Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
125 results · page 2 of 3
Oct 31, 2023FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2023-46235 · Other software · FOGProject · reported by GitHubMedium 5.4
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the logs, they would be parsed as HTML and displayed accordingly. Version 1.5.10.15 contains a patch. As a workaround, view logs from an external text editor rather than the dashboard.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023libcue provides an API for parsing and extracting data from CUE sheets.CVE-2023-43641 · Other software · lipnitsk · reported by GitHubHigh 8.8
libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution. This issue is patched in version 2.3.0.
- Product
- libcue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.blog
Oct 2, 2023Rescue Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-41728 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes allows Stored XSS.This issue affects Rescue Shortcodes: from n/a through 2.5.
- Product
- Rescue Shortcodes
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Rescue Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 17, 2022Remote code execution vulnerability due to insufficient user privilege verification in reverseWall-MDS.CVE-2022-23769 · Other software · Secuever Co.,Ltd · reported by vuln@krcert.or.krHigh 7.5
Remote code execution vulnerability due to insufficient user privilege verification in reverseWall-MDS. Remote attackers can exploit the vulnerability such as stealing account, through remote code execution.
- Product
- reverseWall-MDS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Jun 17, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via \rdms\admin?page=user\manage_user&id=.CVE-2022-31941 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via \rdms\admin?page=user\manage_user&id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/respondent_types/manage_respondent_type.php?id=.CVE-2022-31965 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/respondent_types/manage_respondent_type.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/respondent_types/view_respondent_type.php?id=.CVE-2022-31964 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/respondent_types/view_respondent_type.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/view_incident.php?id=.CVE-2022-31962 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/view_incident.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/manage_incident.php?id=.CVE-2022-31961 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/manage_incident.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/teams/manage_team.php?id=.CVE-2022-31959 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/teams/manage_team.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/teams/view_team.php?id=.CVE-2022-31957 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/teams/view_team.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/manage_report.php?id=.CVE-2022-31956 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/manage_report.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/view_report.php?id=.CVE-2022-31953 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/view_report.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL injection via /rdms/classes/Master.php?f=delete_incident.CVE-2022-31952 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL injection via /rdms/classes/Master.php?f=delete_incident.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_respondent_type.CVE-2022-31951 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_respondent_type.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_report.CVE-2022-31948 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_report.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_team.CVE-2022-31946 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_team.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to Delete any file via /rdms/classes/Master.php?f=delete_img.CVE-2022-31945 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.1
Rescue Dispatch Management System v1.0 is vulnerable to Delete any file via /rdms/classes/Master.php?f=delete_img.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2022Rescue Dispatch Management System 1.0 suffers from Stored XSS, leading to admin account takeover via cookie stealing.CVE-2022-30017 · Other software · Rescue Dispatch Management System Project · reported by MITREMedium 5.4
Rescue Dispatch Management System 1.0 suffers from Stored XSS, leading to admin account takeover via cookie stealing.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
May 23, 2022Rescue Dispatch Management System 1.0 is vulnerable to Incorrect Access Control via http://localhost/rdms/admin/?page=system_info.CVE-2022-30016 · Other software · Rescue Dispatch Management System Project · reported by MITREHigh 8.8
Rescue Dispatch Management System 1.0 is vulnerable to Incorrect Access Control via http://localhost/rdms/admin/?page=system_info.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Feb 7, 2020The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before 3.25.60 allow local non-privileged users (including low-integrity level proceCVE-2020-8808 · Other software · Corsair · reported by MITREHigh 7.8
The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before 3.25.60 allow local non-privileged users (including low-integrity level processes) to read and write to arbitrary physical memory locations, and consequently gain NT AUTHORITY\SYSTEM privileges, via a function call such as MmMapIoSpace.
- Product
- Icue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.corsair.comgithub.com
Jan 21, 2020Null pointer exception can happen while parsing invalid MKV clip where cue information is parsed before segment information in Snapdragon Auto, Snapdragon CompuCVE-2019-14003 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Null pointer exception can happen while parsing invalid MKV clip where cue information is parsed before segment information in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCS605, QM215, Rennell, SA6155P, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Sep 16, 2019In Escuela de Gestion Publica Plurinacional (EGPP) Sistema Integrado de Gestion Academica (GESAC) v1, the username parameter of the authentication form is vulneCVE-2019-16264 · Other software · Egpp · reported by MITRECritical 9.8
In Escuela de Gestion Publica Plurinacional (EGPP) Sistema Integrado de Gestion Academica (GESAC) v1, the username parameter of the authentication form is vulnerable to SQL injection, allowing attackers to access the database.
- Product
- Sistema Integrado DE Gestion Academica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfayer.cominfayer.com
Mar 21, 2019An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below.CVE-2018-20220 · Other software · Teracue · reported by MITREHigh 7.5
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be interacted with, a large portion of the HTTP endpoints are missing authentication. An attacker is able to view these pages before being authenticated, and some of these pages may disclose sensitive information.
