Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
162 results · page 2 of 4
Dec 16, 2024SeedProd Pro: Unrestricted Upload of File with Dangerous TypeCVE-2024-54285 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in SeedProd LLC SeedProd Pro allows Upload a Web Shell to a Web Server.This issue affects SeedProd Pro: from n/a through 6.18.10.
- Product
- SeedProd Pro
- Affected
- up to 6.18.10
- What to do
- Affects up to 6.18.10. Update SeedProd Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024SeedProd Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54284 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SeedProd LLC SeedProd Pro allows SQL Injection.This issue affects SeedProd Pro: from n/a through 6.18.10.
- Product
- SeedProd Pro
- Affected
- up to 6.18.10
- What to do
- Affects up to 6.18.10. Update SeedProd Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024SeedProd Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54283 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SeedProd LLC SeedProd Pro allows SQL Injection.This issue affects SeedProd Pro: from n/a through 6.18.10.
- Product
- SeedProd Pro
- Affected
- up to 6.18.10
- What to do
- Affects up to 6.18.10. Update SeedProd Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 8, 2024ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name derived from an unseeded RNG).CVE-2024-55566 · Other software · reported by MITREMedium 6.6
ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name derived from an unseeded RNG). The impact can be overwriting files or making ColPack graphing unavailable to other users.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comcwe.mitre.org
Oct 6, 2024Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47299 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Stored XSS.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.17.4.
- Product
- Coming Soon Page, Under Construction & Maintenance Mode by SeedProd
- Affected
- up to 6.17.4
- What to do
- Affects up to 6.17.4. Update Coming Soon Page, Under Construction & Maintenance Mode by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2024A stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload iCVE-2024-46409 · Other software · seeddms · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter in the Calendar page.
- Product
- seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddemo6.seeddms.orgpacketstormsecurity.com
Aug 19, 2024Predictable seed generation in the security access mechanism of UDS in the Blind Spot Protection Sensor ECU in Nissan Altima (2022) allows attackers to predict CVE-2024-6348 · Other software · Nissan · reported by cve@asrg.ioMedium 5.3
Predictable seed generation in the security access mechanism of UDS in the Blind Spot Protection Sensor ECU in Nissan Altima (2022) allows attackers to predict the requested seeds and bypass security controls via repeated ECU resets and seed requests.
- Product
- Altima
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMC seed resulting in lCVE-2024-21980 · Other software · AMD · reported by psirt@amd.comHigh 7.9
Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMC seed resulting in loss of confidentiality and integrity.
- Product
- 3rd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially allowing reading of memoCVE-2023-31355 · Other software · AMD · reported by psirt@amd.comMedium 6
Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially allowing reading of memory from a decommissioned guest.
- Product
- 3rd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2024In the Linux kernel, the following vulnerability has been resolved: x86/coco: Require seeding RNG with RDRAND on CoCo systems There are few uses of CoCo that CVE-2024-35875 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.4
In the Linux kernel, the following vulnerability has been resolved: x86/coco: Require seeding RNG with RDRAND on CoCo systems There are few uses of CoCo that don't rely on working cryptography and hence a working RNG. Unfortunately, the CoCo threat model means that the VM host cannot be trusted and may actively work against guests to extract secrets or manipulate computation. Since a malicious host can modify or observe nearly all inputs to guests, the only remaining source of entropy for CoCo guests is RDRAND. If RDRAND is broken -- due to CPU hardware fault -- the RNG as a whole is meant to gracefully continue on gathering entropy from other sources, but since there aren't other sources on CoCo, this is catastrophic. This is mostly a concern at boot time when initially seeding the RNG, as after that the consequences of a broken RDRAND are much more theoretical. So, try at boot to seed the RNG using 256 bits of RDRAND output. If this fails, panic(). This will also trigger if the system is booted without RDRAND, as RDRAND is essential for a safe CoCo boot. Add this deliberately to be "just a CoCo x86 driver feature" and not part of the RNG itself. Many device drivers and platf
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 29, 2024Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.This issue aCVE-2024-1579 · Other software · Secomea · reported by VulnerabilityReporting@secomea.comHigh 8.1
Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.This issue affects GateManager: before 11.2.624071020.
- Product
- GateManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecomea.comsecomea.com
Apr 15, 2024Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: Cross-Site Request Forgery (CSRF)CVE-2024-32088 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through 6.15.20.
- Product
- Coming Soon Page, Under Construction & Maintenance Mode by SeedProd
- Affected
- up to 6.15.20
- What to do
- Affects up to 6.15.20. Update Coming Soon Page, Under Construction & Maintenance Mode by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 26, 2024RT-Thread through 5.0.2 generates random numbers with a weak algorithm of "seed = 214013L * seed + 2531011L; return (seed >> 16) & 0x7FFF;" in calc_random in drCVE-2024-25389 · Other software · rt-thread · reported by MITREHigh 7.5
RT-Thread through 5.0.2 generates random numbers with a weak algorithm of "seed = 214013L * seed + 2531011L; return (seed >> 16) & 0x7FFF;" in calc_random in drivers/misc/rt_random.c.
