Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

117 results · page 2 of 3

Oct 11, 2023An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to the echo_driver.sys component.CVE-2023-38817 · Other software · Echo · reported by MITREHigh 7.8
An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to the echo_driver.sys component. NOTE: the vendor's position is that the reported ability for user-mode applications to execute code as NT AUTHORITY\SYSTEM was "deactivated by Microsoft itself."
Product
Anti Cheat Tool
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ioctl.fail ioctl.fail
Sep 23, 2023An information leak was discovered in OpenStack heat.CVE-2023-1625 · Other software · Red Hat · reported by Red HatHigh 7.4
An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.
Product
Red Hat OpenStack Platform 13 (Queens)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Jul 5, 2023A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file.CVE-2023-30207 · Other software · Kodi · reported by MITREMedium 5.5
A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file.
Product
Kodi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 3, 2023A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the valCVE-2023-23082 · Other software · Kodi · reported by MITREMedium 4.6
A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the value passed to the offset argument.
Product
Kodi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 14, 2022The HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unprivileged function calls, allowing local, CVE-2020-36603 · Other software · Hoyoverse · reported by MITREMedium 6.5
The HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unprivileged function calls, allowing local, unprivileged users to execute arbitrary code with SYSTEM privileges on Microsoft Windows systems. The mhyprot2.sys driver must first be installed by a user with administrative privileges.
Product
Mhyprot2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 26, 2022A flaw was found in openstack-tripleo-heat-templates.CVE-2021-3585 · Other software · Openstack · reported by Red HatMedium 5.5
A flaw was found in openstack-tripleo-heat-templates. Plain passwords from RHSM exist in the logs during OSP13 deployment with subscription-manager.
Product
Tripleo Heat Templates
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugs.launchpad.net
Jul 27, 2022Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackers with Overall/Read pCVE-2022-36913 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Product
Jenkins Openstack Heat Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Jul 27, 2022A missing permission check in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URCVE-2022-36912 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Product
Jenkins Openstack Heat Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Jul 27, 2022A cross-site request forgery (CSRF) vulnerability in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers to connect to an attacker-specified URL.CVE-2022-36911 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
A cross-site request forgery (CSRF) vulnerability in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers to connect to an attacker-specified URL.
Product
Jenkins Openstack Heat Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Mar 23, 2022An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname.CVE-2021-4180 · Other software · Openstack · reported by Red HatMedium 4.3
An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the www_authenticate_uri parameter (which is visible to all end users) in configuration files. This would give sensitive information which may aid in additional system exploitation. This flaw affects openstack-tripleo-heat-templates versions prior to 11.6.1.
Product
Tripleo Heat Templates
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com bugzilla.redhat.com
Feb 11, 2022Unprotected component vulnerability in StTheaterModeDurationAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applicationsCVE-2022-23997 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Unprotected component vulnerability in StTheaterModeDurationAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to disable theater mode without a proper permission.
Product
Samsung Wearable Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Feb 11, 2022Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to enable beCVE-2022-23996 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to enable bedtime mode without a proper permission.
Product
Samsung Wearable Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Nov 11, 2021The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and triggeCVE-2002-20001 · Other software · Balasys · reported by MITREHigh 7.5
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.
Product
Dheater
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com dheatattack.com
Oct 21, 2021Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to desCVE-2021-39321 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function.
Product
Sassy Social Share
Affected
3.3.23 to 3.3.23
What to do
Affects 3.3.23 to 3.3.23. Update Sassy Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 6, 2020Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the ‘HEATRemoteService’ agent.CVE-2020-12441 · Network & remote access · Ivanti · reported by MITRECritical 9.8
Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the ‘HEATRemoteService’ agent. The DoS can be triggered by sending a specially crafted network packet.
Product
Desktop&server Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com insinuator.net
Jun 21, 2019OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances.CVE-2016-7404 · Other software · Openstack · reported by MITRECritical 9.8
OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform.
Product
Magnum
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.launchpad.net bugzilla.suse.com
Jul 30, 2018A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40.CVE-2018-10898 · Other software · [UNKNOWN] · reported by Red HatHigh 8.8
A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials.
Product
openstack-tripleo-heat-templates
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Jul 27, 2018An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made wCVE-2017-2621 · Other software · Red Hat · reported by Red HatMedium 5.5
An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information.
Product
openstack-heat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com access.redhat.com
Feb 22, 2018SQL Injection exists in the OS Property Real Estate 3.12.7 component for Joomla! via the cooling_system1, heating_system1, or laundry parameter.CVE-2018-7319 · Other software · OS Property Real Estate Project · reported by MITRECritical 9.8
SQL Injection exists in the OS Property Real Estate 3.12.7 component for Joomla! via the cooling_system1, heating_system1, or laundry parameter.
