Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
96 results · page 2 of 2
Jun 13, 2019Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via localCVE-2019-0183 · Other software · Intel · reported by secure@intel.comLow 3.3
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Open Cloud Integrity Tehnology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2019Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via localCVE-2019-0182 · Other software · Intel · reported by secure@intel.comLow 3.3
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Open Cloud Integrity Tehnology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2019Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via localCVE-2019-0181 · Other software · Intel · reported by secure@intel.comMedium 6.7
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Open Cloud Integrity Tehnology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2019Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via localCVE-2019-0180 · Other software · Intel · reported by secure@intel.comMedium 4.4
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Open Cloud Integrity Tehnology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2019Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via localCVE-2019-0179 · Other software · Intel · reported by secure@intel.comMedium 4.4
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Open Cloud Integrity Tehnology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2019Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via localCVE-2019-0178 · Other software · Intel · reported by secure@intel.comLow 3.6
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Open Cloud Integrity Tehnology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2019Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via localCVE-2019-0177 · Other software · Intel · reported by secure@intel.comMedium 4.4
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Open Cloud Integrity Tehnology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2019Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via localCVE-2019-0175 · Other software · Intel · reported by secure@intel.comMedium 4.4
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Open Cloud Integrity Tehnology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2018An exploitable information disclosure vulnerability exists in the password protection functionality of Quicken Deluxe 2018 for Mac version 5.2.2.CVE-2018-3854 · Other software · Intuit · reported by talos-cna@cisco.comHigh 7.1
An exploitable information disclosure vulnerability exists in the password protection functionality of Quicken Deluxe 2018 for Mac version 5.2.2. A specially crafted sqlite3 request can cause the removal of the password protection, allowing an attacker to access and modify the data without knowing the password. An attacker needs to have access to the password-protected files to trigger this vulnerability.
- Product
- Quicken 2018
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 30, 2018A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares.CVE-2018-16467 · Other software · Nextcloud · reported by support@hackerone.comMedium 5.3
A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares.
- Product
- Nextcloud Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comnextcloud.com
Oct 30, 2018A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the passwCVE-2018-16464 · Other software · Nextcloud · reported by support@hackerone.comMedium 5.7
A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the password.
- Product
- Nextcloud Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comnextcloud.com
Oct 30, 2018A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protectedCVE-2018-16463 · Other software · Nextcloud · reported by support@hackerone.comLow 3.1
A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protected shares.
- Product
- Nextcloud Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comnextcloud.com
Jul 26, 2018Thomson Reuters UltraTax CS 2017 on Windows has a password protection option; however, the level of protection might be inconsistent with some customers' expectCVE-2018-14608 · Other software · Thomsonreuters · reported by MITREHigh 7.5
Thomson Reuters UltraTax CS 2017 on Windows has a password protection option; however, the level of protection might be inconsistent with some customers' expectations because the data is directly accessible in cleartext. Specifically, it stores customer data in unique directories (%install_path%\WinCSI\UT17DATA\client_ID\file_name.XX17) that can be bypassed without authentication by examining the strings of the .XX17 file. The strings stored in the .XX17 file contain each customer's: Full Name, Spouse's Name, Social Security Number, Date of Birth, Occupation, Home Address, Daytime Phone Number, Home Phone Number, Spouse's Address, Spouse's Daytime Phone Number, Spouse's Social Security Number, Spouse's Home Phone Number, Spouse's Occupation, Spouse's Date of Birth, and Spouse's Filing Status.
- Product
- Ultratax CS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorporateblue.comthemikewylie.com
Feb 28, 2018In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for privCVE-2018-1286 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for privileged users.
- Product
- Apache OpenMeetings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Apr 3, 2015The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta DescriptCVE-2015-0902 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5
The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code.
- Product
- Semper Fi All in One SEO Pack
- Fixed in
- 2.2.6
- What to do
- Update Semper Fi All in One SEO Pack to 2.2.6 or newer.
Nov 20, 2014The Protected Pages module 7.x-2.x before 7.x-2.4 for Drupal allows remote attackers to bypass the password protection via a crafted path.CVE-2014-9024 · Other software · Protected Pages Project · reported by MITREHigh 7.5
The Protected Pages module 7.x-2.x before 7.x-2.4 for Drupal allows remote attackers to bypass the password protection via a crafted path.
- Product
- Protected Pages
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2014The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtaCVE-2014-5337 · WordPress plugins & themes · reported by MITREMedium 5
The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php.
- Product
- WordPress Mobile Pack
- Fixed in
- 2.0.2
- What to do
- Update WordPress Mobile Pack to 2.0.2 or newer.
