Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,397 results · page 19 of 28
Aug 3, 2020It was found that the AMQ Online console is vulnerable to a Cross-Site Request Forgery (CSRF) which is exploitable in cases where preflight checks are not instiCVE-2020-14319 · Other software · Redhat · reported by Red HatMedium 5.9
It was found that the AMQ Online console is vulnerable to a Cross-Site Request Forgery (CSRF) which is exploitable in cases where preflight checks are not instigated or bypassed. For example authorised users using an older browser with Adobe Flash are vulnerable when targeted by an attacker. This flaw affects all versions of AMQ-Online prior to 1.5.2 and Enmasse versions 0.31.0-rc1 up until but not including 0.32.2.
- Product
- AMQ Online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Jun 9, 2020An elevation of privilege vulnerability exists when Windows Lockscreen fails to properly load spotlight images from a secure location, aka 'Windows Lockscreen ECVE-2020-1279 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
An elevation of privilege vulnerability exists when Windows Lockscreen fails to properly load spotlight images from a secure location, aka 'Windows Lockscreen Elevation of Privilege Vulnerability'.
- Product
- Windows 10 Version 2004 for 32-bit Systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 5, 2020IBM Worklight/MobileFoundation 8.0.0.0 does not properly invalidate session cookies when a user logs out of a session, which could allow another user to gain unCVE-2020-4229 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.3
IBM Worklight/MobileFoundation 8.0.0.0 does not properly invalidate session cookies when a user logs out of a session, which could allow another user to gain unauthorized access to a user's session. IBM X-Force ID: 175211.
- Product
- MobileFirst Platform Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 9, 2020modules/loaders/loader_ico.c in imlib2 1.6.0 has an integer overflow (with resultant invalid memory allocations and out-of-bounds reads) via an icon with many cCVE-2020-12761 · Other software · Enlightenment · reported by MITRECritical 9.1
modules/loaders/loader_ico.c in imlib2 1.6.0 has an integer overflow (with resultant invalid memory allocations and out-of-bounds reads) via an icon with many colors in its color map.
- Product
- Imlib2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.enlightenment.orggit.enlightenment.org
Apr 29, 2020In Moonlight iOS/tvOS before 4.0.1, the pairing process is vulnerable to a man-in-the-middle attack.CVE-2020-11024 · Other software · moonlight-stream · reported by GitHubMedium 6.1
In Moonlight iOS/tvOS before 4.0.1, the pairing process is vulnerable to a man-in-the-middle attack. The bug has been fixed in Moonlight v4.0.1 for iOS and tvOS.
- Product
- Moonlight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2020The ene.sys driver in G.SKILL Trident Z Lighting Control through 1.00.08 exposes mapping and un-mapping of physical memory, reading and writing to Model SpecifiCVE-2020-12446 · Other software · Gskill · reported by MITREHigh 7.8
The ene.sys driver in G.SKILL Trident Z Lighting Control through 1.00.08 exposes mapping and un-mapping of physical memory, reading and writing to Model Specific Register (MSR) registers, and input from and output to I/O ports to local non-privileged users. This leads to privilege escalation to NT AUTHORITY\SYSTEM.
- Product
- Trident Z Lighting Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2020Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP Server).CVE-2020-2800 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.8
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
- Product
- Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Apr 1, 2020Parrot ANAFI is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flightCVE-2019-3944 · Other software · Parrot · reported by vulnreport@tenable.comHigh 7.5
Parrot ANAFI is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flight.
- Product
- Anafi Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 31, 2020An issue was discovered in Progress Telerik UI for Silverlight before 2020.1.330.CVE-2020-11414 · Other software · Telerik · reported by MITREHigh 7.5
An issue was discovered in Progress Telerik UI for Silverlight before 2020.1.330. The RadUploadHandler class in RadUpload for Silverlight expects a web request that provides the file location of the uploading file along with a few other parameters. The uploading file location should be inside the directory where the upload handler class is defined. Before 2020.1.330, a crafted web request could result in uploads to arbitrary locations.
