Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
107 results · page 2 of 3
Jan 27, 2024An issue in Kap for macOS version 3.6.0 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settinCVE-2024-23740 · Other software · Getkap · reported by MITRECritical 9.8
An issue in Kap for macOS version 3.6.0 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings.
- Product
- KAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comelectronjs.org
Oct 27, 2023In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code.CVE-2023-40116 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Aug 30, 2023Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.CVE-2023-4624 · Other software · bookstackapp · reported by security@huntr.devLow 2.4
Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023A vulnerability was found in webbuilders-group silverstripe-kapost-bridge 0.3.3.CVE-2015-10077 · Other software · webbuilders-group · reported by VulDBMedium 6.3
A vulnerability was found in webbuilders-group silverstripe-kapost-bridge 0.3.3. It has been declared as critical. Affected by this vulnerability is the function index/getPreview of the file code/control/KapostService.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 0.4.0 is able to address this issue. The patch is named 2e14b0fd0ea35034f90890f364b130fb4645ff35. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220471.
- Product
- silverstripe-kapost-bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2022A vulnerability was found in kapetan dns up to 6.1.0.CVE-2021-4248 · Other software · kapetan · reported by VulDBMedium 5.6
A vulnerability was found in kapetan dns up to 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file DNS/Protocol/Request.cs. The manipulation leads to insufficient entropy in prng. The attack may be launched remotely. Upgrading to version 7.0.0 is able to address this issue. The name of the patch is cf7105aa2aae90d6656088fe5a8ee1d5730773b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216188.
- Product
- dns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022Boodskap IoT Platform v4.4.9-02 allows attackers to make unauthenticated API requests.CVE-2022-35136 · Other software · Boodskap · reported by MITREMedium 6.5
Boodskap IoT Platform v4.4.9-02 allows attackers to make unauthenticated API requests.
- Product
- IOT Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityblog101.blogspot.comsecurityblog101.blogspot.com
Oct 13, 2022Boodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges via a crafted request sent to /api/user/upsert/<uuid>.CVE-2022-35135 · Other software · Boodskap · reported by MITREHigh 8.8
Boodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges via a crafted request sent to /api/user/upsert/<uuid>.
- Product
- IOT Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityblog101.blogspot.comsecurityblog101.blogspot.com
Oct 13, 2022Boodskap IoT Platform v4.4.9-02 contains a cross-site scripting (XSS) vulnerability.CVE-2022-35134 · Other software · Boodskap · reported by MITREMedium 5.4
Boodskap IoT Platform v4.4.9-02 contains a cross-site scripting (XSS) vulnerability.
- Product
- IOT Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityblog101.blogspot.comsecurityblog101.blogspot.com
Jul 10, 2022The varijkapil13/Sphere_ImageBackend repository through 2019-10-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafelCVE-2022-31561 · Other software · Sphere Imagebackend Project · reported by MITRECritical 9.3
The varijkapil13/Sphere_ImageBackend repository through 2019-10-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Sphere Imagebackend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2022Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.CVE-2022-0877 · Other software · bookstackapp · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022bookstack is vulnerable to Improper Access ControlCVE-2021-4194 · Other software · bookstackapp · reported by security@huntr.devMedium 6.5
bookstack is vulnerable to Improper Access Control
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021bookstack is vulnerable to Improper Access ControlCVE-2021-4119 · Other software · bookstackapp · reported by security@huntr.devCritical 9.8
bookstack is vulnerable to Improper Access Control
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2021bookstack is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-3944 · Other software · bookstackapp · reported by security@huntr.devMedium 6.8
bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2021bookstack is vulnerable to Improper Access ControlCVE-2021-4026 · Other software · bookstackapp · reported by security@huntr.devMedium 4.3
bookstack is vulnerable to Improper Access Control
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2021bookstack is vulnerable to Unrestricted Upload of File with Dangerous TypeCVE-2021-3915 · Other software · bookstackapp · reported by security@huntr.devMedium 5.7
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2021-3916 · Other software · bookstackapp · reported by security@huntr.devMedium 6.5
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2021bookstack is vulnerable to Unrestricted Upload of File with Dangerous TypeCVE-2021-3906 · Other software · bookstackapp · reported by security@huntr.devMedium 6.5
