Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
102 results · page 2 of 3
Apr 25, 2021NEC Aterm devices (Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier)CVE-2021-20708 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
NEC Aterm devices (Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier) allow authenticated attackers to execute arbitrary OS commands by sending a specially crafted request to a specific URL.
- Product
- NEC Aterm devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2021Cross-site scripting vulnerability in NEC Aterm devices (Aterm WG1900HP2 firmware Ver.1.3.1 and earlier, Aterm WG1900HP firmware Ver.2.5.1 and earlier, Aterm WGCVE-2021-20680 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in NEC Aterm devices (Aterm WG1900HP2 firmware Ver.1.3.1 and earlier, Aterm WG1900HP firmware Ver.2.5.1 and earlier, Aterm WG1800HP4 firmware Ver.1.3.1 and earlier, Aterm WG1800HP3 firmware Ver.1.5.1 and earlier, Aterm WG1200HS2 firmware Ver.2.5.0 and earlier, Aterm WG1200HP3 firmware Ver.1.3.1 and earlier, Aterm WG1200HP2 firmware Ver.2.5.0 and earlier, Aterm W1200EX firmware Ver.1.3.1 and earlier, Aterm W1200EX-MS firmware Ver.1.3.1 and earlier, Aterm WG1200HS firmware all versions Aterm WG1200HP firmware all versions Aterm WF800HP firmware all versions Aterm WF300HP2 firmware all versions Aterm WR8165N firmware all versions Aterm W500P firmware all versions, and Aterm W300P firmware all versions) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
- Product
- NEC Aterm devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2021Cross-site scripting vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers toCVE-2021-20622 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- Aterm WG2600HP and Aterm WG2600HP2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2021Cross-site request forgery (CSRF) vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remoteCVE-2021-20621 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- Product
- Aterm WG2600HP and Aterm WG2600HP2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2021Cross-site scripting vulnerability in Aterm WF800HP firmware Ver1.0.9 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.CVE-2021-20620 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Aterm WF800HP firmware Ver1.0.9 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- Aterm WF800HP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2020Improper validation of integrity check value vulnerability in Aterm SA3500G firmware versions prior to Ver.CVE-2020-5637 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpMedium 6.8
Improper validation of integrity check value vulnerability in Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker with an administrative privilege to execute a malicious program.
- Product
- Aterm SA3500G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2020Aterm SA3500G firmware versions prior to Ver.CVE-2020-5636 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpMedium 6.8
Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker with an administrative privilege to send a specially crafted request to a specific URL, which may result in an arbitrary command execution.
- Product
- Aterm SA3500G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2020Aterm SA3500G firmware versions prior to Ver.CVE-2020-5635 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 8.8
Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker on the adjacent network to send a specially crafted request to a specific URL, which may result in an arbitrary command execution.
- Product
- Aterm SA3500G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2020In WatermelonDB (NPM package "@nozbe/watermelondb") before versions 0.15.1 and 0.16.2, a maliciously crafted record ID can exploit a SQL Injection vulnerabilityCVE-2020-4035 · Other software · Nozbe · reported by GitHubMedium 5.9
In WatermelonDB (NPM package "@nozbe/watermelondb") before versions 0.15.1 and 0.16.2, a maliciously crafted record ID can exploit a SQL Injection vulnerability in iOS adapter implementation and cause the app to delete all or selected records from the database, generally causing the app to become unusable. This may happen in apps that don't validate IDs (valid IDs are `/^[a-zA-Z0-9_-.]+$/`) and use Watermelon Sync or low-level `database.adapter.destroyDeletedRecords` method. The integrity risk is low due to the fact that maliciously deleted records won't synchronize, so logout-login will restore all data, although some local changes may be lost if the malicious deletion causes the sync process to fail to proceed to push stage. No way to breach confidentiality with this vulnerability is known. Full exploitation of SQL Injection is mitigated, because it's not possible to nest an insert/update query inside a delete query in SQLite, and it's not possible to pass a semicolon-separated second query. There's also no known practicable way to breach confidentiality by selectively deleting records, because those records will not be synchronized. It's theoretically possible that selective rec
- Product
- WatermelonDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2020Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges CVE-2020-5534 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 8
Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via unspecified vectors.
- Product
- Aterm WG2600HS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2020Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecifieCVE-2020-5533 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Aterm WG2600HS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2020Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows anCVE-2020-5525 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 8
Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via management screen.
- Product
- Aterm series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2020Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows anCVE-2020-5524 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 8.8
Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an attacker on the same network segment to execute arbitrary OS commands with root privileges via UPnP function.
