Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
234 results · page 2 of 5
Sep 16, 2024FluxCP is a web-based Control Panel for rAthena servers written in PHP.CVE-2024-45799 · Other software · rathena · reported by GitHubHigh 7.3
FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that are currently not sanitized. This allows executing arbitrary javascript code on the user's browser just by visiting the shop pages. As a result all logged in to fluxcp users can have their session info stolen. This issue has been addressed in release version 1.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- FluxCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024Cross Site Scripting (XSS) Vulnerability in Firewall menu in Control Panel in KASDA KW5515 version 4.3.1.0, allows attackers to execute arbitrary code and stealCVE-2020-24061 · Other software · kasda · reported by MITREMedium 4.3
Cross Site Scripting (XSS) Vulnerability in Firewall menu in Control Panel in KASDA KW5515 version 4.3.1.0, allows attackers to execute arbitrary code and steal cookies via a crafted script
- Product
- kw5515
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024Mediavine Control Panel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43218 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mediavine Mediavine Control Panel mediavine-control-panel.This issue affects Mediavine Control Panel: from n/a through <= 2.10.4.
- Product
- Mediavine Control Panel
- Affected
- up to 2.10.4
- What to do
- Affects up to 2.10.4. Update Mediavine Control Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 18, 20241Panel is a web-based linux server management control panel.CVE-2024-39911 · Other software · 1Panel-dev · reported by GitHubCritical 10
1Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issue has been addressed in version 1.10.12-lts. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- 1Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mo60.cngithub.com
Jul 18, 20241Panel is a web-based linux server management control panel.CVE-2024-39907 · Other software · 1Panel-dev · reported by GitHubCritical 9.8
1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to upgrade. There are no known workarounds for these issues.
- Product
- 1Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2024Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before updaCVE-2024-25150 · Other software · Liferay · reported by security@liferay.comMedium 4.3
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordliferay.devliferay.dev
Feb 17, 2024Vulnerability of defects introduced in the design process in the Control Panel module.Successful exploitation of this vulnerability may cause app processes to bCVE-2023-52363 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Vulnerability of defects introduced in the design process in the Control Panel module.Successful exploitation of this vulnerability may cause app processes to be started by mistake.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mediavine Mediavine Control Panel plugin <= 2.10.2 versions.CVE-2023-44259 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mediavine Mediavine Control Panel plugin <= 2.10.2 versions.
- Affected
- up to 2.10.2
- What to do
- Affects up to 2.10.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 15, 2023A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML viaCVE-2023-39777 · Other software · Vbulletin · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Feb 15, 2023Media CP Media Control Panel latest version.CVE-2023-23467 · Other software · Media CP · reported by cna@cyber.gov.ilHigh 8.1
Media CP Media Control Panel latest version. Reflected XSS possible through unspecified endpoint.
- Product
- Media Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023Media CP Media Control Panel latest version.CVE-2023-23466 · Other software · Media CP · reported by cna@cyber.gov.ilMedium 6.5
Media CP Media Control Panel latest version. Insufficiently protected credential change.
- Product
- Media Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023Media CP Media Control Panel latest version.CVE-2023-23465 · Other software · Media CP · reported by cna@cyber.gov.ilCritical 9.1
Media CP Media Control Panel latest version. CSRF possible through unspecified endpoint.
- Product
- Media Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023Media CP Media Control Panel latest version.CVE-2023-23464 · Other software · Media CP · reported by cna@cyber.gov.ilHigh 8.1
Media CP Media Control Panel latest version. A Permissive Flash Cross-domain Policy may allow information disclosure.
- Product
- Media Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2023In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.CVE-2023-22953 · Other software · Expressionengine · reported by MITREHigh 8.8
In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.
- Product
- Expressionengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.expressionengine.comgist.github.com
Feb 8, 2023An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authenticatioCVE-2022-47648 · Other software · Bosch · reported by psirt@bosch.comHigh 7.6
An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authentication due to the IP based authorization. If an authorized user has accessed a publicly available B420 product using valid credentials, an insider attacker can gain access to the same panel without requiring any sort of authorization. The B420 module was already obsolete at the time this vulnerability was found (The End of Life announcement was made in 2013).
- Product
- B420
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.compastebin.com
Dec 30, 2022NVIDIA Control Panel for Windows contains a vulnerability where an unauthorized user or an unprivileged regular user can compromise the security of the softwareCVE-2022-34672 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Control Panel for Windows contains a vulnerability where an unauthorized user or an unprivileged regular user can compromise the security of the software by gaining privileges, reading sensitive information, or executing commands.
- Product
- vGPU software (guest driver) - Windows, NVIDIA Cloud Gaming (guest driver)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Nov 13, 2022A vulnerability, which was classified as critical, was found in Vesta Control Panel.CVE-2022-3967 · Other software · unspecified · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of the file func/main.sh of the component sed Handler. The manipulation leads to argument injection. An attack has to be approached locally. The name of the patch is 39561c32c12cabe563de48cc96eccb9e2c655e25. It is recommended to apply a patch to fix this issue. VDB-213546 is the identifier assigned to this vulnerability.