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2021bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2021-3874 · Other software · bookstackapp · reported by security@huntr.devMedium 6.5
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2021bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3768 · Other software · bookstackapp · reported by security@huntr.devMedium 5.4
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2021bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3767 · Other software · bookstackapp · reported by security@huntr.devMedium 5.4
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2021bookstack is vulnerable to Server-Side Request Forgery (SSRF)CVE-2021-3758 · Other software · bookstackapp · reported by security@huntr.devMedium 6.5
bookstack is vulnerable to Server-Side Request Forgery (SSRF)
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2020BookStack is a platform for storing and organising information and documentation.CVE-2020-26260 · Other software · BookStackApp · reported by GitHubMedium 6.4
BookStack is a platform for storing and organising information and documentation. In BookStack before version 0.30.5, a user with permissions to edit a page could set certain image URL's to manipulate functionality in the exporting system, which would allow them to make server side requests and/or have access to a wider scope of files within the BookStack file storage locations. The issue was addressed in BookStack v0.30.5. As a workaround, page edit permissions could be limited to only those that are trusted until you can upgrade.
- Product
- BookStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbookstackapp.comgithub.com
Nov 3, 2020In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or fCVE-2020-26211 · Other software · BookStackApp · reported by GitHubHigh 7.7
In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a page could insert a particular meta tag which could be used to silently redirect users to a alternative location upon visit of a page. Dangerous content may remain in the database but will be removed before being displayed on a page. If you think this could have been exploited the linked advisory provides a SQL query to test. As a workaround without upgrading, page edit permissions could be limited to only those that are trusted until you can upgrade although this will not address existing exploitation of this vulnerability. The issue is fixed in BookStack version 0.30.4.
- Product
- BookStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2020In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clickedCVE-2020-26210 · Other software · BookStackApp · reported by GitHubHigh 7.7
In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the page. Dangerous content may remain in the database after this update. If you think this could have been exploited the linked advisory provides a SQL query to test. As a workaround, page edit permissions could be limited to only those that are trusted until you can upgrade although this will not address existing exploitation of this vulnerability. The issue is fixed in version 0.30.4.
- Product
- BookStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbookstackapp.comgithub.com
May 7, 2020In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation.CVE-2020-11055 · Other software · BookStackApp · reported by GitHubMedium 6.3
In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios where not-trusted users are given permission to create comments. This has been fixed in 0.29.2.
- Product
- BookStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpbookstackapp.com
Mar 9, 2020BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code oCVE-2020-5256 · Other software · BookStackApp · reported by GitHubHigh 7.9
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. The issue was addressed in a series of patches in versions 0.25.3, 0.25.4 and 0.25.5. Users should upgrade to at least v0.25.5 to avoid this vulnerability.
- Product
- BookStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2019Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions.CVE-2018-19014 · Other software · ICS-CERT · reported by ics-cert@hq.dhs.govMedium 6.5
Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. Log files are accessible over an unauthenticated network connection. By accessing the log files, an attacker is able to gain insights about internals of the patient monitor, the location of the monitor, and wired network configuration.
- Product
- Dräger Infinity Delta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Jan 28, 2019Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions.CVE-2018-19010 · Other software · ICS-CERT · reported by ics-cert@hq.dhs.govMedium 6.5
Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. A malformed network packet may cause the monitor to reboot. By repeatedly sending the malformed network packet, an attacker may be able to disrupt patient monitoring by causing the monitor to repeatedly reboot until it falls back to default configuration and loses network connectivity.
