Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
68 results · page 2 of 2
Dec 4, 2023 Dell DM5500 5.14.0.0, contains a Stack-based Buffer Overflow Vulnerability in the appliance.CVE-2023-44305 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell DM5500 5.14.0.0, contains a Stack-based Buffer Overflow Vulnerability in the appliance. An unauthenticated remote attacker may exploit this vulnerability to crash the affected process or execute arbitrary code on the system by sending specially crafted input data.
- Product
- Dell PowerProtect Data Manager DM5500 Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023 Dell DM5500 contains a privilege escalation vulnerability in the appliance.CVE-2023-44304 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell DM5500 contains a privilege escalation vulnerability in the appliance. A remote attacker with low privileges could potentially exploit this vulnerability to escape the restricted shell and gain root access to the appliance.
- Product
- Dell PowerProtect Data Manager DM5500 Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023 Dell DM5500 5.14.0.0 and prior contain an improper authentication vulnerability.CVE-2023-44302 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell DM5500 5.14.0.0 and prior contain an improper authentication vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access of resources or functionality that could possibly lead to execute arbitrary code.
- Product
- Dell PowerProtect Data Manager DM5500 Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023 Dell DM5500 5.14.0.0 and prior contain a Reflected Cross-Site Scripting Vulnerability.CVE-2023-44301 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell DM5500 5.14.0.0 and prior contain a Reflected Cross-Site Scripting Vulnerability. A network attacker with low privileges could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
- Product
- Dell PowerProtect Data Manager DM5500 Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023 Dell DM5500 5.14.0.0, contain a Plain-text Password Storage Vulnerability in the appliance.CVE-2023-44300 · Other software · Dell · reported by security_alert@emc.comMedium 5.5
Dell DM5500 5.14.0.0, contain a Plain-text Password Storage Vulnerability in the appliance. A local attacker with privileges could potentially exploit this vulnerability, leading to the disclosure of certain service credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
- Product
- Dell PowerProtect Data Manager DM5500 Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023 Dell DM5500 5.14.0.0 contains an OS command injection vulnerability in the appliance.CVE-2023-44291 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell DM5500 5.14.0.0 contains an OS command injection vulnerability in the appliance. A remote attacker with high privileges could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker.
- Product
- Dell PowerProtect Data Manager DM5500 Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023Post Meta Data Manager: Cross-Site Request ForgeryCVE-2023-5776 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Post Meta Data Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the pmdm_wp_ajax_delete_meta, pmdm_wp_delete_user_meta, and pmdm_wp_delete_user_meta functions. This makes it possible for unauthenticated attackers to delete arbitrary user, term, and post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Post Meta Data Manager
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Post Meta Data Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Oct 28, 2023Post Meta Data Manager: Unauthorized modification of dataCVE-2023-5426 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_delete_user_meta, pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta functions in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to delete user, term, and post meta belonging to arbitrary users.
- Product
- Post Meta Data Manager
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Post Meta Data Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 28, 2023Post Meta Data Manager: Unauthorized modification of dataCVE-2023-5425 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_change_user_meta and pmdm_wp_change_post_meta functions in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to gain elevated (e.g., administrator) privileges.
- Product
- Post Meta Data Manager
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Post Meta Data Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 11, 2023 Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability.CVE-2023-28062 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability to bypass intended access restrictions and perform unauthorized actions.
- Product
- PPDM Reporting (PowerProtect Data Manager)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.CVE-2022-2493 · Other software · openemr · reported by security@huntr.devHigh 8.1
Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2021Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access to sensitive informCVE-2021-35526 · Other software · Hitachi ABB Power Grids · reported by cybersecurity@hitachienergy.comMedium 6.3
Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access to sensitive information. This issue affects: Hitachi ABB Power Grids System Data Manager – SDM600 1.2 versions prior to FP2 HF6 (Build Nr. 1.2.14002.257).
- Product
- System Data Manager – SDM600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comus-cert.cisa.gov
Jul 6, 2020Dell PowerProtect Data Manager (PPDM) versions prior to 19.4 and Dell PowerProtect X400 versions prior to 3.2 contain an improper authorization vulnerability.CVE-2020-5356 · Other software · Dell · reported by security_alert@emc.comHigh 7.7
Dell PowerProtect Data Manager (PPDM) versions prior to 19.4 and Dell PowerProtect X400 versions prior to 3.2 contain an improper authorization vulnerability. A remote authenticated malicious user may download any file from the affected PowerProtect virtual machines.
- Product
- Power Protect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2018Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Data Manager Server).CVE-2018-2656 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.1
Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Data Manager Server). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle General Ledger. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle General Ledger accessible data as well as unauthorized access to critical data or complete access to all Oracle General Ledger accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
- Product
- General Ledger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Dec 27, 2017A vulnerability has been identified in Siemens 7KT PAC1200 data manager (7KT1260) in all versions < V2.03.CVE-2017-9944 · Other software · Siemens · reported by productcert@siemens.comCritical 9.8
A vulnerability has been identified in Siemens 7KT PAC1200 data manager (7KT1260) in all versions < V2.03. The integrated web server (port 80/tcp) of the affected devices could allow an unauthenticated remote attacker to perform administrative operations over the network.
- Product
- 7kt Pac1200 Data Manager Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsiemens.com
Sep 25, 2015Resource Data Management Data Manager before 2.2 allows remote authenticated users to modify arbitrary passwords via unspecified vectors.CVE-2015-6470 · Other software · Resource Data Management Data Manager · reported by ics-cert@hq.dhs.govMedium 5.5
Resource Data Management Data Manager before 2.2 allows remote authenticated users to modify arbitrary passwords via unspecified vectors.
- Product
- Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Sep 25, 2015Cross-site request forgery (CSRF) vulnerability in Resource Data Management Data Manager before 2.2 allows remote attackers to hijack the authentication of unspCVE-2015-6468 · Other software · Resource Data Management Data Manager · reported by ics-cert@hq.dhs.govMedium 6.8
Cross-site request forgery (CSRF) vulnerability in Resource Data Management Data Manager before 2.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
- Product
- Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Jun 18, 2014SQL injection vulnerability in the web service in F5 ARX Data Manager 3.0.0 through 3.1.0 allows remote authenticated users to execute arbitrary SQL commands viCVE-2014-2949 · Network & remote access · F5 · reported by cret@cert.orgMedium 6.5
SQL injection vulnerability in the web service in F5 ARX Data Manager 3.0.0 through 3.1.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
- Product
- ARX Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comkb.cert.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.