Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
105 results · page 2 of 3
Sep 3, 2023A vulnerability, which was classified as critical, was found in IBOS OA 4.5.5.CVE-2023-4740 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in IBOS OA 4.5.5. This affects an unknown part of the file ?r=email/api/delDraft&archiveId=0 of the component Delete Draft Handler. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238629 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2023A vulnerability has been found in IBOS OA 4.5.5 and classified as critical.CVE-2023-4713 · Other software · IBOS · reported by VulDBMedium 5.5
A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects the function addComment of the file ?r=weibo/comment/addcomment. The manipulation of the argument touid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238576. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2023A vulnerability was found in IBOS OA 4.5.5.CVE-2023-4545 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability was found in IBOS OA 4.5.5. It has been classified as critical. Affected is an unknown function of the file ?r=recruit/bgchecks/export&checkids=x. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238056. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2023A vulnerability was found in IBOS OA 4.5.5.CVE-2023-4543 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability was found in IBOS OA 4.5.5. It has been declared as critical. This vulnerability affects unknown code of the file ?r=recruit/contact/export&contactids=x. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238048. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2023Cross Site Scripting vulnerability in Qibosoft qibosoft v.7 and before allows a remote attacker to execute arbitrary code via the eindtijd and starttijd parametCVE-2020-20808 · Other software · Qibosoft · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Qibosoft qibosoft v.7 and before allows a remote attacker to execute arbitrary code via the eindtijd and starttijd parameters of do/search.php.
- Product
- Qibosoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability has been found in IBOS OA 4.5.5 and classified as critical.CVE-2023-3826 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /?r=recruit/resume/edit&op=status of the component Interview Handler. The manipulation of the argument resumeid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235147. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability was found in IBOS OA 4.5.5.CVE-2023-3801 · Other software · IBOS · reported by VulDBMedium 5.5
A vulnerability was found in IBOS OA 4.5.5. It has been declared as critical. Affected by this vulnerability is the function actionEdit of the file ?r=officialdoc/officialdoc/edit of the component Mobile Notification Handler. The manipulation leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-235069 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability was found in IBOS OA 4.5.5 and classified as critical.CVE-2023-3799 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability was found in IBOS OA 4.5.5 and classified as critical. This issue affects some unknown processing of the file ?r=article/category/del of the component Delete Category Handler. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235067. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability was found in IBOS OA 4.5.5 and classified as critical.CVE-2023-3791 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability was found in IBOS OA 4.5.5 and classified as critical. Affected by this issue is the function actionExport of the file ?r=contact/default/export of the component Personal Office Address Book. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-235058 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023A vulnerability was found in IBOS OA 4.5.5.CVE-2023-3621 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability was found in IBOS OA 4.5.5. It has been classified as critical. Affected is the function createDeleteCommand of the file ?r=article/default/delete of the component Delete Packet. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-233574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023A vulnerability classified as critical was found in IBOS OA 4.5.5.CVE-2023-3478 · Other software · IBOS · reported by VulDBMedium 4.7
A vulnerability classified as critical was found in IBOS OA 4.5.5. Affected by this vulnerability is the function actionEdit of the file ?r=dashboard/roleadmin/edit&op=member of the component Add User Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232759. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023A vulnerability has been found in IBOS OA 4.5.5 and classified as critical.CVE-2023-3449 · Other software · IBOS · reported by VulDBMedium 5.5
A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects the function actionExport of the file ?r=recruit/interview/export&interviews=x of the component Interview Management Export. The manipulation of the argument interviews leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-232546 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2023FiboSearch - AJAX Search for WooCommerce: Stored Cross-Site ScriptingCVE-2023-2450 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.23.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- FiboSearch - AJAX Search for WooCommerce
- Affected
- up to 1.23.0
- What to do
- Affects up to 1.23.0. Update FiboSearch - AJAX Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 5, 2023A vulnerability, which was classified as critical, has been found in IBOS 4.5.5.CVE-2023-3100 · Other software · Ibos · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in IBOS 4.5.5. Affected by this issue is the function actionDel of the file ?r=dashboard/approval/del. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-230690 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Xibo is a content management system (CMS).CVE-2023-33181 · Other software · xibosignage · reported by GitHubMedium 4.3
Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Xibo is a content management system (CMS).CVE-2023-33180 · Other software · xibosignage · reported by GitHubMedium 6.5
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.2 in the `/display/map` API route inside the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values in to the `bounds` parameter. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Xibo is a content management system (CMS).CVE-2023-33179 · Other software · xibosignage · reported by GitHubMedium 6.5