- Product
- UI For Silverlight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.telerik.comdocs.telerik.com
Mar 23, 2020This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0.CVE-2020-8868 · Other software · Quest · reported by zdi-disclosures@trendmicro.comCritical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the __service__ user account. The product contains a hard-coded password for this account. An attacker can leverage this vulnerability to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-9553.
- Product
- Foglight Evolve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.quest.comzerodayinitiative.com
Mar 11, 2020The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web server and makes use ofCVE-2019-5149 · Other software · Wago · reported by talos-cna@cisco.comHigh 7.5
The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web server and makes use of the FastCGI module, which is intended to provide high performance for all Internet applications without the penalties of Web server APIs. However, the default configuration of this module appears to limit the number of concurrent php-cgi processes to two, which can be abused to cause a denial of service of the entire web server. This affects WAGO PFC200 Firmware version 03.00.39(12) and version 03.01.07(13), and WAGO PFC100 Firmware version 03.00.39(12) and version 03.02.02(14).
- Product
- WAGO PFC200 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Feb 10, 2020Syska Smart Bulb devices through 2017-08-06 receive RGB parameters over cleartext Bluetooth Low Energy (BLE), leading to sniffing, reverse engineering, and replCVE-2017-18642 · Other software · Syska · reported by MITREMedium 6.5
Syska Smart Bulb devices through 2017-08-06 receive RGB parameters over cleartext Bluetooth Low Energy (BLE), leading to sniffing, reverse engineering, and replay attacks.
- Product
- Smartlight Rainbow LED Smart Bulb Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiayanpahwa.github.ioiayanpahwa.github.io
Jan 31, 2020Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control.CVE-2019-12999 · Other software · Lightning · reported by MITREHigh 7.5
Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control.
- Product
- Network Daemon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2020c-lightning before 0.7.1 allows attackers to trigger loss of funds because of Incorrect Access Control.CVE-2019-12998 · Other software · Elementsproject · reported by MITREHigh 7.5
c-lightning before 0.7.1 allows attackers to trigger loss of funds because of Incorrect Access Control. NOTE: README.md states "It can be used for testing, but it should not be used for real funds."
- Product
- C-lightning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.linuxfoundation.org
Jan 22, 2020The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to improper D-Bus security policy configuratioCVE-2018-16266 · Computers, phones & browsers · Linux · reported by MITREHigh 8.1
The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
- Product
- Tizen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedia.defcon.orgreview.tizen.org
Jan 17, 2020Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or CVE-2020-5397 · Other software · Spring · reported by security@pivotal.ioMedium 5.3
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.
- Product
- Spring Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2019suPHP before 0.7.2 source-highlighting feature allows security bypass which could lead to arbitrary code executionCVE-2014-1867 · Other software · suphp · reported by security@debian.orgHigh 7.8
suPHP before 0.7.2 source-highlighting feature allows security bypass which could lead to arbitrary code execution
- Product
- suphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Nov 19, 2019lightdm before 0.9.6 writes in .dmrc and Xauthority files using root permissions while the files are in user controlled folders.CVE-2011-3349 · Other software · lightdm · reported by Red HatHigh 7.8
lightdm before 0.9.6 writes in .dmrc and Xauthority files using root permissions while the files are in user controlled folders. A local user can overwrite root-owned files via a symlink, which can allow possible privilege escalation.
- Product
- lightdm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugs.debian.org
Nov 14, 2019On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation.CVE-2019-18980 · Other software · Philips · reported by MITREHigh 7.5
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. The only requirement is that the attacker have network access to the bulb.
- Product
- Taolight Smart Wi-fi WIZ Connected LED Bulb 9290022656 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.dammitly.netblog.dammitly.net
Nov 5, 2019An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23.CVE-2019-17598 · Other software · Lightbend · reported by MITREHigh 7.5
An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host.
