Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
161 results · page 2 of 4
Dec 8, 2022Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/P2pListFilter.CVE-2022-45513 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/P2pListFilter.
- Product
- W30e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Plist.php.CVE-2021-38729 · Other software · Sem-cms · reported by MITRECritical 9.8
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Plist.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function fromDhcpListClient with a combined parameter "list*" ("%s%d","liCVE-2022-40869 · Network & remote access · Tendacn · reported by MITRECritical 9.8
Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function fromDhcpListClient with a combined parameter "list*" ("%s%d","list").
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the page parameter in the function fromDhcpListClient.CVE-2022-37806 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the page parameter in the function fromDhcpListClient.
- Product
- Ac1206 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2022A buffer overflow in the FTcpListener thread in The Isle Evrima (the dedicated server on Windows and Linux) 0.9.88.07 before 2022-08-12 allows a remote attackerCVE-2022-38221 · Other software · The Isle Evrima Project · reported by MITRECritical 9.8
A buffer overflow in the FTcpListener thread in The Isle Evrima (the dedicated server on Windows and Linux) 0.9.88.07 before 2022-08-12 allows a remote attacker to crash any server with an accessible RCON port, or possibly execute arbitrary code.
- Product
- The Isle Evrima
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtakethebait.nettakethebait.net
Jul 1, 2022Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the listN parameter in the function fromDhcpListClient.CVE-2022-32039 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the listN parameter in the function fromDhcpListClient.
- Product
- M3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022A vulnerability, which was classified as problematic, was found in PHPList 3.2.6.CVE-2017-20036 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in PHPList 3.2.6. Affected is an unknown function of the file /lists/admin/ of the component Bounce Rule. The manipulation leads to cross site scripting (Persistent). It is possible to launch the attack remotely. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- PHPList
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022A vulnerability, which was classified as problematic, has been found in PHPList 3.2.6.CVE-2017-20035 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in PHPList 3.2.6. This issue affects some unknown processing of the file /lists/admin/ of the component Subscribe. The manipulation leads to cross site scripting (Persistent). The attack may be initiated remotely. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- PHPList
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022A vulnerability classified as problematic was found in PHPList 3.2.6.CVE-2017-20034 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in PHPList 3.2.6. This vulnerability affects unknown code of the file /lists/admin/ of the component List Name. The manipulation leads to cross site scripting (Persistent). The attack can be initiated remotely. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- PHPList
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022A vulnerability classified as problematic has been found in PHPList 3.2.6.CVE-2017-20033 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in PHPList 3.2.6. This affects an unknown part of the file /lists/admin/. The manipulation of the argument page with the input send\'\";><script>alert(8)</script> leads to cross site scripting (Reflected). It is possible to initiate the attack remotely. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- PHPList
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022A vulnerability was found in PHPList 3.2.6.CVE-2017-20032 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability was found in PHPList 3.2.6. It has been rated as critical. Affected by this issue is some unknown functionality of the component Subscription. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- PHPList
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022A vulnerability was found in PHPList 3.2.6.CVE-2017-20031 · Other software · unspecified · reported by VulDBLow 2.7
A vulnerability was found in PHPList 3.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument sortby with the input password leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- PHPList
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022A vulnerability was found in PHPList 3.2.6.CVE-2017-20030 · Other software · unspecified · reported by VulDBMedium 4.7
A vulnerability was found in PHPList 3.2.6. It has been classified as critical. Affected is an unknown function of the file /lists/admin/ of the component Sending Campain. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- PHPList
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022A vulnerability was found in PHPList 3.2.6 and classified as critical.CVE-2017-20029 · Other software · unspecified · reported by VulDBHigh 7.3
A vulnerability was found in PHPList 3.2.6 and classified as critical. This issue affects some unknown processing of the file /lists/index.php of the component Edit Subscription. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- PHPList
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2022Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().CVE-2022-26260 · Other software · Simple-plist Project · reported by MITRECritical 9.8
Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().
- Product
- Simple-plist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.CVE-2022-26533 · Other software · Alistgo · reported by MITREMedium 6.1
Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.
- Product
- Alist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2022Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.CVE-2022-22912 · Other software · Plist Project · reported by MITRECritical 9.8
Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.
- Product
- Plist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Artifex MuJS v1.1.3 was discovered to contain a heap buffer overflow which is caused by conflicting JumpList of nested try/finally statements.CVE-2021-45005 · Other software · Artifex · reported by MITRECritical 9.8
Artifex MuJS v1.1.3 was discovered to contain a heap buffer overflow which is caused by conflicting JumpList of nested try/finally statements.
- Product
- Mujs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ghostscript.comgithub.com
Aug 30, 2021The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSorCVE-2021-38343 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSort`, and `npCategoryFilter` `admin_post` actions.
