Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list
36added in the last 30 days
584new WordPress flaws this week
391,288entries in the database

142 results · page 2 of 3

  • Apr 9, 2019A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange SpoofiCVE-2019-0858 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.1

    A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0817.

    Product
    Microsoft Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com

  • Apr 9, 2019A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange SpoofiCVE-2019-0817 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4

    A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0858.

    Product
    Microsoft Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com

  • Jan 16, 2019Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access).CVE-2019-2512 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.7

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected are 8.4, 15.1, 15.2, 16.1, 16.2, 17.7-17.12 and 18.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).

    Product
    Primavera P6 Enterprise Project Portfolio Management
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Oct 16, 2018Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access).CVE-2018-3281 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected are 8.4, 15.1, 15.2, 16.1, 16.2, 17.7 - 17.12 and 18.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

    Product
    Primavera P6 Enterprise Project Portfolio Management
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Oct 16, 2018Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access).CVE-2018-3241 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected are 8.4, 15.1, 15.2, 16.1, 16.2, 17.7 - 17.12 and 18.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

    Product
    Primavera P6 Enterprise Project Portfolio Management
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Oct 16, 2018Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Web Access).CVE-2018-3148 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1

    Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected are 15.1, 15.2, 16.1, 16.2, 17.1-17.12 and 18.1-18.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Unifier, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

    Product
    Primavera Unifier
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Oct 10, 2018An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange SCVE-2018-8448 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4

    An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.

    Product
    Microsoft Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Oct 4, 2018Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible.CVE-2018-13258 · Other software · mediawiki · reported by security@debian.orgMedium 5.3

    Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible.

    Product
    mediawiki
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecuritytracker.comlists.wikimedia.org

  • Jul 18, 2018Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access).CVE-2018-2963 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected are 8.4, 15.x and 16.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

    Product
    Primavera P6 Enterprise Project Portfolio Management
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Jul 18, 2018Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access).CVE-2018-2962 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.4

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected are 8.4, 15.x, 16.x and 17.x. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N).

    Product
    Primavera P6 Enterprise Project Portfolio Management
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Jul 18, 2018Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access).CVE-2018-2961 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected are 8.4, 15.x, 16.x and 17.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

    Product
    Primavera P6 Enterprise Project Portfolio Management
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Jul 18, 2018Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access).CVE-2018-2960 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected are 8.4, 15.x, 16.x and 17.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

    Product
    Primavera P6 Enterprise Project Portfolio Management
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • May 9, 2018An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange ECVE-2018-8159 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4

    An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.

    Product
    Microsoft Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • May 9, 2018A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange SpoofiCVE-2018-8153 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4

    A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Spoofing Vulnerability." This affects Microsoft Exchange Server.

    Product
    Microsoft Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • May 9, 2018An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange SCVE-2018-8152 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4

    An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.

    Product
    Microsoft Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Apr 18, 2018Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access).CVE-2018-2849 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.7

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected are 16.2 and 17.1 - 17.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. While the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

    Product
    Primavera P6 Enterprise Project Portfolio Management
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Apr 12, 2018The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a serialized .NET objCVE-2018-9843 · Other software · Cyberark · reported by MITRECritical 9.8

    The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a serialized .NET object in an Authorization HTTP header.

    Product
    Password Vault
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordseclists.orgsecurityfocus.com

  • Mar 14, 2018Microsoft Exchange Outlook Web Access (OWA) in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update CVE-2018-0940 · Email & office · Microsoft Corporation · reported by secure@microsoft.comMedium 6.5

    Microsoft Exchange Outlook Web Access (OWA) in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft Exchange Server 2013 Service Pack 1, Microsoft Exchange Server 2016 Cumulative Update 7, and Microsoft Exchange Server 2016 Cumulative Update 8 allows an elevation of privilege vulnerability due to how links in the body of an email message are rewritten, aka "Microsoft Exchange Elevation of Privilege Vulnerability".

    Product
    Microsoft Exchange Outlook Web Access (OWA)
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Jan 26, 2018IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting.CVE-2017-1567 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4

    IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131769.

    Product
    Rational DOORS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordibm.comsecurityfocus.com

  • Jan 26, 2018IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting.CVE-2017-1563 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4

    IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131763.

    Product
    Rational DOORS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordibm.comsecurityfocus.com

  • Jan 26, 2018IBM Doors Web Access 9.5 and 9.6 could allow an attacker with physical access to the system to log into the application using previously stored credentials.CVE-2017-1545 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.8

    IBM Doors Web Access 9.5 and 9.6 could allow an attacker with physical access to the system to log into the application using previously stored credentials. IBM X-Force ID: 130914.

    Product
    Rational DOORS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordibm.comsecurityfocus.com

  • Jan 26, 2018IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting.CVE-2017-1540 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4

    IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130808.

    Product
    Rational DOORS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordibm.comsecurityfocus.com

  • Jan 26, 2018IBM Doors Web Access 9.5 and 9.6 could allow a remote attacker to hijack the clicking action of the victim.CVE-2017-1516 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4

    IBM Doors Web Access 9.5 and 9.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 129826.

