Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
95 results · page 2 of 2
Jan 9, 2023Slimstat Analytics: Does not sanitise and escape the URICVE-2022-4310 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slimstat Analytics WordPress plugin before 4.9.3 does not sanitise and escape the URI when logging requests, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against logged in admin viewing the logs
- Product
- Slimstat Analytics
- Fixed in
- 4.9.3
- What to do
- Update Slimstat Analytics to 4.9.3 or newer.
Dec 16, 2022In ProtocolImsBuilder::BuildSetConfig of protocolimsbuilder.cpp, there is a possible out of bounds read due to a missing bounds check.CVE-2022-42514 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In ProtocolImsBuilder::BuildSetConfig of protocolimsbuilder.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-241763298References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 5, 2022SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter.CVE-2022-45019 · Other software · Slims · reported by MITREHigh 7.5
SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collType parameter at loan_by_class.php.CVE-2022-43362 · Other software · Slims · reported by MITREHigh 7.2
Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collType parameter at loan_by_class.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component pop_chart.php.CVE-2022-43361 · Other software · Slims · reported by MITREMedium 4.8
Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component pop_chart.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliography/marcsru.php andCVE-2022-38292 · Other software · Slims · reported by MITRECritical 9.8
SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliography/marcsru.php and /bibliography/z3950sru.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function.CVE-2022-38291 · Other software · Slims · reported by MITREMedium 6.1
SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search bar.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022Slims9 Bulian 9.4.2 is affected by SQL injection in /admin/modules/system/backup.php.CVE-2021-45794 · Other software · Slims · reported by MITREHigh 7.5
Slims9 Bulian 9.4.2 is affected by SQL injection in /admin/modules/system/backup.php. User data can be obtained.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php.CVE-2021-45793 · Other software · Slims · reported by MITREHigh 7.5
Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022Slims9 Bulian 9.4.2 is affected by Cross Site Scripting (XSS) in /admin/modules/system/custom_field.php.CVE-2021-45792 · Other software · Slims · reported by MITREMedium 4.8
Slims9 Bulian 9.4.2 is affected by Cross Site Scripting (XSS) in /admin/modules/system/custom_field.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022Slims8 Akasia 8.3.1 is affected by SQL injection in /admin/modules/bibliography/index.php, /admin/modules/membership/member_type.php, /admin/modules/system/userCVE-2021-45791 · Other software · Slims · reported by MITREHigh 8.8
Slims8 Akasia 8.3.1 is affected by SQL injection in /admin/modules/bibliography/index.php, /admin/modules/membership/member_type.php, /admin/modules/system/user_group.php, and /admin/modules/membership/index.php through the dir parameter. It can be used by remotely authenticated librarian users.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2020LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names.CVE-2020-7959 · Other software · Labvantage · reported by MITREMedium 5.3
LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example, the web application exposes the database name. An attacker might be able to enumerate database names by providing his own database name in a request, because the response will return an 'Unrecognized Database exception message if the database does not exist.
- Product
- Labvantage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Aug 21, 2019The wp-slimstat plugin before 4.8.1 for WordPress has XSS.CVE-2019-15112 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-slimstat plugin before 4.8.1 for WordPress has XSS.
- Product
- wp-slimstat
- Fixed in
- 4.8.1
- What to do
- Update wp-slimstat to 4.8.1 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Oct 7, 2018The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-basedCVE-2015-9273 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
- Product
- wp-slimstat (aka Slimstat Analytics)
- Fixed in
- 4.1.6.1
- What to do
- Update wp-slimstat (aka Slimstat Analytics) to 4.1.6.1 or newer.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Jun 22, 2018SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrf_token parameter.CVE-2018-12659 · Other software · Slims Akasia Project · reported by MITREHigh 8.8
SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrf_token parameter.