- Product
- Aterm series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2020Arvato Skillpipe 3.0 allows attackers to bypass intended print restrictions by deleting <div id="watermark"> from the HTML source code.CVE-2020-9013 · Other software · Arvato · reported by MITREMedium 4.3
Arvato Skillpipe 3.0 allows attackers to bypass intended print restrictions by deleting <div id="watermark"> from the HTML source code.
- Product
- Skillpipe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwitter.comexploit-db.com
Mar 11, 2019class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, orCVE-2019-9692 · Other software · Cmsmadesimple · reported by MITREMedium 6.5
class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG).
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comviewsvn.cmsmadesimple.org
Jan 9, 2019Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows an attacker on the same neCVE-2018-16195 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 8.8
Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows an attacker on the same network segment to execute arbitrary OS commands via SOAP interface of UPnP.
- Product
- Aterm WF1200CR and Aterm WG1200CR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows authenticated attackers toCVE-2018-16194 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows authenticated attackers to execute arbitrary OS commands via unspecified vectors.
- Product
- Aterm WF1200CR and Aterm WG1200CR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Cross-site scripting vulnerability in Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlCVE-2018-16193 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Aterm WF1200CR and Aterm WG1200CR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allow an attacker on the same netCVE-2018-16192 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpMedium 6.5
Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allow an attacker on the same network segment to obtain information registered on the device via unspecified vectors.
- Product
- Aterm WF1200CR and Aterm WG1200CR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via tools_system.cgi date parameter, tCVE-2018-0641 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via tools_system.cgi date parameter, time parameter, and offset parameter.
- Product
- HC100RC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via netWizard.cgi date parameter, timeCVE-2018-0640 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via netWizard.cgi date parameter, time parameter, and offset parameter.
- Product
- HC100RC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via tools_firmware.cgi date parameter, time parameCVE-2018-0639 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via tools_firmware.cgi date parameter, time parameter, and offset parameter.
- Product
- HC100RC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via import.cgi encKey parameter.CVE-2018-0638 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via import.cgi encKey parameter.
- Product
- HC100RC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey parameter.CVE-2018-0637 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey parameter.
- Product
- HC100RC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter of a certain URL, diCVE-2018-0636 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter of a certain URL, different URL from CVE-2018-0634.
- Product
- HC100RC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter.CVE-2018-0635 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter.
- Product
- HC100RC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter or bootmode parameteCVE-2018-0634 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter or bootmode parameter of a certain URL.
- Product
- HC100RC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via submit-url parameter.CVE-2018-0633 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via submit-url parameter.
- Product
- Aterm W300P
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via HTTP request and response.CVE-2018-0632 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via HTTP request and response.
- Product
- Aterm W300P
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter.CVE-2018-0631 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter.
- Product
- Aterm W300P
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd parameter.CVE-2018-0630 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd parameter.
- Product
- Aterm W300P
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response.CVE-2018-0629 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response.
- Product
- Aterm W300P
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response.CVE-2018-0628 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response.
- Product
- WG1200HP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter.CVE-2018-0627 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter.
- Product
- WG1200HP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd in formWsc parameter.CVE-2018-0626 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd in formWsc parameter.
- Product
- WG1200HP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via formSysCmd parameter.CVE-2018-0625 · Other software · NEC Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via formSysCmd parameter.
- Product
- WG1200HP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2018An issue was discovered on the NEC Aterm WG2600HP2 1.0.2.CVE-2017-12575 · Other software · Aterm · reported by MITREHigh 7.5
An issue was discovered on the NEC Aterm WG2600HP2 1.0.2. The router has a set of web service APIs for access to and setup of the configuration. Some APIs don't require authentication. An attacker could exploit this vulnerability by sending a crafted HTTP request to retrieve DHCP clients, firmware version, and network status (ex.: curl -X http://[IP]/aterm_httpif.cgi/negotiate -d "REQ_ID=SUPPORT_IF_GET").
- Product
- Wg2600hp2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2017Remote Code Execution is possible in Code42 CrashPlan 5.4.x via the org.apache.commons.ssl.rmi.DateRMI Java class, because (upon instantiation) it creates an RMCVE-2017-9830 · Other software · Code42 · reported by MITRECritical 9.8
Remote Code Execution is possible in Code42 CrashPlan 5.4.x via the org.apache.commons.ssl.rmi.DateRMI Java class, because (upon instantiation) it creates an RMI server that listens on a TCP port and deserializes objects sent by TCP clients.
