Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
135 results · page 2 of 3
Oct 14, 2024Cross Site Scripting vulnerability in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalateCVE-2024-48821 · Other software · automatic_systems · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges via the FtpConfig.php component.
- Product
- maintenance_slimlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024Slim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability.CVE-2024-9440 · Other software · brian_voelker · reported by VulnCheckMedium 5.4
Slim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability. In select.ts:createOption(), the text variable from the user-provided Options object is assigned to an innerHTML without sanitation. Software that depends on this library to dynamically generate lists using unsanitized user-provided input may be vulnerable to cross-site scripting, resulting in attacker executed JavaScript. At this time, no patch is available.
- Product
- slim_select
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2024Memory corruption when BTFM client sends new messages over Slimbus to ADSP.CVE-2024-33045 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2024Muslim Prayer Time BD: Does not have CSRF check in placeCVE-2024-4758 · WordPress plugins & themes · reported by WPScanHigh 7.6
The Muslim Prayer Time BD WordPress plugin through 2.4 does not have CSRF check in place when reseting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack
- Product
- Muslim Prayer Time BD
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Muslim Prayer Time BD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2024SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php.CVE-2024-25288 · Other software · slims_project · reported by MITREMedium 4.9
SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php.
- Product
- slims
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024SlimStat Analytics: Stored Cross-Site ScriptingCVE-2024-1073 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SlimStat Analytics
- Affected
- up to 5.1.3
- What to do
- Affects up to 5.1.3. Update SlimStat Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 1, 2023SLiMS (aka SENAYAN Library Management System) through 9.6.1 allows admin/modules/reporting/customs/staff_act.php SQL Injection via startDate or untilDate.CVE-2023-48893 · Other software · Slims · reported by MITREHigh 8.8
SLiMS (aka SENAYAN Library Management System) through 9.6.1 allows admin/modules/reporting/customs/staff_act.php SQL Injection via startDate or untilDate.
- Product
- Senayan Library Management System Bulian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2023Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines_report.php.CVE-2023-48813 · Other software · Slims · reported by MITREHigh 8.8
Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines_report.php.
- Product
- Senayan Library Management System Bulian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2023Slimstat Analytics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2022-45373 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics allows SQL Injection.This issue affects Slimstat Analytics: from n/a through 5.0.4.
- Product
- Slimstat Analytics
- Affected
- up to 5.0.4
- What to do
- Affects up to 5.0.4. Update Slimstat Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 31, 2023SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote attacker to obtain sensitive information and execCVE-2023-45996 · Other software · Slims · reported by MITREHigh 8.8
SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the reborrowLimit parameter in the member_type.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2023Slimstat Analytics: SQL InjectionCVE-2023-4598 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Slimstat Analytics
- Affected
- up to 5.0.9
- What to do
- Affects up to 5.0.9. Update Slimstat Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 2, 2023Server-Side Request Forgery vulnerability in SLims version 9.6.0.CVE-2023-3744 · Other software · SLiMS · reported by cve-coordination@incibe.esCritical 9.9
Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal services or upload the contents of relevant files via the "scrape_image.php" file in the imageURL parameter.
- Product
- SLiMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2023Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loan_rules.php.CVE-2023-40970 · Other software · Slims · reported by MITREHigh 8.8
Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loan_rules.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2023Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bibliography/pop_p2p.php.CVE-2023-40969 · Other software · Slims · reported by MITREMedium 6.1
Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bibliography/pop_p2p.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2023Slimstat Analytics: Stored Cross-Site ScriptingCVE-2023-4597 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Slimstat Analytics
- Affected
- up to 5.0.9
- What to do
- Affects up to 5.0.9. Update Slimstat Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 20, 2023An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver.CVE-2023-2194 · Computers, phones & browsers · Linux · reported by Red HatMedium 6.7
An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Apr 17, 2023slim/psr7 is a PSR-7 implementation for use with Slim 4.CVE-2023-30536 · Other software · slimphp · reported by GitHubMedium 6.5
slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An attacker that is able to control the header names that are passed to Slilm-Psr7 would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the application due to the receipt of malformed requests. The issue has been patched in version 1.6.1. There are no known workarounds to this issue. Users are advised to upgrade.
