Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
122 results · page 2 of 3
Jun 23, 2022A vulnerability, which was classified as problematic, has been found in Alpine PhotoTile for Instagram Plugin 1.2.7.7.CVE-2017-20087 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Alpine PhotoTile for Instagram Plugin 1.2.7.7. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely.
- Product
- Alpine PhotoTile for Instagram Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022Due to an insecure design, the Lepin EP-KP001 flash drive through KP001_V19 is vulnerable to an authentication bypass attack that enables an attacker to gain acCVE-2022-29948 · Other software · Lepin Ep-kp001 Project · reported by MITREMedium 4.6
Due to an insecure design, the Lepin EP-KP001 flash drive through KP001_V19 is vulnerable to an authentication bypass attack that enables an attacker to gain access to the stored encrypted data. Normally, the encrypted disk partition with this data is unlocked by entering the correct passcode (6 to 14 digits) via the keypad and pressing the Unlock button. This authentication is performed by an unknown microcontroller. By replacing this microcontroller on a target device with one from an attacker-controlled Lepin EP-KP001 whose passcode is known, it is possible to successfully unlock the target device and read the stored data in cleartext.
- Product
- Lepinep-kp001 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Feb 24, 2022Cybonet - PineApp Mail Relay Unauthenticated Sql Injection.CVE-2022-22794 · Other software · Cybonet · reported by cna@cyber.gov.ilMedium 6.8
Cybonet - PineApp Mail Relay Unauthenticated Sql Injection. Attacker can send a request to: /manage/emailrichment/userlist.php?CUSTOMER_ID_INNER=1 /admin/emailrichment/userlist.php?CUSTOMER_ID_INNER=1 /manage/emailrichment/usersunlist.php?CUSTOMER_ID_INNER=1 /admin/emailrichment/usersunlist.php?CUSTOMER_ID_INNER=1 and by doing that, the attacker can run Remote Code Execution in one liner.
- Product
- Pineapp Mail Relay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022Cybonet - PineApp Mail Relay Local File Inclusion.CVE-2022-22793 · Other software · Cybonet · reported by cna@cyber.gov.ilMedium 6.1
Cybonet - PineApp Mail Relay Local File Inclusion. Attacker can send a request to : /manage/mailpolicymtm/log/eml_viewer/email.content.body.php?filesystem_path=ENCDODED PATH and by doing that, the attacker can read Local Files inside the server.
- Product
- Pineapp Mail Relay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022Alps Alpine Touchpad Driver 10.3201.101.215 is vulnerable to DLL Injection.CVE-2021-27971 · Other software · Alpsalpine · reported by MITREHigh 7.8
Alps Alpine Touchpad Driver 10.3201.101.215 is vulnerable to DLL Injection.
- Product
- Touchpad Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jan 6, 2022The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expected that systemd woCVE-2022-22704 · Other software · Zabbix · reported by MITRECritical 9.8
The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expected that systemd would (in effect) determine part of the configuration.
- Product
- Zabbix-agent2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.alpinelinux.orggitlab.alpinelinux.org
Dec 8, 2021PineApp - Mail Secure - Attacker sending a request to :/blocking.php?url=<script>alert(1)</script> and stealing cookies .CVE-2021-36720 · Other software · Cybonet · reported by cna@cyber.gov.ilMedium 6.1
PineApp - Mail Secure - Attacker sending a request to :/blocking.php?url=<script>alert(1)</script> and stealing cookies .
- Product
- PineApp - Mail Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2021PineApp - Mail Secure - The attacker must be logged in as a user to the Pineapp system.CVE-2021-36719 · Other software · Cybonet · reported by cna@cyber.gov.ilHigh 8.8
PineApp - Mail Secure - The attacker must be logged in as a user to the Pineapp system. The attacker exploits the vulnerable nicUpload.php file to upload a malicious file,Thus taking over the server and running remote code.
- Product
- PineApp - Mail Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.CVE-2021-38370 · Other software · Alpine Project · reported by MITREMedium 5.9
In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.