- Product
- Crashplan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.radicallyopensecurity.comblog.radicallyopensecurity.com
Jun 9, 2017Untrusted search path vulnerability in the installer of Tera Term 4.94 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecifieCVE-2017-2193 · Other software · TeraTerm Project · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installer of Tera Term 4.94 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The installer of Tera Term
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 1, 2016Cross-site request forgery (CSRF) vulnerability on NEC Aterm WF800HP devices with firmware 1.0.17 and earlier allows remote attackers to hijack the authenticatiCVE-2016-1168 · Other software · Aterm · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability on NEC Aterm WF800HP devices with firmware 1.0.17 and earlier allows remote attackers to hijack the authentication of arbitrary users.
- Product
- Wf800hp Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2016Cross-site request forgery (CSRF) vulnerability on NEC Aterm WG300HP devices allows remote attackers to hijack the authentication of arbitrary users.CVE-2016-1167 · Other software · Aterm · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability on NEC Aterm WG300HP devices allows remote attackers to hijack the authentication of arbitrary users.
- Product
- Wg300hp Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2014Cross-site scripting (XSS) vulnerability in phprack.php in the DMCA WaterMarker plugin before 1.1 for WordPress allows remote attackers to inject arbitrary web CVE-2014-4520 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in phprack.php in the DMCA WaterMarker plugin before 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the plugin_dir parameter.
- Product
- Cross-site scripting (XSS) vulnerability in phprack.php in the DMCA WaterMarker
- Fixed in
- 1.1
- What to do
- Update Cross-site scripting (XSS) vulnerability in phprack.php in the DMCA WaterMarker to 1.1 or newer.
Full record and what to do →NVD recordcodevigilant.comsecurityfocus.com
Mar 14, 2014Cross-site scripting (XSS) vulnerability in the Marekkis Watermark plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2013-1758 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Marekkis Watermark plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pfad parameter to wp-admin/options-general.php. NOTE: some of these details are obtained from third party information.
- Product
- Marekkis Watermark
- Affected
- 0.9.2 to 0.9.2
- What to do
- Affects 0.9.2 to 0.9.2. Update Marekkis Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Dec 4, 2013Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the SourcePath value in aCVE-2013-6935 · Other software · Videocharge · reported by MITREHigh 9.3
Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the SourcePath value in a .wcf file.
- Product
- Watermark Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 4, 2013Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the name attribute of theCVE-2013-6937 · Other software · Videocharge · reported by MITREMedium 6.8
Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the name attribute of the cols element in a .wstyle file.
- Product
- Watermark Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Mar 19, 2013Multiple cross-site request forgery (CSRF) vulnerabilities in the web-based management utility on the NEC AtermWR9500N, AtermWR8600N, AtermWR8370N, AtermWR8160NCVE-2013-0717 · Other software · NEC · reported by vultures@jpcert.or.jpMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the web-based management utility on the NEC AtermWR9500N, AtermWR8600N, AtermWR8370N, AtermWR8160N, AtermWM3600R, and AtermWM3450RN routers allow remote attackers to hijack the authentication of administrators for requests that (1) initialize settings or (2) reboot the device.
- Product
- Atermwm3450rn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2008rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections.CVE-2008-1142 · Other software · Aterm · reported by MITRELow 3.7
rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.
- Product
- Aterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarticle.gmane.orgbugs.debian.org
May 9, 2007PHP remote file inclusion vulnerability in watermark.php in the vm (aka Jean-Francois Laflamme) watermark 0.4.1 mod for Gallery allows remote attackers to execuCVE-2007-2575 · Other software · VM Watermark · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in watermark.php in the vm (aka Jean-Francois Laflamme) watermark 0.4.1 mod for Gallery allows remote attackers to execute arbitrary PHP code via a URL in the GALLERY_BASEDIR parameter.
- Product
- VM Watermark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2004cryptoloop on Linux kernel 2.6.x, when used on certain file systems with a block size 1024 or greater, has certain "IV computation" weaknesses that allow watermCVE-2004-2135 · Computers, phones & browsers · Linux · reported by MITRELow 2.1
cryptoloop on Linux kernel 2.6.x, when used on certain file systems with a block size 1024 or greater, has certain "IV computation" weaknesses that allow watermarked files to be detected without decryption.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infomareichelt.de
Feb 19, 2004dm-crypt on Linux kernel 2.6.x, when used on certain file systems with a block size 1024 or greater, has certain "IV computation" weaknesses that allow watermarCVE-2004-2136 · Computers, phones & browsers · Linux · reported by MITRELow 2.1
dm-crypt on Linux kernel 2.6.x, when used on certain file systems with a block size 1024 or greater, has certain "IV computation" weaknesses that allow watermarked files to be detected without decryption.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infomareichelt.de
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.