- Product
- Nested Pages
- Affected
- up to 3.1.15
- What to do
- Affects up to 3.1.15. Update Nested Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jul 6, 2021Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin.CVE-2020-22251 · Websites & servers · Phplist · reported by MITREMedium 4.8
Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2021Remote Code Execution vulnerability in phplist 3.5.1.CVE-2020-22249 · Websites & servers · Phplist · reported by MITRECritical 9.8
Remote Code Execution vulnerability in phplist 3.5.1. The application does not check any file extensions stored in the plugin zip file, Uploading a malicious plugin which contains the php files with extensions like PHP,phtml,php7 will be copied to the plugins directory which would lead to the remote code execution
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Jul 2, 2021A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in CVE-2020-36399 · Websites & servers · Phplist · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "rule1" parameter under the "Bounce Rules" module.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2021A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in CVE-2020-36398 · Websites & servers · Phplist · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "Campaign" field under the "Send a campaign" module.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2021A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist 3.5.4 and below allows authenticated attackers to execute arbitCVE-2020-23194 · Websites & servers · Phplist · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2021A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a craftCVE-2020-23192 · Websites & servers · Phplist · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload in the "admin" parameter under the "Manage administrators" module.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2021A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web scriptsCVE-2020-23190 · Websites & servers · Phplist · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2021A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into CVE-2020-23217 · Websites & servers · Phplist · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add a list" field under the "Import Emails" module.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2021A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into CVE-2020-23214 · Websites & servers · Phplist · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Configure categories" field under the "Categorise Lists" module.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2021A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into CVE-2020-23209 · Websites & servers · Phplist · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "List Description" field under the "Edit A List" module.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2021A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into CVE-2020-23208 · Websites & servers · Phplist · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Send test" field under the "Start or continue campaign" module.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2021A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into CVE-2020-23207 · Websites & servers · Phplist · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Edit Values" field under the "Configure Attributes" module.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2021The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load durinCVE-2021-33575 · Other software · Pixar · reported by MITRECritical 9.8
The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing.
- Product
- Ruby-jss
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2021phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed bCVE-2020-23361 · Websites & servers · Phplist · reported by MITRECritical 9.8
phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports.CVE-2021-3188 · Websites & servers · Phplist · reported by MITRECritical 9.8
phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwehackmx.comwehackmx.com
Dec 25, 2020phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page.CVE-2020-35708 · Websites & servers · Phplist · reported by MITREHigh 7.2
phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.nettufangungor.github.io
Jul 8, 2020An issue was discovered in phpList through 3.5.4.CVE-2020-15073 · Websites & servers · Phplist · reported by MITREMedium 5.4
An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.telspace.co.zadiscuss.phplist.org
Jul 8, 2020An issue was discovered in phpList through 3.5.4.CVE-2020-15072 · Websites & servers · Phplist · reported by MITREHigh 8.8
An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Administrators section.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.telspace.co.zadiscuss.phplist.org
Jun 4, 2020phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php.CVE-2020-13827 · Websites & servers · Phplist · reported by MITREMedium 6.1
phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphplist.orgwizlynxgroup.com
May 4, 2020phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php.CVE-2020-12639 · Websites & servers · Phplist · reported by MITREMedium 6.1
phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2020phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e follCVE-2020-8547 · Websites & servers · Phplist · reported by MITRECritical 9.8
phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jan 15, 2020EMC RepliStor Server Service before ESA-09-003 has a DoASOCommand Remote Code Execution Vulnerability.CVE-2009-1120 · Other software · EMC · reported by security_alert@emc.comCritical 9.8
EMC RepliStor Server Service before ESA-09-003 has a DoASOCommand Remote Code Execution Vulnerability. The flaw exists within the DoRcvRpcCall RPC function -exposed via the rep_srv.exe process- where the vulnerability is caused by an error when the rep_srv.exe handles a specially crafted packet sent by an unauthenticated attacker.
- Product
- RepliStor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comfortiguard.com
Jan 10, 2020TopList before 2019-09-03 allows XSS via a title.CVE-2019-20377 · Other software · Tophub · reported by MITREMedium 6.1
TopList before 2019-09-03 allows XSS via a title.
- Product
- Toplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2019iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote atCVE-2019-19022 · Other software · Iterm2 · reported by MITREHigh 7.5
iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git repositories.
- Product
- Iterm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2019The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes to the passed pointer even if the specifiCVE-2005-3590 · Other software · GNU · reported by MITRECritical 9.8
The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes to the passed pointer even if the specified array size is zero, leading to a buffer overflow and potentially allowing attackers to corrupt memory.
- Product
- Glibc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsourceware.org
Mar 14, 2018The select component in bui through 2018-03-13 has XSS because it performs an escape operation on already-escaped text, as demonstrated by workGroupList text.CVE-2018-8108 · Other software · BUI Project · reported by MITREMedium 6.1
The select component in bui through 2018-03-13 has XSS because it performs an escape operation on already-escaped text, as demonstrated by workGroupList text.
- Product
- BUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2017Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service CVE-2017-7982 · Other software · Libimobiledevice · reported by MITREMedium 5.5
Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted plist file.
- Product
- Libplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Mar 15, 2017The parse_data_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a craftCVE-2017-6440 · Other software · Libplist Project · reported by MITREMedium 5
The parse_data_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file.
- Product
- Libplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Mar 15, 2017Heap-based buffer overflow in the parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-CVE-2017-6439 · Other software · Libplist Project · reported by MITREMedium 5
Heap-based buffer overflow in the parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) via a crafted plist file.
- Product
- Libplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Mar 15, 2017Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (outCVE-2017-6438 · Other software · Libplist Project · reported by MITREHigh 7.3
Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via a crafted plist file.
- Product
- Libplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Mar 15, 2017The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds read) via a crafted plistCVE-2017-6437 · Other software · Libplist Project · reported by MITREMedium 5
The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds read) via a crafted plist file.
- Product
- Libplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.