- Product
- Slims Akasia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2018Reflected Cross-Site Scripting (XSS) exists in the Stock Take module in SLiMS 8 Akasia 8.3.1 via an admin/modules/stock_take/index.php?keywords= URI.CVE-2018-12658 · Other software · Slims Project · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) exists in the Stock Take module in SLiMS 8 Akasia 8.3.1 via an admin/modules/stock_take/index.php?keywords= URI.
- Product
- Slims
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2018Reflected Cross-Site Scripting (XSS) exists in the Master File module in SLiMS 8 Akasia 8.3.1 via an admin/modules/master_file/rda_cmc.php?keywords= URI.CVE-2018-12657 · Other software · Slims Akasia Project · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) exists in the Master File module in SLiMS 8 Akasia 8.3.1 via an admin/modules/master_file/rda_cmc.php?keywords= URI.
- Product
- Slims Akasia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2018Reflected Cross-Site Scripting (XSS) exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywords= URI.CVE-2018-12656 · Other software · Slims Akasia Project · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywords= URI.
- Product
- Slims Akasia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2018Reflected Cross-Site Scripting (XSS) exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loan_rules.php?keywords= URI, a rCVE-2018-12655 · Other software · Slims Akasia Project · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loan_rules.php?keywords= URI, a related issue to CVE-2017-7242.
- Product
- Slims Akasia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2018Reflected Cross-Site Scripting (XSS) exists in the Bibliography module in SLiMS 8 Akasia 8.3.1 via an admin/modules/bibliography/index.php?keywords= URI.CVE-2018-12654 · Other software · Slims Akasia Project · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) exists in the Bibliography module in SLiMS 8 Akasia 8.3.1 via an admin/modules/bibliography/index.php?keywords= URI.
- Product
- Slims Akasia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2017SLiMS 8 Akasia through 8.3.1 has an arbitrary file reading issue because of directory traversal in the url parameter to admin/help.php.CVE-2017-12586 · Other software · Slims · reported by MITREMedium 6.5
SLiMS 8 Akasia through 8.3.1 has an arbitrary file reading issue because of directory traversal in the url parameter to admin/help.php. It can be exploited by remote authenticated librarian users.
- Product
- Akasia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2017SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAX_lookup_handler.php (tableName and tableFields parameters), admin/AJAX_check_id.php, and admin/AJAX_CVE-2017-12585 · Other software · Slims · reported by MITREHigh 8.8
SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAX_lookup_handler.php (tableName and tableFields parameters), admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. It can be exploited by remote authenticated librarian users.
- Product
- Akasia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2017There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1.CVE-2017-12584 · Other software · Slims · reported by MITREHigh 8.8
There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile (including the password) can be updated without sending the current password. This allows remote attackers to trick a user into changing to an attacker-controlled password, a complete account takeover, via the passwd1 and passwd2 fields in an admin/modules/system/app_user.php changecurrent=true operation.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2017Multiple Cross-Site Scripting (XSS) were discovered in admin/modules components in SLiMS 7 Cendana through 2017-03-23: the keywords parameter to bibliography/chCVE-2017-7242 · Other software · Slims · reported by MITREMedium 6.1
Multiple Cross-Site Scripting (XSS) were discovered in admin/modules components in SLiMS 7 Cendana through 2017-03-23: the keywords parameter to bibliography/checkout_item.php, bibliography/dl_print.php, bibliography/item.php, bibliography/item_barcode_generator.php, bibliography/printed_card.php, circulation/loan_rules.php, master_file/author.php, master_file/coll_type.php, and master_file/doc_language.php and the quickReturnID field to circulation/ajax_action.php.
- Product
- Slims7 Cendana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddaimacn.comsecurityfocus.com
Mar 21, 2017Multiple Cross-Site Scripting (XSS) were discovered in SLiMS 7 Cendana before 2017-03-16.CVE-2017-7202 · Other software · Slims · reported by MITREMedium 6.1
Multiple Cross-Site Scripting (XSS) were discovered in SLiMS 7 Cendana before 2017-03-16. The vulnerabilities exist due to insufficient filtration of user-supplied data (id) passed to the 'slims7_cendana-master/template/default/detail_template.php' and 'slims7_cendana-master/template/default-rtl/detail_template.php' URLs. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
- Product
- Slims7 Cendana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Mar 9, 2017An issue was discovered in dnaTools dnaLIMS 4-2015s13.CVE-2017-6529 · Other software · Dnatools · reported by MITREHigh 8.8
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter.