Product
OS Property Real Estate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 15, 2018Ivanti Endpoint Security (formerly HEAT Endpoint Management and Security Suite) 8.5 Update 1 and earlier allows an authenticated user with low privileges and acCVE-2018-6316 · Network & remote access · Ivanti · reported by MITREHigh 7.5
Ivanti Endpoint Security (formerly HEAT Endpoint Management and Security Suite) 8.5 Update 1 and earlier allows an authenticated user with low privileges and access to the local network to bypass application whitelisting when using the Application Control module on Ivanti Endpoint Security in lockdown mode.
Product
Endpoint Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.ivanti.com community.ivanti.com
Dec 28, 2017PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter.CVE-2017-17941 · Other software · Single Theater Booking Script Project · reported by MITREHigh 7.2
PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter.
Product
Single Theater Booking Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 28, 2017PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php.CVE-2017-17940 · Other software · Single Theater Booking Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php.
Product
Single Theater Booking Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 28, 2017PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php.CVE-2017-17939 · Other software · Single Theater Booking Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php.
Product
Single Theater Booking Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 28, 2017PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter.CVE-2017-17938 · Other software · Single Theater Booking Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter.
Product
Single Theater Booking Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 13, 2017Single Theater Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.CVE-2017-17634 · Other software · Single Theater Booking Script Project · reported by MITRECritical 9.8
Single Theater Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
Product
Single Theater Booking Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017Multiplex Movie Theater Booking Script 3.1.5 has SQL Injection via the trailer-detail.php moid parameter, show-time.php moid parameter, or event-detail.php eid CVE-2017-17633 · Other software · Multiplex Movie Theater Booking Script Project · reported by MITRECritical 9.8
Multiplex Movie Theater Booking Script 3.1.5 has SQL Injection via the trailer-detail.php moid parameter, show-time.php moid parameter, or event-detail.php eid parameter.
Product
Multiplex Movie Theater Booking Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 12, 2017A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable.CVE-2017-12155 · Other software · OpenStack · reported by Red HatMedium 6.3
A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.
Product
openstack-tripleo-heat-templates
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Nov 27, 2017When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority as all non-libvirtd CVE-2017-15114 · Other software · Redhat · reported by Red HatHigh 8.1
When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority as all non-libvirtd services. As no additional authentication is configured this allows these services to connect to libvirtd (which is equivalent to root access). If a vulnerability exists in another service it could, combined with this flaw, be exploited to escalate privileges to gain control over compute nodes.
Product
Openstack Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com git.openstack.org
Sep 7, 2017Multiple cross-site scripting (XSS) vulnerabilities in NexusPHP allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) cheaters.CVE-2017-12906 · Other software · Nexusphp Project · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in NexusPHP allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) cheaters.php or (2) confirm_resend.php.
Product
Nexusphp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record loid.online sstrunk.com
Aug 24, 2017SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.CVE-2017-12679 · Other software · Nexusphp · reported by MITRECritical 9.8
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
Product
Nexusphp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 14, 2017An Uncontrolled Search Path Element issue was discovered in Solar Controls Heating Control Downloader (HCDownloader) Version 1.0.1.15 and prior.CVE-2017-9646 · Other software · Solarcontrols · reported by ics-cert@hq.dhs.govHigh 7.8
An Uncontrolled Search Path Element issue was discovered in Solar Controls Heating Control Downloader (HCDownloader) Version 1.0.1.15 and prior. An uncontrolled search path element has been identified, which could allow an attacker to execute arbitrary code on a target system using a malicious DLL file.
Product
Heating Control Downloader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Nov 4, 2016In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal network configuration.CVE-2016-9185 · Other software · Openstack · reported by MITREMedium 4.3
In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal network configuration. Affected versions are <=5.0.3, >=6.0.0 <=6.1.0, and ==7.0.0.
Product
Heat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com access.redhat.com
Oct 10, 2016Reflected XSS in wordpress plugin heat-trackr v1.0CVE-2016-1000136 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin heat-trackr v1.0
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Apr 15, 2016The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb CVE-2015-5271 · Other software · Redhat · reported by Red HatHigh 7.5
The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive information from private containers via unspecified vectors.
Product
Openstack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugs.launchpad.net
Apr 11, 2016The TripleO Heat templates (tripleo-heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 7.0, do not properly use the configured RabbitMQ creCVE-2015-5329 · Other software · Redhat · reported by Red HatHigh 7.3
The TripleO Heat templates (tripleo-heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 7.0, do not properly use the configured RabbitMQ credentials, which makes it easier for remote attackers to obtain access to services in deployed overclouds by leveraging knowledge of the default credentials.
Product
Openstack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Apr 11, 2016The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata CVE-2015-5303 · Other software · Openstack · reported by Red HatHigh 7.5
The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter.