- Product
- Vesta Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2022myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection.CVE-2021-46850 · Other software · Vestacp · reported by MITREHigh 7.2
myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint.
- Product
- Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.talosintelligence.comgithub.com
Aug 18, 2022A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a craCVE-2021-30071 · Other software · Hestiacp · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the body function at /web/api/v1/upload/UploadHandler.php.CVE-2022-36305 · Other software · Vestacp · reported by MITREMedium 6.1
Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the body function at /web/api/v1/upload/UploadHandler.php.
- Product
- Vesta Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the generate_response function at /web/api/v1/upload/UploadHandler.php.CVE-2022-36304 · Other software · Vestacp · reported by MITREMedium 6.1
Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the generate_response function at /web/api/v1/upload/UploadHandler.php.
- Product
- Vesta Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the handle_file_upload function at /web/api/v1/upload/UploadHandler.php.CVE-2022-36303 · Other software · Vestacp · reported by MITREMedium 6.1
Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the handle_file_upload function at /web/api/v1/upload/UploadHandler.php.
- Product
- Vesta Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the post function at /web/api/v1/upload/UploadHandler.php.CVE-2022-34025 · Other software · Vestacp · reported by MITREMedium 6.1
Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the post function at /web/api/v1/upload/UploadHandler.php.
- Product
- Vesta Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2022FUDForum 3.1.2 is vulnerable to Cross Site Scripting (XSS) via page_title param in Page Manager in the Admin Control Panel.CVE-2022-30863 · Other software · Fudforum · reported by MITREMedium 4.8
FUDForum 3.1.2 is vulnerable to Cross Site Scripting (XSS) via page_title param in Page Manager in the Admin Control Panel.
- Product
- Fudforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2022FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel.CVE-2022-30860 · Other software · Fudforum · reported by MITREHigh 7.2
FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel.
- Product
- Fudforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022Unsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL injection.CVE-2020-8242 · Other software · Expressionengine · reported by support@hackerone.comHigh 7.2
Unsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel access to execute the attack.
- Product
- Expressionengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Feb 11, 2022Dairy Farm Shop Management System v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if CVE-2020-36062 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Dairy Farm Shop Management System v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compromised.
- Product
- Dairy Farm Shop Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Jan 31, 2022Online Course Registration v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compromCVE-2020-36064 · Other software · Online Course Registration Project · reported by MITRECritical 9.8
Online Course Registration v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compromised.
- Product
- Online Course Registration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comprojectworlds.in
Nov 29, 2021vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php.CVE-2021-43693 · Other software · Vestacp · reported by MITRECritical 9.8
vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php.
- Product
- Vesta Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2021WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI.CVE-2021-43574 · Other software · Atmail · reported by MITREMedium 6.1
WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- Atmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.atmail.commedium.com
Aug 2, 2021An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus SofCVE-2021-37167 · Other software · Swisslog-healthcare · reported by MITRECritical 9.8
An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. A user logged in using the default credentials can gain root access to the device, which provides permissions for all of the functionality of the device.
- Product
- Hmi-3 Control Panel Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarmis.comswisslog-healthcare.com
Aug 2, 2021A buffer overflow issue leading to denial of service was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of soCVE-2021-37166 · Other software · Swisslog-healthcare · reported by MITREHigh 7.5
A buffer overflow issue leading to denial of service was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. When HMI3 starts up, it binds a local service to a TCP port on all interfaces of the device, and takes extensive time for the GUI to connect to the TCP socket, allowing the connection to be hijacked by an external attacker.
- Product
- Hmi-3 Control Panel Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarmis.comswisslog-healthcare.com
Aug 2, 2021A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software CVE-2021-37164 · Other software · Swisslog-healthcare · reported by MITRECritical 9.8
A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. In the tcpTxThread function, the received data is copied to a stack buffer. An off-by-3 condition can occur, resulting in a stack-based buffer overflow.
- Product
- Hmi-3 Control Panel Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarmis.comswisslog-healthcare.com
Aug 2, 2021An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus operated by released versions of software before Nexus Software CVE-2021-37163 · Other software · Swisslog-healthcare · reported by MITRECritical 9.8
An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus operated by released versions of software before Nexus Software 7.2.5.7. The device has two user accounts with passwords that are hardcoded.
- Product
- Hmi-3 Control Panel Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarmis.comswisslog-healthcare.com
Aug 2, 2021A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software CVE-2021-37162 · Other software · Swisslog-healthcare · reported by MITRECritical 9.8
A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. If an attacker sends a malformed UDP message, a buffer underflow occurs, leading to an out-of-bounds copy and possible remote code execution.
