Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

37added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,914 results · page 19 of 39

Dec 24, 2020WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel.CVE-2020-29247 · Other software · Wondercms · reported by MITREMedium 4.8
WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel. An attacker can inject the XSS payload in Page keywords and each time any user will visit the website, the XSS triggers, and the attacker can able to steal the cookie according to the crafted payload.
Product
Wondercms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record systemweakness.com exploit-db.com
Dec 23, 2020Cross Site Scripting (XSS) vulnerability via the 'Full Name' parameter in the User Registration section of User Registration & Login System with Admin Panel 1.0CVE-2020-35252 · Other software · Egavilanmedia · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability via the 'Full Name' parameter in the User Registration section of User Registration & Login System with Admin Panel 1.0.
Product
User Registration And Login System With Admin Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Dec 21, 2020DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges.CVE-2020-35274 · Other software · Dotcms · reported by MITREMedium 4.8
DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges. An attacker could compromise the security of a website or web application through a stored XSS attack and stealing cookies using XSS.
Product
Dotcms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Dec 21, 2020EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery (CSRF) to remotely gain privileges in the User ProCVE-2020-35273 · Other software · Egavilanmedia · reported by MITREHigh 8
EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery (CSRF) to remotely gain privileges in the User Profile panel. An attacker can update any user's account.
Product
User Registration & Login System With Admin Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Dec 15, 2020The package s-cart/core before 4.4 are vulnerable to Cross-site Scripting (XSS) via the admin panel.CVE-2020-28456 · Other software · S-cart · reported by report@snyk.ioHigh 7.3
The package s-cart/core before 4.4 are vulnerable to Cross-site Scripting (XSS) via the admin panel.
Product
S-cart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 2, 2020Uncontrolled Resource Consumption can be exploited to cause the Phoenix Contact HMIs BTP 2043W, BTP 2070W and BTP 2102W in all versions to become unresponsive aCVE-2020-12524 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 7.5
Uncontrolled Resource Consumption can be exploited to cause the Phoenix Contact HMIs BTP 2043W, BTP 2070W and BTP 2102W in all versions to become unresponsive and not accurately update the display content (Denial of Service).
Product
BTP Touch Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Nov 27, 2020In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.CVE-2017-15682 · Other software · Craftercms · reported by MITREMedium 6.1
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Nov 26, 2020cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).CVE-2020-29137 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net news.cpanel.com
Nov 26, 2020In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).CVE-2020-29136 · Websites & servers · Cpanel · reported by MITREMedium 6.5
In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net news.cpanel.com
Nov 26, 2020cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).CVE-2020-29135 · Websites & servers · Cpanel · reported by MITREMedium 4.1
cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net news.cpanel.com
Nov 24, 2020Fastweb FASTGate GPON FGA2130FWB devices through 2020-05-26 allow CSRF via the router administration web panel, leading to an attacker's ability to perform admiCVE-2020-13620 · Other software · Fastweb · reported by MITREHigh 8.8
Fastweb FASTGate GPON FGA2130FWB devices through 2020-05-26 allow CSRF via the router administration web panel, leading to an attacker's ability to perform administrative actions such as modifying the configuration.
Product
Fastgate Gpon Fga2130fwb Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lucadidomenico.medium.com members.backbox.org
Nov 15, 2020In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it easier for remote attackers to conduct admCVE-2020-28642 · Other software · Infinitewp · reported by MITRECritical 9.8
In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it easier for remote attackers to conduct admin Account Takeover attacks.
Product
Infinitewp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whitehack.de whitehack.de
Nov 10, 2020Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/.CVE-2019-7357 · Other software · Intelliants · reported by MITREHigh 8.8
Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins.
Product
Subrion CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 6, 2020ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidentialCVE-2020-15259 · Other software · auth0 · reported by GitHubHigh 8.1
ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidential data loss. CSRF exploits may occur if the user visits a malicious page containing CSRF payload on the same machine that has access to the ad-ldap-connector admin console via a browser. You may be affected if you use the admin console included with ad-ldap-connector versions <=5.0.12. If you do not have ad-ldap-connector admin console enabled or do not visit any other public URL while on the machine it is installed on, you are not affected. The issue is fixed in version 5.0.13.
Product
ad-ldap-connector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2020Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter.CVE-2019-7356 · Other software · Intelliants · reported by MITREMedium 5.4
Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter.
Product
Subrion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 30, 2020vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request.CVE-2020-7373 · Other software · Vbulletin · reported by cve@rapid7.comCritical 9.8
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is the preferred CVE ID to track this vulnerability.
Product
Vbulletin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.exploitee.rs forum.vbulletin.com
Oct 23, 2020Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10.CVE-2020-27388 · Other software · Yourls · reported by MITREMedium 5.4
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.