Full record and what to do →NVD recordsecunia.comwordpress.org
Feb 5, 2014Rockwell Automation RSLogix 5000 7 through 20.01, and 21.0, does not properly implement password protection for .ACD files (aka project files), which allows locCVE-2014-0755 · Other software · Rockwell Automation · reported by ics-cert@hq.dhs.govMedium 6.3
Rockwell Automation RSLogix 5000 7 through 20.01, and 21.0, does not properly implement password protection for .ACD files (aka project files), which allows local users to obtain sensitive information or modify data via unspecified vectors.
- Product
- RSLogix 5000 software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityfocus.com
Jun 8, 2009Ascad Networks Password Protector SD 1.3.1 allows remote attackers to bypass authentication and gain administrative access by setting the (1) c7portal and (2) cCVE-2009-2003 · Other software · Ascadnetworks · reported by MITREHigh 7.5
Ascad Networks Password Protector SD 1.3.1 allows remote attackers to bypass authentication and gain administrative access by setting the (1) c7portal and (2) cookname cookies to "admin."
- Product
- Password Protector SD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexploit-db.com
Feb 10, 2009Whole Hog Password Protect: Enhanced 1.x allows remote attackers to bypass authentication and obtain administrative access via an integer value in the adminid cCVE-2009-0461 · Other software · Wholehogsoftware · reported by MITREHigh 7.5
Whole Hog Password Protect: Enhanced 1.x allows remote attackers to bypass authentication and obtain administrative access via an integer value in the adminid cookie.
- Product
- Password Protect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2009Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Password Protect: Enhanced 1.x allow remote attackers to execute arbitrary SQL comCVE-2009-0459 · Other software · Wholehogsoftware · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Password Protect: Enhanced 1.x allow remote attackers to execute arbitrary SQL commands via (1) the uid parameter (aka Username field) or (2) the pwd parameter (aka Password field). NOTE: some of these details are obtained from third party information.
- Product
- Password Protect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2007gnump3d 2.9final does not apply password protection to its plugins, which might allow remote attackers to bypass intended access restrictions.CVE-2007-6130 · Other software · GNU · reported by MITREMedium 5
gnump3d 2.9final does not apply password protection to its plugins, which might allow remote attackers to bypass intended access restrictions.
- Product
- Gnump3d
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Aug 16, 2007The server in Babo Violent 2 2.08.00 and earlier does not properly implement password protection, which might allow remote attackers to bypass authentication byCVE-2007-4373 · Other software · Rndlabs · reported by MITREMedium 6.8
The server in Babo Violent 2 2.08.00 and earlier does not properly implement password protection, which might allow remote attackers to bypass authentication by reconnecting after a connection closes.
- Product
- Babo Violent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaluigi.altervista.orgsecurityreason.com
Mar 20, 2007McAfee VirusScan Enterprise 8.5.0.i uses insecure permissions for certain Windows Registry keys, which allows local users to bypass local password protection viCVE-2007-1538 · Other software · Mcafee · reported by MITREHigh 7.5
McAfee VirusScan Enterprise 8.5.0.i uses insecure permissions for certain Windows Registry keys, which allows local users to bypass local password protection via the UIP value in (1) HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection or (2) HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\VirusScan Entreprise\CurrentVersion. NOTE: this issue has been disputed by third-party researchers, stating that the default permissions for HKEY_LOCAL_MACHINE\SOFTWARE does not allow for write access and the product does not modify the inherited permissions. There might be an interaction error with another product
- Product
- Virusscan Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhomepage.mac.comhomepage.mac.com
Aug 23, 2006VNC server on the AK-Systems Windows Terminal 1.2.5 ExVLP is not password protected, which allows remote attackers to login and view RDP or Citrix sessions.CVE-2006-4309 · Other software · Ak-systems · reported by MITREHigh 10
VNC server on the AK-Systems Windows Terminal 1.2.5 ExVLP is not password protected, which allows remote attackers to login and view RDP or Citrix sessions.
- Product
- Windows Terminal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Nov 2, 2005MiniGal 2 (MG2) 0.5.1 allows remote attackers to list password protected images via a request to index.php with the list parameter set to * (wildcard) and the pCVE-2005-3432 · Other software · Thomas Rybak · reported by MITREMedium 5
MiniGal 2 (MG2) 0.5.1 allows remote attackers to list password protected images via a request to index.php with the list parameter set to * (wildcard) and the page parameter set to all.