- Product
- Play Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordplayframework.complayframework.com
Oct 23, 2019A vulnerability in version 0.90 of the Open Floodlight SDN controller software could result in a denial of service attack and crashing of the controller serviceCVE-2014-2304 · Other software · Projectfloodlight · reported by MITREHigh 7.5
A vulnerability in version 0.90 of the Open Floodlight SDN controller software could result in a denial of service attack and crashing of the controller service. This effect is the result of a flaw in OpenFlow protocol processing, where specific malformed and mistimed FEATURES_REPLY messages cause the controller service to not delete switch and port data from its internal tracking structures.
- Product
- Open SDN Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddovernetworks.comdovernetworks.com
Oct 23, 2019A vulnerability in version 0.90 of the Open Floodlight SDN controller software could allow an attacker with access to the OpenFlow control network to selectivelCVE-2013-7333 · Other software · Projectfloodlight · reported by MITREHigh 7.5
A vulnerability in version 0.90 of the Open Floodlight SDN controller software could allow an attacker with access to the OpenFlow control network to selectively disconnect individual switches from the SDN controller, causing degradation and eventually denial of network access to all devices connected to the targeted switch.
- Product
- Open SDN Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddovernetworks.comdovernetworks.com
Oct 8, 2019Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function.CVE-2019-10215 · Other software · Red Hat · reported by Red HatMedium 6.1
Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could exploit this via user interaction to execute code in the user's browser.
- Product
- bootstrap3-typeahead.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgaccess.redhat.com
Sep 25, 2019The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc.CVE-2015-9433 · WordPress plugins & themes · reported by MITREMedium 6.5
The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc. in wp-admin/options-general.php?page=wp-social-bookmarking-light%2Fmodules%2Fadmin.php.
- Product
- wp-social-bookmarking-light
- Fixed in
- 1.7.10
- What to do
- Update wp-social-bookmarking-light to 1.7.10 or newer.
Aug 20, 2019The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.CVE-2016-10893 · WordPress plugins & themes · reported by MITREMedium 6.1
The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.
- Product
- crayon-syntax-highlighter
- Fixed in
- 2.8.4
- What to do
- Update crayon-syntax-highlighter to 2.8.4 or newer.
Aug 20, 2019FlightPath 4.8.3 has XSS in the Content, Edit urgent message, and Users sections of the Admin Console.CVE-2019-15227 · Other software · Getflightpath · reported by MITREMedium 6.1
FlightPath 4.8.3 has XSS in the Content, Edit urgent message, and Users sections of the Admin Console. This could lead to cookie stealing and other malicious actions.
- Product
- Flightpath
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsevenlayers.comsevenlayers.com
Aug 19, 2019FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console.CVE-2019-15229 · Other software · Thedaylightstudio · reported by MITREHigh 8.8
FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsevenlayers.com
Aug 19, 2019FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console.CVE-2019-15228 · Other software · Thedaylightstudio · reported by MITREMedium 5.4
FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsevenlayers.com
Aug 9, 2019The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated byCVE-2016-10865 · WordPress plugins & themes · reported by MITREMedium 6.1
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
- Product
- Lightbox Plus Colorbox
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update Lightbox Plus Colorbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgpluginvulnerabilities.com
Jul 23, 2019A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page navigations.CVE-2019-11699 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page navigations. This could result in user confusion of which site is currently loaded for spoofing attacks. This vulnerability affects Firefox < 67.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jul 19, 2019An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress.CVE-2019-12934 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter.
- Product
- An issue was discovered in the wp-code-highlightjs
- Affected
- up to 0.6.2
- What to do
- Affects up to 0.6.2. Update An issue was discovered in the wp-code-highlightjs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comwordpress.org
Jul 10, 2019FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POSTCVE-2019-13396 · Other software · Getflightpath · reported by MITREMedium 5.3
FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POST request because of an include_once in system_handle_form_submit in modules/system/system.module.