- Product
- Alpine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalpine.x10host.combugs.gentoo.org
Jul 5, 2021In the xrdp package (in branches through 3.14) for Alpine Linux, RDP sessions are vulnerable to man-in-the-middle attacks because pre-generated RSA certificatesCVE-2021-36158 · Other software · Alpinelinux · reported by MITREMedium 5.9
In the xrdp package (in branches through 3.14) for Alpine Linux, RDP sessions are vulnerable to man-in-the-middle attacks because pre-generated RSA certificates and private keys are used.
- Product
- Aports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.alpinelinux.orggitlab.alpinelinux.org
Apr 21, 2021In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash.CVE-2021-30139 · Other software · Alpinelinux · reported by MITREHigh 7.5
In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash.
- Product
- Apk-tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.alpinelinux.orggitlab.alpinelinux.org
Mar 24, 2021spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal.CVE-2020-15809 · Other software · Spinetix · reported by MITREMedium 6.5
spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiVA through 4.5.2-1.0.36229; HMP400 and HMP400W through 4.5.2-1.0.2-1eb2ffbd; and DSOS through 4.5.2-1.0.2-1eb2ffbd.
- Product
- Dsos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.spinetix.comsupport.spinetix.com
Mar 24, 2021Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents of any file on the fiCVE-2021-29133 · Other software · Haserl Project · reported by MITREMedium 5.5
Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents of any file on the filesystem.
- Product
- Haserl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official memcached docker images before 1.5.11-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35197 · Other software · Docker · reported by MITRECritical 9.8
The official memcached docker images before 1.5.11-alpine (Alpine specific) contain a blank password for a root user. System using the memcached docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Memcached Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official rabbitmq docker images before 3.7.13-beta.1-management-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35196 · Other software · Docker · reported by MITRECritical 9.8
The official rabbitmq docker images before 3.7.13-beta.1-management-alpine (Alpine specific) contain a blank password for a root user. System using the rabbitmq docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Rabbitmq Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35195 · Other software · Docker · reported by MITRECritical 9.8
The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user. System using the haproxy docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Haproxy Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35191 · Websites & servers · Drupal · reported by MITRECritical 9.8
The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Drupal Docker Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35190 · Other software · Plone · reported by MITRECritical 9.8
The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. System using the plone docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35189 · Other software · Kong · reported by MITRECritical 9.8
The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user. System using the kong docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Kong Alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35187 · Other software · Influxdata · reported by MITRECritical 9.8
The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user. System using the telegraf docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Telegraf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35185 · Other software · Docker · reported by MITRECritical 9.8
The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user. System using the ghost docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Ghost Alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35193 · Other software · Sonarsource · reported by MITRECritical 9.8
The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System using the sonarqube docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Sonarqube Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-29602 · Other software · Irssi · reported by MITRECritical 9.8
The official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for a root user. System using the irssi docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official spiped docker images before 1.5-alpine contain a blank password for a root user.CVE-2020-29581 · Other software · Docker · reported by MITRECritical 9.8
The official spiped docker images before 1.5-alpine contain a blank password for a root user. Systems using the spiped docker container deployed by affected versions of the docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Spiped Alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-29575 · Other software · Docker · reported by MITRECritical 9.8
The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user. Systems using the elixir Linux Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Elixir Alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-29578 · Other software · Matomo · reported by MITRECritical 9.8
The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user. Systems using the Piwik Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access.
- Product
- Piwik Fpm-alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2020ask_password in Tomb 2.0 through 2.7 returns a warning when pinentry-curses is used and $DISPLAY is non-empty, causing affected users' files to be encrypted witCVE-2020-28638 · Other software · Dyne · reported by MITRECritical 9.8
ask_password in Tomb 2.0 through 2.7 returns a warning when pinentry-curses is used and $DISPLAY is non-empty, causing affected users' files to be encrypted with "tomb {W] Detected DISPLAY, but only pinentry-curses is found." as the encryption key.
- Product
- Tomb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2020The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path Disclosure attacks viaCVE-2020-15596 · Other software · HP · reported by MITREMedium 6.7
The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path Disclosure attacks via a "fake" DLL file.
