-4999 · Other software · Nortel · reported by MITREHigh 7.8
Nortel Networks UNIStim IP Phone 0604DAS allows remote attackers to cause a denial of service (crash) via a long ping packet ("ping of death"). NOTE: this issue could not be reproduced by a third party, who tested it on 0604DAD. In addition, the original researcher was not able to reliably reproduce the issue.
- Product
- Unistim IP Phone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Dec 14, 2007scponly 4.6 and earlier allows remote authenticated users to bypass intended restrictions and execute code by invoking dangerous subcommands including (1) unisoCVE-2007-6350 · Other software · Scponly · reported by MITREHigh 8.5
scponly 4.6 and earlier allows remote authenticated users to bypass intended restrictions and execute code by invoking dangerous subcommands including (1) unison, (2) rsync, (3) svn, and (4) svnserve, as originally demonstrated by creating a Subversion (SVN) repository with malicious hooks, then using svn to trigger execution of those hooks.
- Product
- Scponly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgbugs.gentoo.org
Oct 23, 2007The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), Mobile Voice ClieCVE-2007-5640 · Other software · Nortel · reported by MITREHigh 7.1
The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), Mobile Voice Client, and other product lines, allow remote attackers to block calls and force re-registration via a resume message to the Signaling Server that has a spoofed source IP address for the phone. NOTE: the attack is more disruptive if a new spoofed resume message is sent after each re-registration.
- Product
- Business Communications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2007The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and other Nortel IP Phone, Mobile Voice Client, and WLAN Handsets products allow remote attackers to causeCVE-2007-5639 · Other software · Nortel · reported by MITREHigh 7.1
The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and other Nortel IP Phone, Mobile Voice Client, and WLAN Handsets products allow remote attackers to cause a denial of service (device hang) via a flood of Mute and UnMute messages that have a spoofed source IP address for the Signaling Server.
- Product
- IP Softphone 2050
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsupport.nortel.com
Oct 23, 2007The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other productCVE-2007-5638 · Other software · Nortel · reported by MITREMedium 4.3
The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other product lines, use only 65536 different values in the 32-bit ID number field of an RUDP datagram, which makes it easier for remote attackers to guess the RUDP ID and spoof messages. NOTE: this can be leveraged for an eavesdropping attack by sending many Open Audio Stream messages.
- Product
- Business Communications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2007The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other productCVE-2007-5637 · Other software · Nortel · reported by MITREMedium 4.3
The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other product lines allow remote attackers to eavesdrop on the physical environment via an Open Audio Stream message that enables "surveillance mode." NOTE: issues relating to a small ID number space can be leveraged to make this attack easier.
- Product
- Business Communications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2007Buffer overflow in the Nortel UNIStim IP Softphone 2050 allows remote attackers to cause a denial of service (application abort) and possibly execute arbitrary CVE-2007-5636 · Other software · Nortel · reported by MITREHigh 7.5
Buffer overflow in the Nortel UNIStim IP Softphone 2050 allows remote attackers to cause a denial of service (application abort) and possibly execute arbitrary code via a flood of invalid characters to the RTCP port (5678/udp) that triggers a Windows error message, aka "extraneous messaging."
- Product
- IP Softphone 2050
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2006SQL injection vulnerability in login.asp in UNISOR Content Management System (CMS) allows remote attackers to execute arbitrary SQL commands via the (1) user orCVE-2006-5628 · Other software · Unisor CMS · reported by MITREHigh 7.5
SQL injection vulnerability in login.asp in UNISOR Content Management System (CMS) allows remote attackers to execute arbitrary SQL commands via the (1) user or (2) pass fields.
- Product
- Unisor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Jan 10, 2005The unison command in scponly before 4.0 does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended acCVE-2004-1162 · Other software · Scponly · reported by MITREHigh 7.5
The unison command in scponly before 4.0 does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended access restrictions and execute arbitrary programs via the (1) -rshcmd or (2) -sshcmd flags.
- Product
- Scponly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2002The dynamic initialization feature of the ClearPath MCP environment allows remote attackers to cause a denial of service (crash) via a TCP port scan using a tooCVE-2002-2179 · Other software · Unisys · reported by MITREHigh 7.8
The dynamic initialization feature of the ClearPath MCP environment allows remote attackers to cause a denial of service (crash) via a TCP port scan using a tool such as nmap.
- Product
- Clearpath MCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiss.netsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.