- Product
- Flightpath
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgetflightpath.compacketstormsecurity.com
Jul 4, 2019FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entrCVE-2019-13241 · Other software · Flightcrew Project · reported by MITREHigh 7.8
FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
- Product
- Flightcrew
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsalvatoresecurity.com
Jun 28, 2019An issue was discovered in FlightCrew v0.9.2 and earlier.CVE-2019-13032 · Other software · Flightcrew Project · reported by MITREMedium 5.5
An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to xc::XMLUri::isValidURI(). This affects third-party software (not Sigil) that uses FlightCrew as a library.
- Product
- Flightcrew
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsalvatoresecurity.com
Jun 5, 2019A remote buffer overflow vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iCVE-2019-11983 · Other software · HP · reported by security-alert@hpe.comHigh 7
A remote buffer overflow vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier than version v1.39.
- Product
- Integrated Lights-out 5 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Jun 5, 2019A remote cross site scripting vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-OutCVE-2019-11982 · Other software · HP · reported by security-alert@hpe.comHigh 8.3
A remote cross site scripting vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier than version v1.39.
- Product
- Integrated Lights-out 5 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
May 16, 2019Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a root shell.CVE-2018-20007 · Other software · Yeelight · reported by MITREMedium 6.8
Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a root shell. The attacker can then exfiltrate the audio data, read cleartext Wi-Fi credentials in a log file, or access other sensitive device and user information.
- Product
- Smart AI Speaker Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.yeelight.compayatu.com
May 10, 2019openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method.CVE-2019-11066 · Other software · Lightopenid Project · reported by MITRECritical 9.8
openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method.
- Product
- Lightopenid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2019A vulnerability in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco Adaptive Security Appliance (ASA) Software and FirepoCVE-2019-1697 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.8
A vulnerability in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of LDAP packets sent to an affected device. An attacker could exploit these vulnerabilities by sending a crafted LDAP packet, using Basic Encoding Rules (BER), to be processed by an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
- Product
- Cisco Adaptive Security Appliance (ASA) Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Apr 10, 2019lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspeCVE-2019-11072 · Other software · Lighttpd · reported by MITRECritical 9.8
lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. NOTE: The developer states "The feature which can be abused to cause the crash is a new feature in lighttpd 1.4.50, and is not enabled by default. It must be explicitly configured in the config file (e.g. lighttpd.conf). Certain input will trigger an abort() in lighttpd when that feature is enabled. lighttpd detects the underflow or realloc() will fail (in both 32-bit and 64-bit executables), also detected in lighttpd. Either triggers an explicit abort() by lighttpd. This is not exploitable beyond triggering the explicit abort() with subsequent application exit.
- Product
- Lighttpd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Apr 9, 2019A remote Cross-Site Scripting in HPE iLO 5 Web User Interface vulnerability was identified in HPE Integrated Lights-Out 5 (iLO 5) for Gen10 ProLiant Servers earCVE-2018-7117 · Other software · HP · reported by security-alert@hpe.comMedium 6.1
A remote Cross-Site Scripting in HPE iLO 5 Web User Interface vulnerability was identified in HPE Integrated Lights-Out 5 (iLO 5) for Gen10 ProLiant Servers earlier than version v1.40.