Product
Yourls
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com johnjhacking.com
Oct 2, 2020NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component in which a user is presented with a dialog box fCVE-2020-5979 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component in which a user is presented with a dialog box for input by a high-privilege process, which may lead to escalation of privileges.
Product
NVIDIA GPU Display Driver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvidia.custhelp.com nvidia.custhelp.com
Sep 25, 2020cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).CVE-2020-26115 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).CVE-2020-26114 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).CVE-2020-26113 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020The email quota cache in cPanel before 90.0.10 allows overwriting of files.CVE-2020-26112 · Websites & servers · Cpanel · reported by MITREHigh 7.5
The email quota cache in cPanel before 90.0.10 allows overwriting of files.
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).CVE-2020-26111 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).CVE-2020-26110 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557).CVE-2020-26109 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).CVE-2020-26108 · Websites & servers · Cpanel · reported by MITRECritical 9.8
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).CVE-2020-26107 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).CVE-2020-26106 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).CVE-2020-26105 · Websites & servers · Cpanel · reported by MITRECritical 9.8
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).CVE-2020-26104 · Websites & servers · Cpanel · reported by MITREHigh 7.5
In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).CVE-2020-26103 · Websites & servers · Cpanel · reported by MITREHigh 7.5
In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).CVE-2020-26102 · Websites & servers · Cpanel · reported by MITREHigh 7.5
In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).CVE-2020-26101 · Websites & servers · Cpanel · reported by MITRECritical 9.8
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).CVE-2020-26100 · Websites & servers · Cpanel · reported by MITRECritical 9.8
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).CVE-2020-26099 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).CVE-2020-26098 · Websites & servers · Cpanel · reported by MITRECritical 9.8
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 24, 2020The ping page of the administration panel in Telmat AccessLog <= 6.0 (TAL_20180415) allows an attacker to get root shell access via authenticated code injectionCVE-2020-16148 · Other software · Telmat · reported by MITREHigh 7.2
The ping page of the administration panel in Telmat AccessLog <= 6.0 (TAL_20180415) allows an attacker to get root shell access via authenticated code injection over the network.
Product
Accesslog Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record podalirius.net podalirius.net
Sep 9, 2020A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16).CVE-2020-15787 · Other software · Siemens · reported by productcert@siemens.comCritical 9.8
A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate authentication attempts as the information given can be truncated to match only a set number of characters versus the whole provided string. This could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack.
Product
SIMATIC HMI Unified Comfort Panels
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Sep 9, 2020A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl.CVE-2020-15786 · Other software · Siemens · reported by productcert@siemens.comCritical 9.8
A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions <= V16), SIMATIC HMI Mobile Panels (All versions <= V16), SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently block excessive authentication attempts. This could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack.
Product
SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Aug 26, 2020PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php.CVE-2020-23658 · Websites & servers · Php-fusion · reported by MITREMedium 5.4
PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php.
Product
Php-fusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 28, 2020This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.CVE-2020-15628 · Other software · CentOS Web Panel · reported by zdi-disclosures@trendmicro.comHigh 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the user parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9710.
Product
CentOS Web Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Jul 28, 2020This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.CVE-2020-15627 · Other software · CentOS Web Panel · reported by zdi-disclosures@trendmicro.comHigh 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the account parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9738.
Product
CentOS Web Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Jul 28, 2020This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.CVE-2020-15626 · Other software · CentOS Web Panel · reported by zdi-disclosures@trendmicro.comHigh 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the term parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9730.
Product
CentOS Web Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Jul 28, 2020This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.CVE-2020-15625 · Other software · CentOS Web Panel · reported by zdi-disclosures@trendmicro.comHigh 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_add_mailbox.php. When parsing the username parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9729.
Product
CentOS Web Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Jul 28, 2020This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.CVE-2020-15624 · Other software · CentOS Web Panel · reported by zdi-disclosures@trendmicro.comHigh 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_new_account.php. When parsing the domain parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9727.
Product
CentOS Web Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Jul 28, 2020This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.CVE-2020-15623 · Other software · CentOS Web Panel · reported by zdi-disclosures@trendmicro.comCritical 9.8
This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the archivo parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9722.
Product
CentOS Web Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Jul 28, 2020This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.CVE-2020-15622 · Other software · CentOS Web Panel · reported by zdi-disclosures@trendmicro.comHigh 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the search parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9712.
Product
CentOS Web Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Jul 28, 2020This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.CVE-2020-15621 · Other software · CentOS Web Panel · reported by zdi-disclosures@trendmicro.comHigh 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the email parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9711.
Product
CentOS Web Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Jul 28, 2020This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.CVE-2020-15620 · Other software · CentOS Web Panel · reported by zdi-disclosures@trendmicro.comHigh 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the id parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9741.
Product
CentOS Web Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Jul 28, 2020This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.CVE-2020-15619 · Other software · CentOS Web Panel · reported by zdi-disclosures@trendmicro.comHigh 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the type parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9723.
Product
CentOS Web Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.