- Product
- rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Feb 20, 2024Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, whCVE-2024-1631 · Other software · Internet Computer · reported by 6b35d637-e00f-4228-858c-b20ad6e1d07bCritical 9.1
Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the library generates the secret key using secure randomness. However, a recent change broke this guarantee and uses an insecure seed for key pair generation. Since the private key of this identity (535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe) is compromised, one could lose funds associated with the principal on ledgers or lose access to a canister where this principal is the controller.
- Product
- agent-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordagent-js.icp.xyzgithub.com
Feb 5, 2024Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode: Unauthorized modification of dataCVE-2024-1072 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. This makes it possible for unauthenticated attackers to change the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin. Version 6.15.22 addresses this issue but introduces a bug affecting admin pages. We suggest upgrading to 6.15.23.
- Product
- Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode
- Affected
- up to 6.15.21
- What to do
- Affects up to 6.15.21. Update Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 1, 2024Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead tCVE-2023-4472 · Other software · Objectplanet · reported by mandiant-cve@google.comCritical 9.8
Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application.
- Product
- Opinio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comobjectplanet.com
Jan 16, 2024Seed Social: Does not sanitise and escape some of its settingsCVE-2022-3836 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Seed Social WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Seed Social
- Fixed in
- 2.0.4
- What to do
- Update Seed Social to 2.0.4 or newer.
Oct 20, 2023Website Builder by SeedProd: Cross-Site Request ForgeryCVE-2023-4975 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1. This is due to missing or incorrect nonce validation on functionality in the builder.php file. This makes it possible for unauthenticated attackers to change the stripe connect token via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Website Builder by SeedProd
- Affected
- up to 6.15.13.1
- What to do
- Affects up to 6.15.13.1. Update Website Builder by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 8, 2023The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue.CVE-2023-39910 · Other software · Libbitcoin · reported by MITREHigh 7.5
The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet private keys generated from "bx seed" entropy output and steal funds. (Affected users need to move funds to a secure new cryptocurrency wallet.) NOTE: the vendor's position is that there was sufficient documentation advising against "bx seed" but others disagree. NOTE: this was exploited in the wild in June and July 2023.
- Product
- Libbitcoin Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2023A cross-site scripting (XSS) vulnerability in SeedDMS v6.0.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.CVE-2021-39421 · Other software · Seeddms · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in SeedDMS v6.0.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023SeedDMS v6.0.15 was discovered to contain an open redirect vulnerability.CVE-2021-39425 · Other software · Seeddms · reported by MITREMedium 6.1
SeedDMS v6.0.15 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php file.CVE-2021-33223 · Other software · Seeddms · reported by MITREHigh 8.8
An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php file.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsunil-singh.notion.sitenotion.so
Feb 14, 2023Onekey Touch devices through 4.0.0 and Onekey Mini devices through 2.10.0 allow man-in-the-middle attackers to obtain the seed phase.CVE-2023-25758 · Other software · Onekey · reported by MITREMedium 4.2
Onekey Touch devices through 4.0.0 and Onekey Mini devices through 2.10.0 allow man-in-the-middle attackers to obtain the seed phase. The man-in-the-middle access can only be obtained after disassembling a device (i.e., here, "man-in-the-middle" does not refer to the attacker's position on an IP network). NOTE: the vendor states that "our hardware team has updated the security patch without anyone being affected."
- Product
- Onekey Touch Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.onekey.sofortune.com
Jan 20, 2023Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ECVE-2022-40267 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpMedium 5.9
Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DSS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/z (x=24,40,60, y=T,R, z=ES,ESS) versions 1.042 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/ES-A (x=24,40,60, y=T,R) versions 1.043 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5S
- Product
- MELSEC iQ-F Series FX5U-32MT/ES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability was found in Symbiote Seed up to 6.0.2.CVE-2017-20164 · Other software · Symbiote · reported by VulDBMedium 6.3
A vulnerability was found in Symbiote Seed up to 6.0.2. It has been classified as critical. Affected is the function onBeforeSecurityLogin of the file code/extensions/SecurityLoginExtension.php of the component Login. The manipulation of the argument URL leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 6.0.3 is able to address this issue. The patch is identified as b065ebd82da53009d273aa7e989191f701485244. It is recommended to upgrade the affected component. VDB-217626 is the identifier assigned to this vulnerability.
- Product
- Seed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2022Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack.CVE-2022-44938 · Other software · Seeddms · reported by MITRECritical 9.8
Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022D-Link COVR 1200,1202,1203 v1.08 was discovered to have a predictable seed in a Pseudo-Random Number Generator.CVE-2022-42159 · Other software · Dlink · reported by MITREMedium 4.3
D-Link COVR 1200,1202,1203 v1.08 was discovered to have a predictable seed in a Pseudo-Random Number Generator.