- Product
- Slim-Psr7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images.CVE-2023-29850 · Other software · Slims · reported by MITREHigh 7.5
SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This allows attackers to obtain information such as the user's geolocation and device information.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2023Slimstat Analytics: Does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL queryCVE-2023-0630 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.
- Product
- Slimstat Analytics
- Fixed in
- 4.9.3.3
- What to do
- Update Slimstat Analytics to 4.9.3.3 or newer.
Feb 13, 2023SLIMS v9.5.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /customs/loan_by_class.php?reportView.CVE-2023-24086 · Other software · Slims Project · reported by MITREMedium 6.1
SLIMS v9.5.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /customs/loan_by_class.php?reportView.
- Product
- Slims
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023Slimstat Analytics: Does not sanitise and escape the URICVE-2022-4310 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slimstat Analytics WordPress plugin before 4.9.3 does not sanitise and escape the URI when logging requests, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against logged in admin viewing the logs
- Product
- Slimstat Analytics
- Fixed in
- 4.9.3
- What to do
- Update Slimstat Analytics to 4.9.3 or newer.
Dec 5, 2022SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter.CVE-2022-45019 · Other software · Slims · reported by MITREHigh 7.5
SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collType parameter at loan_by_class.php.CVE-2022-43362 · Other software · Slims · reported by MITREHigh 7.2
Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collType parameter at loan_by_class.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component pop_chart.php.CVE-2022-43361 · Other software · Slims · reported by MITREMedium 4.8
Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component pop_chart.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliography/marcsru.php andCVE-2022-38292 · Other software · Slims · reported by MITRECritical 9.8
SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliography/marcsru.php and /bibliography/z3950sru.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function.CVE-2022-38291 · Other software · Slims · reported by MITREMedium 6.1
SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search bar.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022Slims9 Bulian 9.4.2 is affected by SQL injection in /admin/modules/system/backup.php.CVE-2021-45794 · Other software · Slims · reported by MITREHigh 7.5
Slims9 Bulian 9.4.2 is affected by SQL injection in /admin/modules/system/backup.php. User data can be obtained.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php.CVE-2021-45793 · Other software · Slims · reported by MITREHigh 7.5
Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022Slims9 Bulian 9.4.2 is affected by Cross Site Scripting (XSS) in /admin/modules/system/custom_field.php.CVE-2021-45792 · Other software · Slims · reported by MITREMedium 4.8
Slims9 Bulian 9.4.2 is affected by Cross Site Scripting (XSS) in /admin/modules/system/custom_field.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022Slims8 Akasia 8.3.1 is affected by SQL injection in /admin/modules/bibliography/index.php, /admin/modules/membership/member_type.php, /admin/modules/system/userCVE-2021-45791 · Other software · Slims · reported by MITREHigh 8.8
Slims8 Akasia 8.3.1 is affected by SQL injection in /admin/modules/bibliography/index.php, /admin/modules/membership/member_type.php, /admin/modules/system/user_group.php, and /admin/modules/membership/index.php through the dir parameter. It can be used by remotely authenticated librarian users.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations.CVE-2021-32033 · Other software · Protectimus · reported by MITREMedium 4.6
Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations. The time value used by the device can be set independently from the used seed value for generating time-based one-time passwords, without authentication. Thus, an attacker with short-time physical access to a device can set the internal real-time clock (RTC) to the future, generate one-time passwords, and reset the clock to the current time. This allows the generation of valid future time-based one-time passwords without having further access to the hardware token.
- Product
- Slim NFC 70 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 8, 2020The official znc docker images before 1.7.1-slim contain a blank password for a root user.CVE-2020-29577 · Other software · ZNC · reported by MITRECritical 9.8
The official znc docker images before 1.7.1-slim contain a blank password for a root user. Systems using the znc docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- ZNC Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2020An issue was discovered on KT Slim egg IML500 (R7283, R8112, R8424) and IML520 (R8112, R8368, R8411) wifi device.CVE-2020-7805 · Other software · Infomark · reported by vuln@krcert.or.krCritical 9.8
An issue was discovered on KT Slim egg IML500 (R7283, R8112, R8424) and IML520 (R8112, R8368, R8411) wifi device. This issue is a command injection allowing attackers to execute arbitrary OS commands.