- Product
- Dnalims
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexploit-db.com
Mar 9, 2017An issue was discovered in dnaTools dnaLIMS 4-2015s13.CVE-2017-6528 · Other software · Dnatools · reported by MITREHigh 8.1
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is affected by plaintext password storage (the /home/dna/spool/.pfile file).
- Product
- Dnalims
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexploit-db.com
Mar 9, 2017An issue was discovered in dnaTools dnaLIMS 4-2015s13.CVE-2017-6527 · Other software · Dnatools · reported by MITREHigh 7.5
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacker to access system files readable by the web server user (by using the viewAppletFsa.cgi seqID parameter).
- Product
- Dnalims
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexploit-db.com
Mar 9, 2017An issue was discovered in dnaTools dnaLIMS 4-2015s13.CVE-2017-6526 · Other software · Dnatools · reported by MITRECritical 9.8
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi POST requests).
- Product
- Dnalims
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexploit-db.com
Jan 21, 2015Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to injecCVE-2015-1204 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fs[resource] parameter in the wp-slim-view-2 page to wp-admin/admin.php.
- Product
- Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat
- Fixed in
- 3.9.2
- What to do
- Update Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat to 3.9.2 or newer.
Full record and what to do →NVD recordsecunia.comwordpress.org
Jan 13, 2015Cross-site scripting (XSS) vulnerability in the WP SlimStat plugin before 3.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2014-100027 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the WP SlimStat plugin before 3.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
- Product
- Cross-site scripting (XSS) vulnerability in the WP SlimStat
- Fixed in
- 3.5.6
- What to do
- Update Cross-site scripting (XSS) vulnerability in the WP SlimStat to 3.5.6 or newer.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Oct 21, 2014The Zillion Muslims (aka com.zillionmuslims.src) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middleCVE-2014-7789 · Other software · Zillionmuslims · reported by cret@cert.orgMedium 5.4
The Zillion Muslims (aka com.zillionmuslims.src) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Zillion Muslims
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Oct 21, 2014The Kuran'in Bilimsel Mucizeleri (aka com.wKurannBilimselMucizeleri) application 0.1 for Android does not verify X.509 certificates from SSL servers, which alloCVE-2014-7779 · Other software · Kuran'in Bilimsel Mucizeleri Project · reported by cret@cert.orgMedium 5.4
The Kuran'in Bilimsel Mucizeleri (aka com.wKurannBilimselMucizeleri) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Kuran'in Bilimsel Mucizeleri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Nov 27, 2007Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC2 allow remote attackers to inject arbitrary web script oCVE-2007-6142 · Other software · Salims Softhouse · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC2 allow remote attackers to inject arbitrary web script or HTML via the (1) show parameter to index.php and the (2) print parameter to print.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- JAF CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Mar 5, 2007PHP remote file inclusion vulnerability in forum/forum.php JAF CMS 4.0 RC1 allows remote attackers to execute arbitrary PHP code via a URL in the website parameCVE-2006-7128 · Other software · Salims Softhouse · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in forum/forum.php JAF CMS 4.0 RC1 allows remote attackers to execute arbitrary PHP code via a URL in the website parameter.
- Product
- JAF CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comrahim.webd.pl
Mar 5, 2007Multiple PHP remote file inclusion vulnerabilities in JAF CMS 4.0 and 4.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the main_dir parCVE-2006-7127 · Other software · Salims Softhouse · reported by MITREMedium 6.8
Multiple PHP remote file inclusion vulnerabilities in JAF CMS 4.0 and 4.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the main_dir parameter to (1) forum/main.php and (2) forum/headlines.php.
