Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
72 results · page 2 of 2
Feb 8, 2022Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.CVE-2022-0524 · Other software · publify · reported by security@huntr.devHigh 7.5
Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.
- Product
- publify/publify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6.CVE-2021-4146 · Other software · pimcore · reported by security@huntr.devMedium 4.3
Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2022calibre-web is vulnerable to Business Logic ErrorsCVE-2021-4171 · Other software · janeczku · reported by security@huntr.devCritical 9.8
calibre-web is vulnerable to Business Logic Errors
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2022Changlian Blocklist has a Business Logic Errors vulnerability .Successful exploitation of this vulnerability may expand the attack surface of the message class.CVE-2021-39968 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Changlian Blocklist has a Business Logic Errors vulnerability .Successful exploitation of this vulnerability may expand the attack surface of the message class.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Dec 15, 2021yetiforcecrm is vulnerable to Business Logic ErrorsCVE-2021-4117 · Other software · yetiforcecompany · reported by security@huntr.devMedium 4.3
yetiforcecrm is vulnerable to Business Logic Errors
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021yetiforcecrm is vulnerable to Business Logic ErrorsCVE-2021-4111 · Other software · yetiforcecompany · reported by security@huntr.devMedium 4.3
yetiforcecrm is vulnerable to Business Logic Errors
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2021There is a Business Logic Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to persistent dos.CVE-2021-37071 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a Business Logic Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to persistent dos.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Oct 5, 2021A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.CVE-2021-39866 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.4
A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2021Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mCVE-2021-36012 · Websites & servers · Adobe · reported by AdobeMedium 6.5
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.
- Product
- Magento Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jun 3, 2021There is a Business Logic Errors vulnerability in Huawei Smartphone.CVE-2021-22308 · Other software · Huawei · reported by psirt@huawei.comLow 3.3
There is a Business Logic Errors vulnerability in Huawei Smartphone. The malicious apps installed on the device can keep taking screenshots in the background. This issue does not cause system errors, but may cause personal information leakage.
- Product
- Emui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Mar 18, 2021A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated CVE-2021-24148 · WordPress plugins & themes · reported by WPScanCritical 9.8
A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.
- Product
- MStore API
- Fixed in
- 3.2.0
- What to do
- Update MStore API to 3.2.0 or newer.
Jan 26, 2021reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic.CVE-2020-28874 · Other software · Projectsend · reported by MITREHigh 7.5
reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).
- Product
- Projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2020Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution.CVE-2020-15860 · Other software · Parallels · reported by MITRECritical 9.9
Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it was discovered that it is possible to access any host in the internal domain, even if it has no published applications or the mentioned host is no longer associated with that server farm.
- Product
- Remote Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.parallels.comcoresecurity.com
Jun 26, 2020Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic error vulnerability.CVE-2020-9630 · Websites & servers · Adobe · reported by AdobeCritical 9.8
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic error vulnerability. Successful exploitation could lead to privilege escalation.
- Product
- Magento
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Apr 18, 2018Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 and cf-release versions prior to v237, contain a business logic flaw.CVE-2016-2169 · Other software · Cloud Foundry · reported by security_alert@emc.comMedium 5.3
Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 and cf-release versions prior to v237, contain a business logic flaw. An application developer may create an application with a route that conflicts with a platform service route and receive traffic intended for the service.
- Product
- Cloud Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2017B.A.S C2Box before 4.0.0 (r19171) relies on client-side validation, which allows remote attackers to "corrupt the business logic" via a negative value in an oveCVE-2015-4626 · Other software · Treasuryxpress · reported by MITREHigh 7.5
B.A.S C2Box before 4.0.0 (r19171) relies on client-side validation, which allows remote attackers to "corrupt the business logic" via a negative value in an overdraft.
- Product
- C2box
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Feb 14, 2007buscador/buscador.htm in Portal Search allows remote attackers to obtain sensitive information (business logic) via a query string composed of a search for certCVE-2007-0923 · Other software · Radical Technologies · reported by MITREHigh 7.8
buscador/buscador.htm in Portal Search allows remote attackers to obtain sensitive information (business logic) via a query string composed of a search for certain characters.
- Product
- Portal Search
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityreason.com
Feb 18, 2006Cross-site scripting (XSS) vulnerability in Hitachi Business Logic - Container 02-03 through 03-00-/B on Windows, and 03-00 through 03-00-/B on Linux, allows reCVE-2006-0773 · Other software · Hitachi · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Hitachi Business Logic - Container 02-03 through 03-00-/B on Windows, and 03-00 through 03-00-/B on Linux, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the extended receiving box function.
- Product
- Business Logic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comhitachi-support.com
Feb 18, 2006SQL injection vulnerability in Hitachi Business Logic - Container 02-03 through 03-00-/B on Windows, and 03-00 through 03-00-/B on Linux, allows remote attackerCVE-2006-0772 · Other software · Hitachi · reported by MITREHigh 7.5
SQL injection vulnerability in Hitachi Business Logic - Container 02-03 through 03-00-/B on Windows, and 03-00 through 03-00-/B on Linux, allows remote attackers to execute arbitrary SQL commands via unspecified vectors in the extended receiving box function.
- Product
- Business Logic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comhitachi-support.com
Dec 29, 2005Multiple SQL injection vulnerabilities in Hitachi Business Logic - Container (BLC) P-2443-9114 01-00 through 02-06 on Windows, and P-1M43-9111 01-01 through 02-CVE-2005-4578 · Other software · Hitachi · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Hitachi Business Logic - Container (BLC) P-2443-9114 01-00 through 02-06 on Windows, and P-1M43-9111 01-01 through 02-00 on AIX, allow remote attackers to execute arbitrary SQL commands via unknown attack vectors in an unspecified input form.
- Product
- Business Logic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Dec 29, 2005Multiple HTTP response splitting vulnerabilities in Hitachi Business Logic - Container (BLC) P-2443-9114 01-00 through 02-06 on Windows, and P-1M43-9111 01-01 tCVE-2005-4579 · Other software · Hitachi · reported by MITREMedium 5
Multiple HTTP response splitting vulnerabilities in Hitachi Business Logic - Container (BLC) P-2443-9114 01-00 through 02-06 on Windows, and P-1M43-9111 01-01 through 02-00 on AIX, allow remote attackers to inject arbitrary HTTP headers via unknown attack vectors in an unspecified input form.
- Product
- Business Logic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Dec 29, 2005Multiple cross-site scripting (XSS) vulnerabilities in Hitachi Business Logic - Container (BLC) P-2443-9114 01-00 through 02-06 on Windows, and P-1M43-9111 01-0CVE-2005-4577 · Other software · Hitachi · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Hitachi Business Logic - Container (BLC) P-2443-9114 01-00 through 02-06 on Windows, and P-1M43-9111 01-01 through 02-00 on AIX, allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in an unspecified input form.
- Product
- Business Logic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.