- Product
- KT Slim egg IML500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfomark.co.krkrcert.or.kr
Nov 4, 2019slim has NULL pointer dereference when using crypt() method from glibc 2.17CVE-2013-4412 · Other software · slim · reported by Red HatHigh 7.5
slim has NULL pointer dereference when using crypt() method from glibc 2.17
- Product
- slim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Aug 21, 2019The wp-slimstat plugin before 4.8.1 for WordPress has XSS.CVE-2019-15112 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-slimstat plugin before 4.8.1 for WordPress has XSS.
- Product
- wp-slimstat
- Fixed in
- 4.8.1
- What to do
- Update wp-slimstat to 4.8.1 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Oct 20, 2018There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the function ProcessMSLScript of coders/msl.c in GraphicsMCVE-2018-18544 · Other software · Graphicsmagick · reported by MITREMedium 6.5
There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31.
- Product
- Graphicsmagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.code.sf.netlists.opensuse.org
Oct 7, 2018The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-basedCVE-2015-9273 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
- Product
- wp-slimstat (aka Slimstat Analytics)
- Fixed in
- 4.1.6.1
- What to do
- Update wp-slimstat (aka Slimstat Analytics) to 4.1.6.1 or newer.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Jun 22, 2018SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrf_token parameter.CVE-2018-12659 · Other software · Slims Akasia Project · reported by MITREHigh 8.8
SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrf_token parameter.
- Product
- Slims Akasia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2018Reflected Cross-Site Scripting (XSS) exists in the Stock Take module in SLiMS 8 Akasia 8.3.1 via an admin/modules/stock_take/index.php?keywords= URI.CVE-2018-12658 · Other software · Slims Project · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) exists in the Stock Take module in SLiMS 8 Akasia 8.3.1 via an admin/modules/stock_take/index.php?keywords= URI.
- Product
- Slims
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2018Reflected Cross-Site Scripting (XSS) exists in the Master File module in SLiMS 8 Akasia 8.3.1 via an admin/modules/master_file/rda_cmc.php?keywords= URI.CVE-2018-12657 · Other software · Slims Akasia Project · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) exists in the Master File module in SLiMS 8 Akasia 8.3.1 via an admin/modules/master_file/rda_cmc.php?keywords= URI.
- Product
- Slims Akasia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2018Reflected Cross-Site Scripting (XSS) exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywords= URI.CVE-2018-12656 · Other software · Slims Akasia Project · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywords= URI.
- Product
- Slims Akasia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2018Reflected Cross-Site Scripting (XSS) exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loan_rules.php?keywords= URI, a rCVE-2018-12655 · Other software · Slims Akasia Project · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loan_rules.php?keywords= URI, a related issue to CVE-2017-7242.
- Product
- Slims Akasia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2018Reflected Cross-Site Scripting (XSS) exists in the Bibliography module in SLiMS 8 Akasia 8.3.1 via an admin/modules/bibliography/index.php?keywords= URI.CVE-2018-12654 · Other software · Slims Akasia Project · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) exists in the Bibliography module in SLiMS 8 Akasia 8.3.1 via an admin/modules/bibliography/index.php?keywords= URI.
- Product
- Slims Akasia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2018slimerjs-edge is a npm wrapper for installing the bleeding edge version of slimerjs.CVE-2016-10644 · Other software · HackerOne · reported by support@hackerone.comHigh 8.1
slimerjs-edge is a npm wrapper for installing the bleeding edge version of slimerjs. slimerjs-edge downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
- Product
- slimerjs-edge node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 1, 2018headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies.CVE-2016-10625 · Other software · HackerOne · reported by support@hackerone.comHigh 8.1
headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies. headless-browser-lite downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
- Product
- headless-browser-lite node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter.CVE-2017-17988 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php.CVE-2017-17987 · Other software · Muslim Matrimonial Script Project · reported by MITREHigh 7.2
PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter.CVE-2017-17986 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter.CVE-2017-17985 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter.CVE-2017-17984 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.