- Product
- Enc-400 Hdmi Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 21, 2019An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below.CVE-2018-20219 · Other software · Teracue · reported by MITREHigh 8.1
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the device sends an authentication cookie to the end user such that they can access the devices web administration panel. This token is hard-coded to a string in the source code (/usr/share/www/check.lp file). By setting this cookie in a browser, an attacker is able to maintain access to every ENC-400 device without knowing the password, which results in authentication bypass. Even if a user changes the password on the device, this token is static and unchanged.
- Product
- Enc-400 Hdmi Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 21, 2019An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below.CVE-2018-20218 · Other software · Teracue · reported by MITRECritical 9.8
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind of escaping or validation in /usr/share/www/check.lp file. An attacker is able to perform command injection using the "password" parameter in the login form.
- Product
- Enc-400 Hdmi Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgzxsecurity.co.nz
Nov 8, 2018A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the pCVE-2018-15381 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to the listening Java Remote Method Invocation (RMI) service. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.
- Product
- Cisco Unity Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 29, 2018cue-sdk-node is a Corsair Cue SDK wrapper for node.js.CVE-2016-10590 · Other software · HackerOne · reported by support@hackerone.comHigh 8.1
cue-sdk-node is a Corsair Cue SDK wrapper for node.js. cue-sdk-node downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.
- Product
- cue-sdk-node node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Oct 28, 2017bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to an "Access violation near NULL on destination operand" and crash when processing a malformed CUECVE-2017-15955 · Other software · Debian · reported by MITREMedium 5.5
bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to an "Access violation near NULL on destination operand" and crash when processing a malformed CUE (.cue) file.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2017bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow and crash when processing a malformed CUE (.cue) file.CVE-2017-15953 · Other software · Debian · reported by MITREMedium 5.5
bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow and crash when processing a malformed CUE (.cue) file.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2017The splt_cue_export_to_file function in cue.c in libmp3splt 0.9.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via CVE-2017-5665 · Other software · Libmp3splt Project · reported by MITREMedium 5.5
The splt_cue_export_to_file function in cue.c in libmp3splt 0.9.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.
- Product
- Libmp3splt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comblogs.gentoo.org
Apr 21, 2016The AXM-NET module in Accuenergy Acuvim II NET Firmware 3.08 and Acuvim IIR NET Firmware 3.08 allows remote attackers to discover a cleartext mail-server passwoCVE-2016-2294 · Other software · Accuenergy · reported by ics-cert@hq.dhs.govHigh 7.5
The AXM-NET module in Accuenergy Acuvim II NET Firmware 3.08 and Acuvim IIR NET Firmware 3.08 allows remote attackers to discover a cleartext mail-server password via unspecified vectors.
- Product
- Acuvim II NET Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Apr 21, 2016The AXM-NET module in Accuenergy Acuvim II NET Firmware 3.08 and Acuvim IIR NET Firmware 3.08 allows remote attackers to discover settings via a direct request CVE-2016-2293 · Other software · Accuenergy · reported by ics-cert@hq.dhs.govHigh 8.6
The AXM-NET module in Accuenergy Acuvim II NET Firmware 3.08 and Acuvim IIR NET Firmware 3.08 allows remote attackers to discover settings via a direct request to an unspecified URL.
- Product
- Acuvim IIR NET Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Jun 13, 2015CGI RESCUE BloBee 1.20 and earlier allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via unspecified vectors.CVE-2015-2962 · Other software · CGI Rescue · reported by vultures@jpcert.or.jpHigh 7.5
CGI RESCUE BloBee 1.20 and earlier allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via unspecified vectors.
- Product
- Blobee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2014The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving CVE-2014-2374 · Other software · Accuenergy · reported by ics-cert@hq.dhs.govHigh 7.5
The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving JavaScript.
- Product
- Accuenergy Acuvim II AXN-NET Ethernet module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccuenergy.comcisa.gov
Nov 5, 2014The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving CVE-2014-2373 · Other software · Accuenergy · reported by ics-cert@hq.dhs.govHigh 7.5
The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving JavaScript.
- Product
- Accuenergy Acuvim II AXN-NET Ethernet module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccuenergy.comcisa.gov
Oct 19, 2014The ForoSocuellamos (aka com.forosocuellamos.tlcttbeukajwpeqreg) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows mCVE-2014-7307 · Other software · Forosocuellamos · reported by cret@cert.orgMedium 5.4
The ForoSocuellamos (aka com.forosocuellamos.tlcttbeukajwpeqreg) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Forosocuellamos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 8, 2014The Wonder Zoo - Animal rescue ! (aka com.gameloft.android.ANMP.GloftZRHM) application 1.6.1 for Android does not verify X.509 certificates from SSL servers, whCVE-2014-5628 · Other software · Gameloft · reported by cret@cert.orgMedium 5.4
The Wonder Zoo - Animal rescue ! (aka com.gameloft.android.ANMP.GloftZRHM) application 1.6.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Wonder ZOO - Animal Rescue !
