Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
85 results · page 2 of 2
Jun 6, 2018The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.CVE-2017-16202 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
- Product
- coffeescript node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Apr 6, 2018The pipe_init_terminal function in main.c in s3dvt allows local users to gain privileges by leveraging setuid permissions and usage of bash 4.3 and earlier.CVE-2014-1226 · Other software · S3dvt Project · reported by MITREHigh 7.8
The pipe_init_terminal function in main.c in s3dvt allows local users to gain privileges by leveraging setuid permissions and usage of bash 4.3 and earlier. NOTE: This vulnerability exists because of an incomplete fix for CVE-2013-6876.
- Product
- S3dvt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhmarco.orgseclists.org
Mar 6, 2018In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandleCVE-2018-7738 · Other software · Kernel · reported by MITREHigh 7.8
In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.
- Product
- Util-linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.combugs.debian.org
Jan 12, 2018The Yodobashi App for Android 1.2.1.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serversCVE-2015-2981 · Other software · Yodobashi · reported by vultures@jpcert.or.jpMedium 5.9
The Yodobashi App for Android 1.2.1.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Yodobashi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2017The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname'CVE-2016-0634 · Other software · GNU · reported by secalert_us@oracle.comHigh 7.5
The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.
- Product
- Bash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.comopenwall.com
Jun 13, 2017Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.CVE-2016-3704 · Other software · Fedoraproject · reported by Red HatHigh 7.5
Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.
- Product
- Fedora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Mar 27, 2017The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a commanCVE-2017-5932 · Other software · GNU · reported by Red HatHigh 7.8
The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a command substitution metacharacter.
- Product
- Bash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.savannah.gnu.orgopenwall.com
Jan 23, 2017popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.CVE-2016-9401 · Other software · GNU · reported by MITREMedium 5.5
popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.
- Product
- Bash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.comopenwall.com
Jan 19, 2017Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.CVE-2016-7543 · Other software · GNU · reported by MITREHigh 8.4
Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.
- Product
- Bash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.comopenwall.com
Nov 29, 2016Dell iDRAC7 and iDRAC8 devices with firmware before 2.40.40.40 allow authenticated users to gain Bash shell access through a string injection.CVE-2016-5685 · Other software · Dell EMC · reported by security_alert@emc.comHigh 8.8
Dell iDRAC7 and iDRAC8 devices with firmware before 2.40.40.40 allow authenticated users to gain Bash shell access through a string injection.
- Product
- iDRAC7 and iDRAC8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.community.dell.comsecurityfocus.com
Oct 25, 2016Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect integrity via vectors related to Bash.CVE-2016-5480 · Other software · Oracle · reported by secalert_us@oracle.comLow 2.8
Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect integrity via vectors related to Bash.
- Product
- Solaris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Sep 25, 2016Terminal in Apple OS X before 10.12 uses weak permissions for the .bash_history and .bash_session files, which allows local users to obtain sensitive informatioCVE-2016-4755 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
Terminal in Apple OS X before 10.12 uses weak permissions for the .bash_history and .bash_session files, which allows local users to obtain sensitive information via unspecified vectors.
- Product
- MAC OS X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comsecurityfocus.com
Aug 7, 2015The Yodobashi application 1.2.1.0 and earlier for Android allows remote attackers to execute arbitrary Java methods, and consequently obtain sensitive informatiCVE-2015-2980 · Other software · Yodobashi · reported by vultures@jpcert.or.jpMedium 6.8
The Yodobashi application 1.2.1.0 and earlier for Android allows remote attackers to execute arbitrary Java methods, and consequently obtain sensitive information or execute OS commands, via a crafted HTML document.
- Product
- Yodobashi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2014GNU Bash OS Command Injection VulnerabilityCVE-2014-6278 · Other software · GNU · reported by security@debian.orgExploitedHigh 8.8
GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.