- Product
- Elite X2 1012 G1 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsupport.hp.com
Jun 19, 2020Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavCVE-2020-14929 · Other software · Alpine Project · reported by MITREHigh 7.5
Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.
- Product
- Alpine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmailman13.u.washington.edulists.debian.org
Sep 25, 2019The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-CVE-2015-9432 · WordPress plugins & themes · reported by MITREMedium 6.5
The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.
- Product
- alpine-photo-tile-for-instagram
- Fixed in
- 1.2.7.6
- What to do
- Update alpine-photo-tile-for-instagram to 1.2.7.6 or newer.
Jun 18, 2019Alpine Linux abuild through 3.4.0 allows an unprivileged member of the abuild group to add an untrusted package via a --keys-dir option that causes acceptance oCVE-2019-12875 · Other software · Alpinelinux · reported by MITREMedium 6.5
Alpine Linux abuild through 3.4.0 allows an unprivileged member of the abuild group to add an untrusted package via a --keys-dir option that causes acceptance of an untrusted signing key.
- Product
- Abuild
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.foxkit.usgithub.com
May 8, 2019Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user.CVE-2019-5021 · Other software · Gliderlabs · reported by talos-cna@cisco.comCritical 9.8
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the `root` user.
- Product
- Docker-alpine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgsecurityfocus.com
Dec 20, 2018Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools (Alpine Linux' package manager) that can reCVE-2018-1000849 · Other software · Alpinelinux · reported by MITREHigh 8.8
Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools (Alpine Linux' package manager) that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data to an attacker-specified file, due to bugs in handling long link target name and the way a regular file is extracted.. This vulnerability appears to have been fixed in 2.6.10, 2.7.6, and 2.10.1.
- Product
- Alpine Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalpinelinux.orggit.alpinelinux.org
Nov 27, 2018Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a conCVE-2018-17256 · Other software · CyberSecurity Philippines - CERT · reported by vulnerability@cspcert.phMedium 4.8
Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content.
- Product
- UmbracoCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2017A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution, by crafting a maliciouCVE-2017-9671 · Other software · Alpinelinux · reported by MITREHigh 7.8
A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution, by crafting a malicious APKINDEX.tar.gz file with a bad pax header block.
- Product
- Alpine Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Jul 17, 2017A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution by crafting a maliciousCVE-2017-9669 · Other software · Alpinelinux · reported by MITREHigh 7.8
A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution by crafting a malicious APKINDEX.tar.gz file.
- Product
- Alpine Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Mar 31, 2017Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.CVE-2015-4624 · Other software · Hak5 · reported by MITREHigh 7.5
Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.
- Product
- Wi-fi Pineapple Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Sep 21, 2015Buffer overflow in form2ping.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW5829CVE-2015-5993 · Other software · Philippine Long Distance Telephone · reported by cret@cert.orgHigh 7.8
Buffer overflow in form2ping.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to cause a denial of service (device outage) via a long ipaddr parameter.
- Product
- Kasda Kw58293 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 21, 2015Cross-site scripting (XSS) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TXCVE-2015-5992 · Other software · Philippine Long Distance Telephone · reported by cret@cert.orgMedium 4.3
Cross-site scripting (XSS) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to inject arbitrary web script or HTML via the ssid parameter.
- Product
- Speedsurf 504an Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 21, 2015Cross-site request forgery (CSRF) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8UCVE-2015-5991 · Other software · Philippine Long Distance Telephone · reported by cret@cert.orgMedium 6.8
Cross-site request forgery (CSRF) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to hijack the authentication of administrators for requests that perform setup operations, as demonstrated by modifying network settings.
- Product
- Speedsurf 504an Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Nov 20, 2013PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms has a sudoers file that does not properly restrict user specifications, which allows local CVE-2013-6831 · Other software · Pineapp · reported by MITREHigh 7.2
PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms has a sudoers file that does not properly restrict user specifications, which allows local users to gain privileges via a sudo command that leverages access to the qmailq account.