- Product
- JAF CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comrahim.webd.pl
Oct 3, 2006module/shout/jafshout.php (aka the shoutbox) in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allows remote attackers to execute arbitrary code within sectiCVE-2006-5131 · Other software · Salims Softhouse · reported by MITREHigh 7.5
module/shout/jafshout.php (aka the shoutbox) in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allows remote attackers to execute arbitrary code within sections bounded by "<?php" and "?>", possibly due to a static code injection vulnerability involving admin/data_inc.php.
- Product
- JAF CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Oct 3, 2006Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allow remote attackers to inject arbitrary web script oCVE-2006-5130 · Other software · Salims Softhouse · reported by MITREMedium 6.8
Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) url, (3) title, and (4) about parameters in a forum post. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
- Product
- JAF CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Oct 3, 2006Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allow remote attackers to inject arbitrary web script oCVE-2006-5129 · Other software · Salims Softhouse · reported by MITREMedium 6.8
Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) the message parameter, and possibly other parameters, in module/shout/jafshout.php (aka the shoutbox); and (2) the message body in a forum post in module/forum/topicwin.php, related to the name, email, title, date, ldate, and lname variables.
- Product
- JAF CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Jul 18, 2005PHPCounter 7.2 allows remote attackers to obtain sensitive information via a direct request to prelims.php, which reveals the path in an error message.CVE-2005-2289 · Websites & servers · Phpcounter · reported by MITREMedium 5
PHPCounter 7.2 allows remote attackers to obtain sensitive information via a direct request to prelims.php, which reveals the path in an error message.
- Product
- Phpcounter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2005Just another flat file (JAF) CMS before 3.0 Final allows remote attackers to obtain sensitive information via (1) an * (asterisk) in the id parameter, (2) a blaCVE-2005-2053 · Other software · Salims Softhouse · reported by MITREMedium 5
Just another flat file (JAF) CMS before 3.0 Final allows remote attackers to obtain sensitive information via (1) an * (asterisk) in the id parameter, (2) a blank id parameter, or (3) an * (asterisk) in the disp parameter to index.php, which reveals the path in an error message. NOTE: a followup suggests that this may be a directory traversal or file inclusion vulnerability.
- Product
- JAF CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2004Directory traversal vulnerability in index.php in Just Another Flat file (JAF) CMS 3.0RC allows remote attackers to read arbitrary files and possibly execute PHCVE-2004-1505 · Other software · Salims Softhouse · reported by MITREHigh 7.5
Directory traversal vulnerability in index.php in Just Another Flat file (JAF) CMS 3.0RC allows remote attackers to read arbitrary files and possibly execute PHP code via a .. (dot dot) in the show parameter.
- Product
- JAF CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2004The displaycontent function in config.php for Just Another Flat file (JAF) CMS 3.0RC allows remote attackers to gain sensitive information via a blank show paraCVE-2004-1504 · Other software · Salims Softhouse · reported by MITREMedium 5
The displaycontent function in config.php for Just Another Flat file (JAF) CMS 3.0RC allows remote attackers to gain sensitive information via a blank show parameter, which reveals the installation path in an error message, as demonstrated using index.php.
- Product
- JAF CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2001Directory traversal vulnerability in SlimServe HTTPd 1.1a allows remote attackers to read arbitrary files via a ...CVE-2001-0454 · Other software · Whitsoft · reported by MITREMedium 5
Directory traversal vulnerability in SlimServe HTTPd 1.1a allows remote attackers to read arbitrary files via a ... (modified dot dot) in the HTTP request.
- Product
- Slimserve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comexchange.xforce.ibmcloud.com
May 3, 2001Buffer overflow in SlimServe HTTPd 1.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long GET request.CVE-2001-0171 · Other software · Whitsoft · reported by MITREHigh 10
Buffer overflow in SlimServe HTTPd 1.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long GET request.
- Product
- Slimserve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.