- Product
- GNU Bash
- On CISA’s list since
- Oct 2, 2025 (federal fix deadline Oct 23, 2025)
- What to do
- Attackers are using this now. Install GNU’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogjvn.jpjvndb.jvn.jp
Sep 28, 2014Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounCVE-2014-7187 · Other software · GNU · reported by MITREHigh 10
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.
- Product
- Bash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2014The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access anCVE-2014-7186 · Other software · GNU · reported by MITREHigh 10
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue.
- Product
- Bash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2014GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arCVE-2014-6277 · Other software · GNU · reported by security@debian.orgHigh 10
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
- Product
- Bash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2014GNU Bourne-Again Shell (Bash) Arbitrary Code Execution VulnerabilityCVE-2014-7169 · Other software · GNU · reported by MITREExploitedCritical 9.8
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.
- Product
- Bourne-Again Shell (Bash)
- On CISA’s list since
- Jan 28, 2022 (federal fix deadline Jul 28, 2022)
- What to do
- Attackers are using this now. Install GNU’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogadvisories.mageia.orgarchives.neohapsis.com
Sep 24, 2014GNU Bourne-Again Shell (Bash) Arbitrary Code Execution VulnerabilityCVE-2014-6271 · Other software · GNU · reported by security@debian.orgExploitedCritical 9.8
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.
- Product
- Bourne-Again Shell (Bash)
- On CISA’s list since
- Jan 28, 2022 (federal fix deadline Jul 28, 2022)
- What to do
- Attackers are using this now. Install GNU’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogadvisories.mageia.orgarchives.neohapsis.com
Sep 8, 2014The Bingo Bash - Free Bingo Casino (aka air.com.bitrhymes.bingo) application 1.31.1 for Android does not verify X.509 certificates from SSL servers, which allowCVE-2014-5536 · Other software · Bashgaming · reported by cret@cert.orgMedium 5.4
The Bingo Bash - Free Bingo Casino (aka air.com.bitrhymes.bingo) application 1.31.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Bingo Bash Free Bingo Casino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Jan 29, 2014The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allowsCVE-2014-1683 · Other software · Skybluecanvas · reported by MITREMedium 6.8
The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php.
- Product
- Skybluecanvas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 27, 2012Stack-based buffer overflow in lib/sh/eaccess.c in GNU Bash before 4.2 patch 33 might allow local users to bypass intended restricted shell access via a long fiCVE-2012-3410 · Other software · GNU · reported by Red HatMedium 4.6
Stack-based buffer overflow in lib/sh/eaccess.c in GNU Bash before 4.2 patch 33 might allow local users to bypass intended restricted shell access via a long filename in /dev/fd, which is not properly handled when expanding the /dev/fd prefix.
- Product
- Bash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.gnu.orgbugs.debian.org
Nov 5, 2010GMXRC.bash in Gromacs 4.5.1 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horCVE-2010-4001 · Other software · Gromacs · reported by MITREMedium 4.6
GMXRC.bash in Gromacs 4.5.1 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: CVE disputes this issue because the GMXLDLIB value is always added to the beginning of LD_LIBRARY_PATH at a later point in the script
- Product
- Gromacs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Jan 14, 2010The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONCVE-2010-0002 · Other software · GNU · reported by Red HatLow 2.1
The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename.
- Product
- Bash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmandriva.comqa.mandriva.com
Dec 8, 2008bash-doc 3.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/cb#####.? temporary file, related to the (1) aliasconv.sh, (2) aliasCVE-2008-5374 · Other software · Matthias Klose · reported by MITREMedium 6.9
bash-doc 3.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/cb#####.? temporary file, related to the (1) aliasconv.sh, (2) aliasconv.bash, and (3) cshtobash scripts.