- Product
- Covr 1203 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2022SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS.CVE-2022-28479 · Other software · Seeddms · reported by MITREMedium 4.8
SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS. An attacker with admin privileges can inject the payload inside the "Role management" menu and then trigger the payload by loading the "Users management" menu
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Jun 6, 2022SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal.CVE-2022-28478 · Other software · Seeddms · reported by MITREMedium 6.5
SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal. The "Remove file" functionality inside the "Log files management" menu does not sanitize user input allowing attackers with admin privileges to delete arbitrary files on the remote system.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Jun 6, 2022The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to inCVE-2022-28051 · Other software · Seeddms · reported by MITREMedium 5.4
The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to inject malicious javascript code.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2022Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator.CVE-2022-26852 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to an account compromise.
- Product
- PowerScale OneFS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "referuCVE-2021-45408 · Other software · Seeddms · reported by MITREMedium 6.1
Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "referuri" parameter.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsunil-singh.notion.sitesunil-singh.notion.site
Jan 20, 2022Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authorizCVE-2021-34600 · Other software · Telenot Electronic GmbH · reported by info@cert.vde.comMedium 5.5
Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authorization of users. This may lead to total loss of trustworthiness of the installation.
- Product
- CompasX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordx41-dsec.dex41-dsec.de
Oct 22, 2021SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component AddEvent.php via the name and comment pCVE-2020-23048 · Other software · Seeddms · reported by MITREMedium 6.1
SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component AddEvent.php via the name and comment parameters.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Aug 3, 2021Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unlockCVE-2021-36543 · Other software · Seeddms · reported by MITREMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unlock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberdivision.medium.comcyberdivision.medium.com
Aug 3, 2021Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any CVE-2021-36542 · Other software · Seeddms · reported by MITREMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document nameCVE-2021-35343 · Other software · Seeddms · reported by MITREMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document name without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2021pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory.CVE-2021-31154 · Other software · Pleaseedit Project · reported by MITREHigh 7.8
pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.
- Product
- Pleaseedit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comopenwall.com
Mar 18, 2021SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php.CVE-2021-26216 · Other software · Seeddms · reported by MITREMedium 4.3
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtuhin1729.medium.comtuhin1729.medium.com
Mar 18, 2021SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php.CVE-2021-26215 · Other software · Seeddms · reported by MITREMedium 4.3
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtuhin1729.medium.comtuhin1729.medium.com
Mar 3, 2021A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21.CVE-2020-28597 · Other software · Epignosishq · reported by talos-cna@cisco.comHigh 7.5
A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset supplying the password reset token to reset the password of an account of their choice.
- Product
- Efront
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Feb 15, 2021steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data.CVE-2021-27211 · Other software · Steghide Project · reported by MITREHigh 7.5
steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data.
- Product
- Steghide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 14, 2021Privilege chaining vulnerability in acmailer ver.CVE-2021-20618 · Other software · Seeds Co.,Ltd. · reported by vultures@jpcert.or.jpCritical 9.8
Privilege chaining vulnerability in acmailer ver. 4.0.2 and earlier, and acmailer DB ver. 1.1.4 and earlier allows remote attackers to bypass authentication and to gain an administrative privilege which may result in obtaining the sensitive information on the server via unspecified vectors.
- Product
- acmailer and acmailer DB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2021Improper access control vulnerability in acmailer ver.CVE-2021-20617 · Other software · Seeds Co.,Ltd. · reported by vultures@jpcert.or.jpCritical 9.8
Improper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier allows remote attackers to execute an arbitrary OS command, or gain an administrative privilege which may result in obtaining the sensitive information on the server via unspecified vectors.
- Product
- acmailer and acmailer DB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2020Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChooser.php.CVE-2020-28727 · Other software · Seeddms · reported by MITREMedium 6.1
Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChooser.php.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Nov 24, 2020Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php.CVE-2020-28726 · Other software · Seeddms · reported by MITREMedium 6.1
Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Jun 24, 2020The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS.CVE-2020-15038 · WordPress plugins & themes · reported by MITREMedium 5.4
The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS.
- Product
- SeedProd coming-soon
- Fixed in
- 5.1.1
- What to do
- Update SeedProd coming-soon to 5.1.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Jun 3, 2020D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator.CVE-2020-13784 · Other software · Dlink · reported by MITREHigh 7.5
D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator.
- Product
- Dir-865l Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportannouncement.us.dlink.comunit42.paloaltonetworks.com
Dec 10, 2019lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.CVE-2012-1577 · Other software · dietlibc · reported by Red HatCritical 9.8
lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.
- Product
- dietlibc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcvsweb.openbsd.orgopenwall.com
Jun 28, 2019A stored XSS vulnerability was found in SeedDMS 5.1.11 due to poorly escaping the search result in the autocomplete search form placed in the header of out/out.CVE-2019-12932 · Other software · Seeddms · reported by MITREMedium 6.1
A stored XSS vulnerability was found in SeedDMS 5.1.11 due to poorly escaping the search result in the autocomplete search form placed in the header of out/out.Viewfolder.php.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.