- Product
- Minigal 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2005Webroot Desktop Firewall before 1.3.0build52 allows local users to disable the firewall, even when password protection is enabled, via certain DeviceIoControl cCVE-2005-3198 · Other software · Webroot Software · reported by MITREMedium 4.6
Webroot Desktop Firewall before 1.3.0build52 allows local users to disable the firewall, even when password protection is enabled, via certain DeviceIoControl commands.
- Product
- Desktop Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecunia.com
May 16, 2005The Altiris Client Service for Windows (ACLIENT.EXE) 6.0.88 allows local users to disable password protection and access the administrative interface by findingCVE-2005-1590 · Other software · Altiris · reported by MITREMedium 4.6
The Altiris Client Service for Windows (ACLIENT.EXE) 6.0.88 allows local users to disable password protection and access the administrative interface by finding and showing the "Altiris Client Service" hidden window, disabling the password protection, disabling the "Hide client tray icon box" option, then opening the AClient tray icon and using the View Log File option, a different vulnerability than CVE-2004-2070.
- Product
- Client Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecunia.com
Aug 31, 2004Cross-site scripting (XSS) vulnerability in (1) index.asp, (2) ChangePassword.asp, (3) users_list.asp, (4) and users_add.asp in Password Protect allows remote aCVE-2004-1648 · Other software · Web Animations · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in (1) index.asp, (2) ChangePassword.asp, (3) users_list.asp, (4) and users_add.asp in Password Protect allows remote attackers to inject arbitrary web script or HTML via the ShowMsg parameter.
- Product
- Password Protect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2004SQL injection vulnerability in Password Protect allows remote attackers to execute arbitrary SQL statements and bypass authentication via (1) admin or Pass paraCVE-2004-1647 · Other software · Web Animations · reported by MITREHigh 7.5
SQL injection vulnerability in Password Protect allows remote attackers to execute arbitrary SQL statements and bypass authentication via (1) admin or Pass parameter to index_next.asp, (2) LoginId, OPass, or NPass to CPassChangePassword.asp, (3) users_edit.asp, or (4) users_add.asp.
- Product
- Password Protect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2003WinZip 8.0 uses weak random number generation for password protected ZIP files, which allows local users to brute force the encryption keys and extract the dataCVE-2003-1376 · Other software · Winzip · reported by MITREMedium 4.6
WinZip 8.0 uses weak random number generation for password protected ZIP files, which allows local users to brute force the encryption keys and extract the data from the zip file by guessing the state of the stream coder.
- Product
- Winzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Dec 31, 2003Invision Power Services Invision Board 1.0 through 1.1.1, when a forum is password protected, stores the administrator password in a cookie in plaintext, which CVE-2003-1454 · Other software · Invision Power Services · reported by MITREMedium 5
Invision Power Services Invision Board 1.0 through 1.1.1, when a forum is password protected, stores the administrator password in a cookie in plaintext, which could allow remote attackers to gain access.
- Product
- Invision Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Mar 31, 2003BRS WebWeaver Web Server 1.01 allows remote attackers to bypass password protections for files and directories via an HTTP request containing a "/./" sequence.CVE-2002-1546 · Other software · BRS · reported by MITREHigh 7.5
BRS WebWeaver Web Server 1.01 allows remote attackers to bypass password protections for files and directories via an HTTP request containing a "/./" sequence.
- Product
- Webweaver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comiss.net
Mar 31, 2003BadBlue 1.7 allows remote attackers to bypass password protections for directories and files via an HTTP request containing an extra / (slash).CVE-2002-1541 · Other software · Working Resources Inc. · reported by MITREHigh 7.5
BadBlue 1.7 allows remote attackers to bypass password protections for directories and files via an HTTP request containing an extra / (slash).
- Product
- Badblue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comiss.net
Dec 31, 2002Savant Web Server 3.1 and earlier allows remote attackers to bypass authentication for password protected user folders via a URL with a hex encoded space (%20) CVE-2002-2145 · Other software · Savant · reported by MITREHigh 7.5
Savant Web Server 3.1 and earlier allows remote attackers to bypass authentication for password protected user folders via a URL with a hex encoded space (%20) and a '.' (%2e) at the end of the filename.
- Product
- Savant Webserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordonline.securityfocus.comiss.net
Dec 31, 2002Perception LiteServe 2.0 allows remote attackers to read password protected files via a leading "/./" in a URL.CVE-2002-2369 · Other software · Perception · reported by MITREMedium 5
Perception LiteServe 2.0 allows remote attackers to read password protected files via a leading "/./" in a URL.