- Product
- Bash-doc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgsecunia.com
Aug 20, 2007The server in Toribash 2.71 and earlier does not properly handle long commands, which allows remote attackers to trigger a protocol violation in which data is sCVE-2007-4450 · Other software · Toribash · reported by MITREMedium 5
The server in Toribash 2.71 and earlier does not properly handle long commands, which allows remote attackers to trigger a protocol violation in which data is sent to other clients without a required LF character, as demonstrated by a SAY command. NOTE: the security impact of this violation is not clear, although it probably makes exploitation of CVE-2007-4449 easier.
- Product
- Toribash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2007The client in Toribash 2.71 and earlier allows remote attackers to cause a denial of service (application hang) via a command without an LF character, as demonsCVE-2007-4449 · Other software · Toribash · reported by MITREMedium 5
The client in Toribash 2.71 and earlier allows remote attackers to cause a denial of service (application hang) via a command without an LF character, as demonstrated by a SAY command.
- Product
- Toribash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2007The server in Toribash 2.71 and earlier does not properly handle partially joined clients that are temporarily assigned the ID of -1, which allows remote attackCVE-2007-4448 · Other software · Toribash · reported by MITREMedium 5
The server in Toribash 2.71 and earlier does not properly handle partially joined clients that are temporarily assigned the ID of -1, which allows remote attackers to cause a denial of service (daemon crash) via a GRIP command with the ID of -1.
- Product
- Toribash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2007Multiple buffer overflows in the client in Toribash 2.71 and earlier allow remote attackers to (1) execute arbitrary code via a long game command in a replay (.CVE-2007-4447 · Other software · Toribash · reported by MITREHigh 7.5
Multiple buffer overflows in the client in Toribash 2.71 and earlier allow remote attackers to (1) execute arbitrary code via a long game command in a replay (.rpl) file and (2) cause a denial of service (application crash) via a long SAY command that omits a required LF character; and allow remote Toribash servers to execute arbitrary code via (3) a long game command and (4) a long SAY command that omits a required LF character.
- Product
- Toribash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2007Format string vulnerability in the server in Toribash 2.71 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the NICCVE-2007-4446 · Other software · Toribash · reported by MITREHigh 7.5
Format string vulnerability in the server in Toribash 2.71 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the NICK command (client nickname) when entering a game.
- Product
- Toribash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2007The server in Toribash 2.71 and earlier on Windows allows remote attackers to cause a denial of service (continuous beep and server hang) via certain commands tCVE-2007-4451 · Other software · Toribash · reported by MITREMedium 5
The server in Toribash 2.71 and earlier on Windows allows remote attackers to cause a denial of service (continuous beep and server hang) via certain commands that contain many 0x07 or other invalid characters.
- Product
- Toribash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2007The client in Toribash 2.71 and earlier allows remote attackers to cause a denial of service (disconnection) via a long (1) emote or (2) SPEC command.CVE-2007-4452 · Other software · Toribash · reported by MITREMedium 5
The client in Toribash 2.71 and earlier allows remote attackers to cause a denial of service (disconnection) via a long (1) emote or (2) SPEC command.
- Product
- Toribash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2002SSH 1 through 3, and possibly other versions, allows local users to bypass restricted shells such as rbash or rksh by uploading a script to a world-writeable diCVE-2002-1715 · Other software · SSH · reported by MITREHigh 7.2
SSH 1 through 3, and possibly other versions, allows local users to bypass restricted shells such as rbash or rksh by uploading a script to a world-writeable directory, then executing that script to gain normal shell access.
- Product
- SSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordonline.securityfocus.comsecurityfocus.com
Jan 9, 2001Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documCVE-2000-1134 · Other software · Immunix · reported by MITREHigh 7.2
Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documents or in-here documents), which allows local users to overwrite files of other users via a symlink attack.
- Product
- Immunix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.freebsd.orgpatches.sgi.com
Apr 20, 1999The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute.CVE-1999-0491 · Other software · GNU · reported by MITREMedium 4.6
The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute.
- Product
- Bash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.calderasystems.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.