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
May 8, 2014The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and use_cow_images isCVE-2014-0134 · Other software · Openstack · reported by Red HatLow 3.5
The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and use_cow_images is set to false, allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image.
- Product
- Compute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comubuntu.com
Apr 30, 2014The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text TracCVE-2014-1525 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 9.3
The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) via a crafted VIDEO element in an HTML document.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.opensuse.org
Mar 25, 2014The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bCVE-2014-2573 · Other software · Openstack · reported by MITRELow 2.3
The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.
- Product
- Compute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comopenwall.com
Aug 29, 2013The RIP process in Cisco IOS XR allows remote attackers to cause a denial of service (process crash) via a crafted version-2 RIP packet, aka Bug ID CSCue46731.CVE-2013-3470 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5
The RIP process in Cisco IOS XR allows remote attackers to cause a denial of service (process crash) via a crafted version-2 RIP packet, aka Bug ID CSCue46731.
- Product
- IOS XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgtools.cisco.com
May 3, 2013The SNMP module in Cisco IOS XR allows remote authenticated users to cause a denial of service (process restart) via crafted SNMP packets, aka Bug ID CSCue69472CVE-2013-1234 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4
The SNMP module in Cisco IOS XR allows remote authenticated users to cause a denial of service (process restart) via crafted SNMP packets, aka Bug ID CSCue69472.
- Product
- IOS XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 26, 2009Cross-site scripting (XSS) vulnerability in CGI RESCUE Trees before 2.11 allows remote attackers to inject arbitrary web script or HTML via unspecified parameteCVE-2009-1790 · Other software · CGI Rescue · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in CGI RESCUE Trees before 2.11 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
- Product
- Rescue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2009CRLF injection vulnerability in CGI RESCUE Web Mailer before 1.04 allows remote attackers to inject arbitrary HTTP headers, and conduct cross-site scripting (XSCVE-2009-1591 · Other software · CGI Rescue · reported by MITREMedium 4.3
CRLF injection vulnerability in CGI RESCUE Web Mailer before 1.04 allows remote attackers to inject arbitrary HTTP headers, and conduct cross-site scripting (XSS) or HTTP response splitting attacks, via CRLF sequences in an unspecified web form.
- Product
- CGI Web Mailer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2009Unspecified vulnerability in CGI RESCUE FORM2MAIL before 1.42 allows remote attackers to send email to arbitrary recipients via a web form.CVE-2009-1590 · Other software · CGI Rescue · reported by MITREMedium 5
Unspecified vulnerability in CGI RESCUE FORM2MAIL before 1.42 allows remote attackers to send email to arbitrary recipients via a web form.
- Product
- Form2mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2009Unspecified vulnerability in CGI RESCUE MiniBBS22 before 1.01 allows remote attackers to send email to arbitrary recipients via unknown vectors.CVE-2009-1589 · Other software · CGI Rescue · reported by MITREMedium 5
Unspecified vulnerability in CGI RESCUE MiniBBS22 before 1.01 allows remote attackers to send email to arbitrary recipients via unknown vectors.
- Product
- CGI Rescue Minibbs22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2009Cross-site scripting (XSS) vulnerability in CGI RESCUE MiniBBS 8t before 8.95t, 8 before 8.95, 9 before 9.08, and 10 before 10.32 allows remote attackers to injCVE-2009-1588 · Other software · CGI Rescue · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in CGI RESCUE MiniBBS 8t before 8.95t, 8 before 8.95, 9 before 9.08, and 10 before 10.32 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- CGI Rescue Minibbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2008Directory traversal vulnerability in CGI RESCUE KanniBBS2000 (aka KanniBBS2000i, MiniBBS2000, and MiniBBS2000i) before 1.03 allows remote attackers to read arbiCVE-2008-5723 · Other software · Cgi-rescue · reported by MITREMedium 5
Directory traversal vulnerability in CGI RESCUE KanniBBS2000 (aka KanniBBS2000i, MiniBBS2000, and MiniBBS2000i) before 1.03 allows remote attackers to read arbitrary files via unspecified vectors.
- Product
- Kannibbs2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2008Heap-based buffer overflow in the tvtumin.sys kernel driver in Lenovo Rescue and Recovery 4.20, including 4.20.0511 and 4.20.0512, allows local users to executeCVE-2008-4589 · Other software · Lenovo · reported by MITREHigh 7.2
Heap-based buffer overflow in the tvtumin.sys kernel driver in Lenovo Rescue and Recovery 4.20, including 4.20.0511 and 4.20.0512, allows local users to execute arbitrary code via a long file name.
- Product
- Resuce And Recovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.