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.5 in the `nameFilter` function used throughout the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values for logical operators. Users should upgrade to version 3.3.5 which fixes this issue. There are no known workarounds aside from upgrading.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Xibo is a content management system (CMS).CVE-2023-33178 · Other software · xibosignage · reported by GitHubMedium 6.5
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `/dataset/data/{id}` API route inside the CMS starting in version 1.4.0 and prior to versions 2.3.17 and 3.3.5. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values in to the `filter` parameter. Values allowed in the filter parameter are checked against a deny list of commands that should not be allowed, however this checking was done in a case sensitive manor and so it is possible to bypass these checks by using unusual case combinations. Users should upgrade to version 2.3.17 or 3.3.5, which fix this issue. There are no workarounds aside from upgrading.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Xibo is a content management system (CMS).CVE-2023-33177 · Other software · xibosignage · reported by GitHubHigh 8.8
Xibo is a content management system (CMS). A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CMS via the layout import function by an authenticated user which would allow creation of files outside of the CMS library directory as the webserver user. This can be used to upload a PHP webshell inside the web root directory and achieve remote code execution as the webserver user. Users should upgrade to version 2.3.17 or 3.3.5, which fix this issue. Customers who host their CMS with Xibo Signage have already received an upgrade or patch to resolve this issue regardless of the CMS version that they are running.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.CVE-2023-29480 · Other software · Ribose · reported by MITREHigh 7.5
Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.
- Product
- RNP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Ribose RNP before 0.16.3 may hang when the input is malformed.CVE-2023-29479 · Other software · Ribose · reported by MITREMedium 5.3
Ribose RNP before 0.16.3 may hang when the input is malformed.
- Product
- RNP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.ribose.comopen.ribose.com
Apr 21, 2023Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm.CVE-2021-33589 · Other software · Ribose · reported by MITREHigh 7.5
Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm.
- Product
- RNP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopen.ribose.comribose.com
Apr 15, 2023A vulnerability, which was classified as critical, was found in IBOS 4.5.5.CVE-2023-2107 · Other software · Ibos · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in IBOS 4.5.5. Affected is an unknown function of the file file/personal/del&op=recycle. The manipulation of the argument fids leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226110 is the identifier assigned to this vulnerability.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023A vulnerability has been found in IBOS up to 4.5.4 and classified as critical.CVE-2023-1747 · Other software · Ibos · reported by VulDBMedium 6.3
A vulnerability has been found in IBOS up to 4.5.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /?r=email/api/mark&op=delFromSend. The manipulation of the argument emailids leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.5.5 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-224635.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023A vulnerability classified as critical was found in IBOS 4.5.5.CVE-2023-1744 · Other software · Ibos · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in IBOS 4.5.5. This vulnerability affects unknown code of the component htaccess Handler. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224632.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023A vulnerability was found in IBOS 4.5.5.CVE-2023-1742 · Other software · Ibos · reported by VulDBMedium 6.3
A vulnerability was found in IBOS 4.5.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /?r=report/api/getlist of the component Report Search. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-224630 is the identifier assigned to this vulnerability.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2023A vulnerability classified as critical has been found in IBOS 4.5.5.CVE-2023-1494 · Other software · Ibos · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in IBOS 4.5.5. Affected is an unknown function of the file ApiController.php. The manipulation of the argument emailids leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223380.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023Qibosoft QiboCMS v7 was discovered to contain a remote code execution (RCE) vulnerability via the Get_Title function at label_set_rs.phpCVE-2023-27037 · Other software · Qibosoft · reported by MITREHigh 8.8
Qibosoft QiboCMS v7 was discovered to contain a remote code execution (RCE) vulnerability via the Get_Title function at label_set_rs.php
- Product
- Qibocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023A vulnerability, which was classified as problematic, has been found in IBOS up to 4.5.5.CVE-2023-1278 · Other software · Ibos · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in IBOS up to 4.5.5. Affected by this issue is some unknown functionality of the file mobil/index.php. The manipulation of the argument accesstoken leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-222608.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2022FiboSearch: Does not sanitise and escape some of its settingsCVE-2022-1469 · WordPress plugins & themes · reported by WPScanMedium 4.8
The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- FiboSearch
- Fixed in
- 1.17.0
- What to do
- Update FiboSearch to 1.17.0 or newer.
Dec 27, 2021Qibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component /admin/index.php?lfj=friendlink&action=add.CVE-2020-20946 · Other software · Qibosoft · reported by MITREMedium 5.4
Qibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component /admin/index.php?lfj=friendlink&action=add.