- Product
- Liteserve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2002Etype Eserv 2.97 allows remote attackers to view password protected files via /./ in the URL.CVE-2002-0112 · Other software · Etype · reported by MITREMedium 5
Etype Eserv 2.97 allows remote attackers to view password protected files via /./ in the URL.
- Product
- Eserv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.commarc.info
Dec 21, 2001ZIP drive for Iomega ZIP-100 disks allows attackers with physical access to the drive to bypass password protection by inserting a known disk with a known passwCVE-1999-1174 · Other software · Iomega · reported by MITREMedium 4.6
ZIP drive for Iomega ZIP-100 disks allows attackers with physical access to the drive to bypass password protection by inserting a known disk with a known password, waiting for the ZIP drive to power down, manually replacing the known disk with the target disk, and using the known password to access the target disk.
- Product
- ZIP 100 MB Drive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcounterpane.comcounterpane.com
May 3, 2001The password protection option for the Compressed Folders feature in Plus! for Windows 98 and Windows Me writes password information to a file, which allows locCVE-2001-0152 · Computers, phones & browsers · Microsoft · reported by MITRELow 2.1
The password protection option for the Compressed Folders feature in Plus! for Windows 98 and Windows Me writes password information to a file, which allows local users to recover the passwords and read the compressed folders.
- Product
- Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.microsoft.comdocs.microsoft.com
Jan 10, 2001Crystal Reports, when displaying data for a password protected database using HTML pages, embeds the username and password in cleartext in the HTML page and theCVE-2001-1464 · Other software · Businessobjects · reported by MITREHigh 7.5
Crystal Reports, when displaying data for a password protected database using HTML pages, embeds the username and password in cleartext in the HTML page and the URL, which allows remote attackers to obtain passwords.
- Product
- Crystal Reports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgexchange.xforce.ibmcloud.com
Oct 20, 2000The password protection feature of Microsoft Money can store the password in plaintext, which allows attackers with physical access to the system to obtain the CVE-2000-0777 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.2
The password protection feature of Microsoft Money can store the password in plaintext, which allows attackers with physical access to the system to obtain the password, aka the "Money Password" vulnerability.
- Product
- Money
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comdocs.microsoft.com
Feb 7, 2000Axis 700 Network Scanner does not properly restrict access to administrator URLs, which allows users to bypass the password protection via a ..CVE-2000-0144 · Other software · Axis · reported by MITREHigh 7.5
Axis 700 Network Scanner does not properly restrict access to administrator URLs, which allows users to bypass the password protection via a .. (dot dot) attack.
- Product
- 700 Network Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Nov 1, 1999Idle locking function in MacOS 9 allows local attackers to bypass the password protection of idled sessions via the programmer's switch or CMD-PWR keyboard sequCVE-1999-1077 · Computers, phones & browsers · Apple · reported by MITREMedium 4.6
Idle locking function in MacOS 9 allows local attackers to bypass the password protection of idled sessions via the programmer's switch or CMD-PWR keyboard sequence, which brings up a debugger that the attacker can use to disable the lock.
- Product
- Macos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Oct 26, 1999Idle locking function in MacOS 9 allows local users to bypass the password protection of idled sessions by selecting the "Log Out" option and selecting a "CanceCVE-1999-1076 · Computers, phones & browsers · Apple · reported by MITREMedium 4.6
Idle locking function in MacOS 9 allows local users to bypass the password protection of idled sessions by selecting the "Log Out" option and selecting a "Cancel" option in the dialog box for an application that attempts to verify that the user wants to log out, which returns the attacker into the locked session.
- Product
- Macos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Oct 4, 1999Macromedia "The Matrix" screen saver on Windows 95 with the "Password protected" option enabled allows attackers with physical access to the machine to bypass tCVE-1999-1454 · Other software · Macromedia · reported by MITREMedium 4.6
Macromedia "The Matrix" screen saver on Windows 95 with the "Password protected" option enabled allows attackers with physical access to the machine to bypass the password prompt by pressing the ESC (Escape) key.
- Product
- Matrix Screen Saver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 1999The Economist screen saver 1999 with the "Password Protected" option enabled allows users with physical access to the machine to bypass the screen saver and reaCVE-1999-1400 · Other software · The Economist · reported by MITRELow 2.1
The Economist screen saver 1999 with the "Password Protected" option enabled allows users with physical access to the machine to bypass the screen saver and read files by running Internet Explorer while the screen is still locked.
- Product
- The Economist 1999 Screen Saver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.indenial.comarchives.indenial.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.