Product
Tripleo Heat Templates
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugs.launchpad.net
Jan 20, 2016The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users toCVE-2015-5295 · Other software · Openstack · reported by Red HatMedium 5.4
The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero.
Product
Orchestration API
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org rhn.redhat.com
Dec 27, 2015The login page in Epiphany Cardio Server 3.3, 4.0, and 4.1 mishandles authentication requests, which allows remote attackers to conduct LDAP injection attacks, CVE-2015-6538 · Other software · Ephiphanyheathdata · reported by MITRECritical 9.8
The login page in Epiphany Cardio Server 3.3, 4.0, and 4.1 mishandles authentication requests, which allows remote attackers to conduct LDAP injection attacks, and consequently bypass intended access restrictions, via a crafted URL.
Product
Cardio Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record epiphanyhealthdata.com kb.cert.org
Nov 16, 2015drivers/usb/serial/whiteheat.c in the Linux kernel before 4.2.4 allows physically proximate attackers to cause a denial of service (NULL pointer dereference andCVE-2015-5257 · Computers, phones & browsers · Linux · reported by Red HatMedium 4.9
drivers/usb/serial/whiteheat.c in the Linux kernel before 4.2.4 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a crafted USB device. NOTE: this ID was incorrectly used for an Apache Cordova issue that has the correct ID of CVE-2015-8320.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org debian.org
Jun 18, 2015Cross-site request forgery (CSRF) vulnerability in ClickHeat 1.14 and earlier allows remote attackers to hijack the authentication of administrators for requestCVE-2015-4659 · Other software · Labsmedia · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in ClickHeat 1.14 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a config action to index.php.
Product
Clickheat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exploit-db.com
Jan 1, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in Argyle Social 2011-04-26 allow remote attackers to hijack the authentication of administrators forCVE-2011-5298 · Other software · Viralheat · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in Argyle Social 2011-04-26 allow remote attackers to hijack the authentication of administrators for requests that (1) modify credentials via the role parameter to users/create/, (2) modify rules via the terms field in stream_filter_rule JSON data to settings-ajax/stream_filter_rules/create, or (3) modify efforts via the title field in effort JSON data to publish-ajax/efforts/create.
Product
Argyle Social
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record htbridge.com htbridge.com
Sep 28, 2014Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel beCVE-2014-3185 · Computers, phones & browsers · Linux · reported by chrome-cve-admin@google.comMedium 6.9
Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel before 3.16.2 allow physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org lists.opensuse.org
Jun 2, 2014OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables CVE-2014-0042 · Other software · Redhat · reported by Red HatMedium 4.3
OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors.
Product
Openstack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com bugs.launchpad.net
Jun 2, 2014OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets sslverify to false for certain Yum repositories, whiCVE-2014-0041 · Other software · Redhat · reported by Red HatMedium 4.3
OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets sslverify to false for certain Yum repositories, which disables SSL protection and allows man-in-the-middle attackers to prevent updates via unspecified vectors.
Product
Openstack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com bugs.launchpad.net
Jun 2, 2014OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) CVE-2014-0040 · Other software · Redhat · reported by Red HatMedium 4.3
OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent updates via unspecified vectors.
Product
Openstack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com bugs.launchpad.net
May 23, 2014OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticCVE-2014-3801 · Other software · Openstack · reported by MITRELow 3.5
OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticated users to obtain the provider template URL via the resource-type-list.
Product
Heat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com openwall.com
Dec 14, 2013The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant CVE-2013-6428 · Other software · Openstack · reported by Red HatMedium 4
The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.
Product
Heat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com seclists.org
Dec 14, 2013The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rCVE-2013-6426 · Other software · Openstack · reported by Red HatMedium 4
The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and (1) create a stack via the CreateStack method or (2) update a stack via the UpdateStack method.
Product
Heat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com openwall.com
Mar 30, 2010Unspecified vulnerability in the ClickHeat plugin, as used in phpMyVisites before 2.4, has unknown impact and attack vectors.CVE-2009-4763 · Websites & servers · Phpmyvisites · reported by MITREMedium 6.8
Unspecified vulnerability in the ClickHeat plugin, as used in phpMyVisites before 2.4, has unknown impact and attack vectors. NOTE: due to lack of details from the vendor, it is not clear whether this is related to CVE-2008-5793.
Product
Phpmyvisites
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com phpmyvisites.us
Oct 9, 2009Multiple SQL injection vulnerabilities in the Call Logging feature in FrontRange HEAT 8.01 allow remote attackers to execute arbitrary SQL commands via the (1) CVE-2009-3642 · Other software · Frontrange · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in the Call Logging feature in FrontRange HEAT 8.01 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
Product
Heat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.org secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.