- Product
- Integrated Lights-out 5 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Mar 7, 2019Multiple vulnerabilities in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco FXOS Software and Cisco NX-OS Software couldCVE-2019-1598 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
Multiple vulnerabilities in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of LDAP packets by an affected device. An attacker could exploit these vulnerabilities by sending an LDAP packet crafted using Basic Encoding Rules (BER) to an affected device. The LDAP packet must have a source IP address of an LDAP server configured on the targeted device. A successful exploit could cause the affected device to reload, resulting in a DoS condition. Firepower 4100 Series Next-Generation Firewalls are affected in versions prior to 2.0.1.201, 2.2.2.54, and 2.3.1.75. Firepower 9300 Security Appliances are affected in versions prior to 2.0.1.201, 2.2.2.54, and 2.3.1.75. MDS 9000 Series Multilayer Switches are affected in versions prior to 8.2(1). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(1). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(2). Nexus 7000 and 7700 Series Switches a
- Product
- Firepower 4100 Series Next-Generation Firewalls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Mar 7, 2019Multiple vulnerabilities in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco FXOS Software and Cisco NX-OS Software couldCVE-2019-1597 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
Multiple vulnerabilities in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of LDAP packets by an affected device. An attacker could exploit these vulnerabilities by sending an LDAP packet crafted using Basic Encoding Rules (BER) to an affected device. The LDAP packet must have a source IP address of an LDAP server configured on the targeted device. A successful exploit could cause the affected device to reload, resulting in a DoS condition. Firepower 4100 Series Next-Generation Firewalls are affected in versions prior to 2.0.1.201, 2.2.2.54, and 2.3.1.75. Firepower 9300 Security Appliances are affected in versions prior to 2.0.1.201, 2.2.2.54 and 2.3.1.75. MDS 9000 Series Multilayer Switches are affected in versions prior to 8.2(1). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(1). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(2). Nexus 7000 and 7700 Series Switches ar
- Product
- Firepower 4100 Series Next-Generation Firewalls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Feb 12, 2019In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon.CVE-2018-20781 · Other software · Gnome · reported by MITREHigh 7.8
In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.
- Product
- Gnome Keyring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugzilla.gnome.org
Feb 4, 2019An issue was discovered in 42Gears SureMDM before 2018-11-27, related to the access policy for Silverlight applications.CVE-2018-15659 · Other software · 42gears · reported by MITREMedium 6.5
An issue was discovered in 42Gears SureMDM before 2018-11-27, related to the access policy for Silverlight applications. Cross-origin access is possible.
- Product
- Suremdm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.digitalinterruption.comresearch.digitalinterruption.com
Feb 4, 2019GUP (generic update process) in LightySoft LogMX before 7.4.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to CVE-2019-7323 · Other software · Logmx · reported by MITREHigh 7.5
GUP (generic update process) in LightySoft LogMX before 7.4.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update. The update process relies on cleartext HTTP. The attacker could replace the LogMXUpdater.class file.
- Product
- Logmx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbmantra.github.iogithub.com
Jan 9, 2019Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier uses hard-coded credentials, which may allow an attacker on tCVE-2018-16201 · Other software · Toshiba Lighting & Technology Corporation · reported by vultures@jpcert.or.jpHigh 8.8
Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier uses hard-coded credentials, which may allow an attacker on the same network segment to login to the administrators settings screen and change the configuration or execute arbitrary OS commands.
- Product
- Toshiba Home gateway HEM-GW16A and Toshiba Home gateway HEM-GW26A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to execute arbCVE-2018-16200 · Other software · Toshiba Lighting & Technology Corporation · reported by vultures@jpcert.or.jpHigh 8.8
Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to execute arbitrary OS commands.
- Product
- Toshiba Home gateway HEM-GW16A and Toshiba Home gateway HEM-GW26A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Cross-site scripting vulnerability in Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an remote attackCVE-2018-16199 · Other software · Toshiba Lighting & Technology Corporation · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an remote attacker to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Toshiba Home gateway HEM-GW16A and Toshiba Home gateway HEM-GW26A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier may allow an attacker on the same network segment to access aCVE-2018-16198 · Other software · Toshiba Lighting & Technology Corporation · reported by vultures@jpcert.or.jpHigh 8.8
Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier may allow an attacker on the same network segment to access a non-documented developer screen to perform operations on the affected device.
- Product
- Toshiba Home gateway HEM-GW16A and Toshiba Home gateway HEM-GW26A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.