- Product
- Hmi-3 Control Panel Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarmis.comswisslog-healthcare.com
Aug 2, 2021A buffer overflow issue was discovered in the HMI3 Control Panel contained within the Swisslog Healthcare Nexus Panel, operated by released versions of softwareCVE-2021-37161 · Other software · Swisslog-healthcare · reported by MITRECritical 9.8
A buffer overflow issue was discovered in the HMI3 Control Panel contained within the Swisslog Healthcare Nexus Panel, operated by released versions of software before Nexus Software 7.2.5.7. A buffer overflow allows an attacker to overwrite an internal queue data structure and can lead to remote code execution.
- Product
- Hmi-3 Control Panel Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarmis.comswisslog-healthcare.com
Aug 2, 2021A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus SoftwCVE-2021-37160 · Other software · Swisslog-healthcare · reported by MITRECritical 9.8
A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. There is no firmware validation (e.g., cryptographic signature validation) during a File Upload for a firmware update.
- Product
- Hmi-3 Control Panel Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarmis.comswisslog-healthcare.com
Aug 2, 2021A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software CVE-2021-37165 · Other software · Swisslog-healthcare · reported by MITRECritical 9.8
A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. When a message is sent to the HMI TCP socket, it is forwarded to the hmiProcessMsg function through the pendingQ, and may lead to remote code execution.
- Product
- Hmi-3 Control Panel Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarmis.comswisslog-healthcare.com
Jul 22, 2021NVIDIA GPU Display Driver for Windows contains a vulnerability in the NVIDIA Control Panel application where it is susceptible to a Windows file system symbolicCVE-2021-1092 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.1
NVIDIA GPU Display Driver for Windows contains a vulnerability in the NVIDIA Control Panel application where it is susceptible to a Windows file system symbolic link attack where an unprivileged attacker can cause the applications to overwrite privileged files, resulting in potential denial of service or data loss.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Apr 8, 2021VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions.CVE-2021-30463 · Other software · Vestacp · reported by MITREHigh 7.8
VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from user.conf under the /usr/local/vesta/data/users/admin directory, the admin password can be changed via a /reset/?action=confirm&user=admin&code= URI. This occurs because chmod is used unsafely.
- Product
- Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordssd-disclosure.comssd-disclosure.com
Apr 8, 2021VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not require a password to run /usr/local/vestaCVE-2021-30462 · Other software · Vestacp · reported by MITREHigh 7.2
VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not require a password to run /usr/local/vesta/bin scripts.
- Product
- Vesta Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordssd-disclosure.comssd-disclosure.com
Mar 15, 2021web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin.CVE-2021-28379 · Other software · Myvestacp · reported by MITREHigh 8.8
web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin.
- Product
- Myvesta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 17, 2021Improper access control in the Intel(R) HD Graphics Control Panel before version 15.40.46.5144 and 15.36.39.5143 may allow an authenticated user to potentially CVE-2020-0518 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper access control in the Intel(R) HD Graphics Control Panel before version 15.40.46.5144 and 15.36.39.5143 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Graphics Drivers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2021Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customeCVE-2021-27231 · Other software · Hestiacp · reported by MITREMedium 5.4
Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email messages.
- Product
- Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2020Panasonic Security System WV-S2231L 4.25 allows a denial of service of the admin control panel (which will require a physical reset to restore administrative coCVE-2020-29194 · Other software · Panasonic · reported by MITREHigh 7.5
Panasonic Security System WV-S2231L 4.25 allows a denial of service of the admin control panel (which will require a physical reset to restore administrative control) via Randomnum=99AC8CEC6E845B28&mode=1 in a POST request to the cgi-bin/set_factory URI.
- Product
- Wv-s2231l Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.panasonic.com
Oct 2, 2020NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component in which a user is presented with a dialog box fCVE-2020-5979 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component in which a user is presented with a dialog box for input by a high-privilege process, which may lead to escalation of privileges.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jun 24, 2020NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component, in which an attacker with local system access cCVE-2020-5962 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component, in which an attacker with local system access can corrupt a system file, which may lead to denial of service or escalation of privileges.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jun 15, 2020D-link DSL-2750U ISL2750UEME3.V1E devices allow approximately 90 seconds of access to the control panel, after a restart, before MAC address filtering rules becCVE-2020-13150 · Other software · Dlink · reported by MITREHigh 7.8
D-link DSL-2750U ISL2750UEME3.V1E devices allow approximately 90 seconds of access to the control panel, after a restart, before MAC address filtering rules become active.
- Product
- Dsl-2750u Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comdlink.com
Apr 21, 2020An elevation of privilege in Vesta Control Panel through 0.9.8-26 allows an attacker to gain root system access from the admin account via v-change-user-passworCVE-2020-10787 · Other software · Vestacp · reported by MITREHigh 8.8
An elevation of privilege in Vesta Control Panel through 0.9.8-26 allows an attacker to gain root system access from the admin account via v-change-user-password (aka the user password change script).
- Product
- Vesta Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2020A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system via cron jobs.CVE-2020-10786 · Other software · Vestacp · reported by MITREHigh 8.8
A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system via cron jobs.
- Product
- Vesta Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.