- Product
- Mail-secure 5099sk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Nov 20, 2013admin/confnetworking.html in PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms allows remote attackers to execute arbitrary commands via shelCVE-2013-6830 · Other software · Pineapp · reported by MITREHigh 7.5
admin/confnetworking.html in PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms allows remote attackers to execute arbitrary commands via shell metacharacters in the nsserver parameter during an nslookup operation.
- Product
- Mail-secure 5099sk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Nov 20, 2013admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pinghost parameter duringCVE-2013-6829 · Other software · Pineapp · reported by MITREHigh 7.5
admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pinghost parameter during a ping operation.
- Product
- Mail-secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Nov 20, 2013admin/management.html in PineApp Mail-SeCure allows remote attackers to bypass authentication and perform a sys_usermng operation via the it parameter.CVE-2013-6828 · Other software · Pineapp · reported by MITREMedium 6.4
admin/management.html in PineApp Mail-SeCure allows remote attackers to bypass authentication and perform a sys_usermng operation via the it parameter.
- Product
- Mail-secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Nov 20, 2013Absolute path traversal vulnerability in admin/viewmsg.php in PineApp Mail-SeCure allows remote attackers to read arbitrary files via a full pathname in the msgCVE-2013-6827 · Other software · Pineapp · reported by MITREMedium 5
Absolute path traversal vulnerability in admin/viewmsg.php in PineApp Mail-SeCure allows remote attackers to read arbitrary files via a full pathname in the msg parameter.
- Product
- Mail-secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Nov 7, 2013PineApp Mail-SeCure before 3.70 allows remote authenticated users to gain privileges by leveraging console access and providing shell metacharacters in a "systeCVE-2013-4987 · Other software · Pineapp · reported by MITREHigh 8.5
PineApp Mail-SeCure before 3.70 allows remote authenticated users to gain privileges by leveraging console access and providing shell metacharacters in a "system ping" command.
- Product
- Mail-secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcoresecurity.comcoresecurity.com
Sep 23, 2009SQL injection vulnerability in the JBudgetsMagic (com_jbudgetsmagic) component 0.3.2 through 0.4.0 for Joomla! allows remote attackers to execute arbitrary SQL CVE-2009-3332 · Other software · Sopinet · reported by MITREHigh 7.5
SQL injection vulnerability in the JBudgetsMagic (com_jbudgetsmagic) component 0.3.2 through 0.4.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the bid parameter in a mybudget action to index.php.
- Product
- COM Jbudgetsmagic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsecurityfocus.com
Nov 10, 2008Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, andCVE-2008-5005 · Other software · University Of Washington · reported by MITREHigh 10
Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and '+' character followed by a long string, processed by the tmail or possibly dmail program.
- Product
- Alpine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmailman2.u.washington.edumailman2.u.washington.edu
Aug 17, 2007Multiple PHP remote file inclusion vulnerabilities in depouilg.php3 in Stephane Pineau VOTE 1c allow remote attackers to execute arbitrary PHP code via a URL inCVE-2007-4384 · Other software · Stephane Pineau · reported by MITREMedium 6.8
Multiple PHP remote file inclusion vulnerabilities in depouilg.php3 in Stephane Pineau VOTE 1c allow remote attackers to execute arbitrary PHP code via a URL in the (1) NomVote and (2) FilePalHex parameters.
- Product
- Vote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Apr 12, 2007Multiple PHP remote file inclusion vulnerabilities in Pineapple Technologies Lore 1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) laCVE-2007-2021 · Other software · Pineapple Technologies · reported by MITREHigh 7.5
Multiple PHP remote file inclusion vulnerabilities in Pineapple Technologies Lore 1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) lang_path parameter to third_party/phpmailer/class.phpmailer.php or the (2) get_plugin_file_path parameter to third_party/smarty/libs/plugins/function.html_checkboxes.php. NOTE: the affected files might be from other software packages, so this might not be a vulnerability in Lore itself. NOTE: (1) might be the same issue as CVE-2006-5734.4.
- Product
- Lore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.