- Product
- Dräger Infinity Delta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Jan 28, 2019Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions.CVE-2018-19012 · Other software · ICS-CERT · reported by ics-cert@hq.dhs.govHigh 7.8
Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. Via a specific dialog it is possible to break out of the kiosk mode and reach the underlying operating system. By breaking out of the kiosk mode, an attacker is able to take control of the operating system.
- Product
- Dräger Infinity Delta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Oct 19, 2018text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random (ratherCVE-2018-18531 · Other software · Kaptcha Project · reported by MITRECritical 9.8
text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random (rather than SecureRandom) function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force approach.
- Product
- Kaptcha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2018An issue was discovered in QuickAppsCMS (aka QACMS) through 2.0.0-beta2.CVE-2018-17102 · Other software · Quickappscms · reported by MITREHigh 8.8
An issue was discovered in QuickAppsCMS (aka QACMS) through 2.0.0-beta2. A CSRF vulnerability can change the administrator password via the user/me URI.
- Product
- Quickapps CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2018The mintToken function of a smart contract implementation for KAPcoin, an Ethereum token, has an integer overflow that allows the owner of the contract to set tCVE-2018-13591 · Other software · Kapcoin Project · reported by MITREHigh 7.5
The mintToken function of a smart contract implementation for KAPcoin, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
- Product
- Kapcoin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2018The mintToken function of a smart contract implementation for KAPAYcoin, an Ethereum token, has an integer overflow that allows the owner of the contract to setCVE-2018-13498 · Other software · Kapaycoin Project · reported by MITREHigh 7.5
The mintToken function of a smart contract implementation for KAPAYcoin, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
- Product
- Kapaycoin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2018The _sell function of a smart contract implementation for GROWCHAIN (GROW), an Ethereum token, has an integer overflow.CVE-2018-13325 · Other software · Boodskap · reported by MITREHigh 7.5
The _sell function of a smart contract implementation for GROWCHAIN (GROW), an Ethereum token, has an integer overflow.
- Product
- Growchain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2018CSRF in /admin/user/manage/add in QuickAppsCMS 2.0.0-beta2 allows an unauthorized remote attacker to create an account with admin privileges.CVE-2018-9108 · Other software · Quickappscms · reported by MITREHigh 8.8
CSRF in /admin/user/manage/add in QuickAppsCMS 2.0.0-beta2 allows an unauthorized remote attacker to create an account with admin privileges.
- Product
- Quickapps CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2018BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution ofCVE-2017-1000462 · Other software · Bookstackapp · reported by MITREMedium 5.4
BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution of javascript code.
- Product
- Bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2018QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site Scripting in the user's real name field resulting in denial of service and performing unauthoriseCVE-2017-1000495 · Other software · Quickappscms · reported by MITREMedium 5.4
QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site Scripting in the user's real name field resulting in denial of service and performing unauthorised actions with an administrator user's account
- Product
- Quickapps CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2016Blind SQL Injection in wordpress plugin dukapress v2.5.9CVE-2015-1000011 · WordPress plugins & themes · reported by MITRECritical 9.8
Blind SQL Injection in wordpress plugin dukapress v2.5.9
- Affected
- 2.5.9 to 2.5.9
- What to do
- Affects 2.5.9 to 2.5.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Feb 27, 2016Untrusted search path vulnerability in the WiresharkApplication class in ui/qt/wireshark_application.cpp in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0CVE-2016-2521 · Other software · Wireshark · reported by MITREHigh 7.8
Untrusted search path vulnerability in the WiresharkApplication class in ui/qt/wireshark_application.cpp in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 on Windows allows local users to gain privileges via a Trojan horse riched20.dll.dll file in the current working directory, related to use of QLibrary.
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecuritytracker.com
Sep 21, 2015Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5CVE-2015-6938 · Other software · Jupyter · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
- Product
- Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Nov 28, 2014Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackeCVE-2014-8799 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the src parameter to lib/dp_image.php.
- Product
- Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress
- Fixed in
- 2.5.4
- What to do
- Update Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress to 2.5.4 or newer.