- Product
- Qibosoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqibosoft.comblog.csdn.net
Dec 27, 2021A Cross-Site Request Forgery (CSRF) in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add administrator accounts.CVE-2020-20945 · Other software · Qibosoft · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add administrator accounts.
- Product
- Qibosoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqibosoft.comblog.csdn.net
Dec 27, 2021An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files.CVE-2020-20944 · Other software · Qibosoft · reported by MITRECritical 9.1
An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files.
- Product
- Qibosoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqibosoft.comblog.csdn.net
Dec 27, 2021A Cross-Site Request Forgery (CSRF) in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing CVE-2020-20943 · Other software · Qibosoft · reported by MITREMedium 4.3
A Cross-Site Request Forgery (CSRF) in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing new articles via a crafted URL.
- Product
- Qibosoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netblog.csdn.net
Jun 24, 2021In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php.CVE-2020-21786 · Other software · Ibos · reported by MITRECritical 9.8
In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021In IBOS 4.5.4 Open, the database backup has Command Injection Vulnerability.CVE-2020-21785 · Other software · Ibos · reported by MITREHigh 8.8
In IBOS 4.5.4 Open, the database backup has Command Injection Vulnerability.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021In IBOS 4.5.4 the email function has a cross site scripting (XSS) vulnerability in emailbody[content] parameter.CVE-2020-21783 · Other software · Ibos · reported by MITREMedium 6.1
In IBOS 4.5.4 the email function has a cross site scripting (XSS) vulnerability in emailbody[content] parameter.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2021A code injection vulnerability has been discovered in the Upgrade function of QibosoftX1 v1.0.CVE-2021-27811 · Other software · Qibosoft · reported by MITREHigh 7.2
A code injection vulnerability has been discovered in the Upgrade function of QibosoftX1 v1.0. An attacker is able execute arbitrary PHP code via exploitation of client_upgrade_edition.php and Upgrade.php.
- Product
- Qibosoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2021Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information by injecting arbCVE-2020-18022 · Other software · Qibosoft · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information by injecting arbitrary commands in a HTTP request to the "ewebeditor\3.1.1\kindeditor.js" component.
- Product
- Qibocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2019qibosoft 7 allows remote code execution because do/jf.php makes eval calls.CVE-2019-17613 · Other software · Qibosoft · reported by MITRECritical 9.8
qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in the content parameter.
- Product
- Qibosoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2019libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line.CVE-2019-13313 · Other software · Libosinfo · reported by MITREHigh 7.8
libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line.
- Product
- Libosinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comaccess.redhat.com
Jan 8, 2019qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web siCVE-2019-5725 · Other software · Qibosoft · reported by MITREHigh 7.5
qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file.
- Product
- Qibosoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2018qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account.CVE-2018-18201 · Other software · Qibosoft · reported by MITREHigh 8.8
qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account.
- Product
- Qibosoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2018In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during PKCVE-2018-15836 · Other software · Xelerance · reported by MITREHigh 7.5
In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used. IKEv2 signature verification is affected when RAW RSA keys are used.
- Product
- Openswan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2018IBOS 4.4.3 has XSS via a company full name.CVE-2018-9130 · Other software · Ibos · reported by MITREMedium 6.1
IBOS 4.4.3 has XSS via a company full name.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcnonce.github.iogithub.com
Apr 13, 2017In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2CVE-2017-7853 · Other software · GNU · reported by MITREHigh 7.5
In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2/osip_message_parse.c, resulting in a remote DoS.
- Product
- Osip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Apr 13, 2017In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_body_to_str() function defined in osipparser2/osip_body.c,CVE-2016-10326 · Other software · GNU · reported by MITREHigh 7.5
In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_body_to_str() function defined in osipparser2/osip_body.c, resulting in a remote DoS.
- Product
- Osip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Apr 13, 2017In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the _osip_message_to_str() function defined in osipparser2/osip_mesCVE-2016-10325 · Other software · GNU · reported by MITREHigh 7.5
In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the _osip_message_to_str() function defined in osipparser2/osip_message_to_str.c, resulting in a remote DoS.
- Product
- Osip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Apr 13, 2017In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_clrncpy() function defined in osipparser2/osip_port.c.CVE-2016-10324 · Other software · GNU · reported by MITRECritical 9.8
In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_clrncpy() function defined in osipparser2/osip_port.c.
- Product
- Osip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Jan 29, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of admCVE-2013-4889 · Other software · Xibosignage · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new administrator via the AddUser action or (2) conduct cross-site scripting (XSS) attacks, as demonstrated by CVE-2013-4888.
- Product
- Xibo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfosec42.blogspot.cominfosec42.blogspot.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.