Full record and what to do →NVD recordsecurity.szurek.plexploit-db.com
Oct 19, 2014The Healthy Lunch Diet Recipes (aka com.best.lunchdietrecipes) application 3.6.1 for Android does not verify X.509 certificates from SSL servers, which allows mCVE-2014-7476 · Computers, phones & browsers · Androidebookapp · reported by cret@cert.orgMedium 5.4
The Healthy Lunch Diet Recipes (aka com.best.lunchdietrecipes) application 3.6.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Healthy Lunch Diet Recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Oct 2, 2014The Yik Yak (aka com.yik.yak) application 2.0.002 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to sCVE-2014-6896 · Other software · Yikyakapp · reported by cret@cert.orgMedium 5.4
The Yik Yak (aka com.yik.yak) application 2.0.002 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- YIK YAK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 15, 2014The myHomework Student Planner (aka com.myhomeowork) application 3.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-CVE-2014-5900 · Other software · Myhomeworkapp · reported by cret@cert.orgMedium 5.4
The myHomework Student Planner (aka com.myhomeowork) application 3.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Myhomework Student Planner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Jul 14, 2014kapfa.sys in Kaseya Virtual System Administrator (VSA) 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16 allows local users to cause a denial of service (NULL pointerCVE-2014-2926 · Other software · Kaseya · reported by cret@cert.orgLow 1.7
kapfa.sys in Kaseya Virtual System Administrator (VSA) 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16 allows local users to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.
- Product
- Virtual System Administrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Jan 3, 2014Cross-site request forgery (CSRF) vulnerability in askapache-firefox-adsense.php in the AskApache Firefox Adsense plugin 3.0 and earlier for WordPress allows reCVE-2013-6992 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in askapache-firefox-adsense.php in the AskApache Firefox Adsense plugin 3.0 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the aafireadcode parameter to wp-admin/options-general.php.
- Product
- AskApache Firefox Adsense
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update AskApache Firefox Adsense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordosvdb.orgsecurityfocus.com
Oct 23, 2013socketfilterfw in Application Firewall in Apple Mac OS X before 10.9 does not properly implement the --blockApp option, which allows remote attackers to bypass CVE-2013-5165 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.4
socketfilterfw in Application Firewall in Apple Mac OS X before 10.9 does not properly implement the --blockApp option, which allows remote attackers to bypass intended access restrictions via a network connection to an application for which blocking was configured.
- Product
- MAC OS X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Aug 21, 2009Cross-site scripting (XSS) vulnerability in the Search feature in elka CMS (aka Elkapax) allows remote attackers to inject arbitrary web script or HTML via the CVE-2009-2930 · Other software · Elkagroup · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Search feature in elka CMS (aka Elkapax) allows remote attackers to inject arbitrary web script or HTML via the q parameter to the default URI.
- Product
- Elkapax CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Jul 7, 2009Multiple SQL injection vulnerabilities in TekRADIUS 3.0 allow context-dependent attackers to execute arbitrary SQL commands via (1) the GUI client, as demonstraCVE-2009-2359 · Other software · Yasinkaplan · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in TekRADIUS 3.0 allow context-dependent attackers to execute arbitrary SQL commands via (1) the GUI client, as demonstrated by input to the Browse Users text box in the Users tab; or (2) the command-line client, as demonstrated by a certain trcli -r command.
- Product
- Tekradius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnth-dimension.org.uksecurityfocus.com
Jul 7, 2009TekRADIUS 3.0 uses BUILTIN\Users:R permissions for the TekRADIUS.ini file, which allows local users to obtain obfuscated database credentials by reading this fiCVE-2009-2358 · Other software · Yasinkaplan · reported by MITREMedium 4.6
TekRADIUS 3.0 uses BUILTIN\Users:R permissions for the TekRADIUS.ini file, which allows local users to obtain obfuscated database credentials by reading this file.
- Product
- Tekradius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnth-dimension.org.uksecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.