    Product
    Rational DOORS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordibm.comsecurityfocus.com

  • Jan 26, 2018IBM Doors Web Access 9.5 and 9.6 could allow an authenticated user to obtain sensitive information from HTTP internal server error responses.CVE-2017-1515 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3

    IBM Doors Web Access 9.5 and 9.6 could allow an authenticated user to obtain sensitive information from HTTP internal server error responses. IBM X-Force ID: 129825.

    Product
    Rational DOORS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordibm.comsecurityfocus.com

  • Dec 12, 2017Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerability due to the way Outlook Web Access (OWA) validates web rCVE-2017-11932 · Email & office · Microsoft Corporation · reported by secure@microsoft.comHigh 8.1

    Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerability due to the way Outlook Web Access (OWA) validates web requests, aka "Microsoft Exchange Spoofing Vulnerability".

    Product
    Microsoft Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Sep 12, 2017Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requCVE-2017-8758 · Email & office · Microsoft Corporation · reported by secure@microsoft.comMedium 6.1

    Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability."

    Product
    Microsoft Exchange Server 2016
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Aug 8, 2017Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access).CVE-2017-10160 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access). Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

    Product
    Primavera P6 Enterprise Project Portfolio Management
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access).CVE-2017-10131 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access). Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera P6 Enterprise Project Portfolio Management. CVSS 3.0 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).

    Product
    Primavera P6 Enterprise Project Portfolio Management
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access).CVE-2017-10046 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.4

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access). Supported versions that are affected are 8.3, 8.4, 15.1, 15.2 and 16.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

    Product
    Primavera P6 Enterprise Project Portfolio Management
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access).CVE-2017-10038 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access). Supported versions that are affected are 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

    Product
    Primavera P6 Enterprise Project Portfolio Management
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Apr 24, 2017Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access).CVE-2017-3583 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access). Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).

    Product
    Primavera P6 Enterprise Project Portfolio Management
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Apr 24, 2017Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access).CVE-2017-3579 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access). Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

    Product
    Primavera P6 Enterprise Project Portfolio Management
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Apr 24, 2017Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access (Apache CommonsCVE-2017-3503 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access (Apache Commons BeanUtils)). Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. While the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Primavera P6 Enterprise Project Portfolio Management. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

    Product
    Primavera P6 Enterprise Project Portfolio Management
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Mar 16, 2017Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a craCVE-2017-0110 · Email & office · Microsoft Corporation · reported by secure@microsoft.comMedium 6.1

    Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a crafted email or chat client, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability."

    Product
    Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Jan 27, 2017Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access).CVE-2017-3324 · Other software · Oracle · reported by secalert_us@oracle.comCritical 10

    Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access). Supported versions that are affected are 8.2, 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. While the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera P6 Enterprise Project Portfolio Management. CVSS v3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).

    Product
    Primavera P6 Enterprise Project Portfolio Management
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Jun 15, 2016Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not prCVE-2016-0028 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5

    Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, aka "Microsoft Exchange Information Disclosure Vulnerability."

    Product
    Outlook Web Access
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecuritytracker.comdocs.microsoft.com

  • Jan 13, 2016Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11CVE-2016-0032 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.1

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."

    Product
    Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Jan 13, 2016Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script orCVE-2016-0031 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.1

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0029.

    Product
    Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Jan 13, 2016Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, and 2016 allows remote atCVE-2016-0030 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.1

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."

    Product
    Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Jan 13, 2016Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script orCVE-2016-0029 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.1

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0031.

    Product
    Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Sep 8, 2015Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackersCVE-2015-2544 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.3

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."

    Product
    Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecuritytracker.comdocs.microsoft.com

  • Sep 8, 2015Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to injeCVE-2015-2543 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.3

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."

    Product
    Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecuritytracker.comdocs.microsoft.com

  • Sep 8, 2015Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to obtain sensitive stacktrace information CVE-2015-2505 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5

    Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to obtain sensitive stacktrace information via a crafted request, aka "Exchange Information Disclosure Vulnerability."

    Product
    Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecuritytracker.comdocs.microsoft.com

  • Dec 16, 2014Directory traversal vulnerability in SafeNet Authentication Service (SAS) Outlook Web Access Agent (formerly CRYPTOCard) before 1.03.30109 allows remote attackeCVE-2014-5359 · Other software · Safenet-inc · reported by MITREHigh 7.8

    Directory traversal vulnerability in SafeNet Authentication Service (SAS) Outlook Web Access Agent (formerly CRYPTOCard) before 1.03.30109 allows remote attackers to read arbitrary files via a .. (dot dot) in the GetFile parameter to owa/owa.

    Product
    Safenet Authentication Service Outlook Web Access Agent
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordappcheck-ng.comsafenet-inc.com

  • Dec 10, 2014XML external entity (XXE) vulnerability in Scalix Web Access 11.4.6.12377 and 12.2.0.14697 allows remote attackers to read arbitrary files and trigger requests CVE-2014-9360 · Other software · Scalix · reported by MITREMedium 6.4

    XML external entity (XXE) vulnerability in Scalix Web Access 11.4.6.12377 and 12.2.0.14697 allows remote attackers to read arbitrary files and trigger requests to intranet servers via a crafted request.

    Product
    Web Access
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordseclists.orgsecurityfocus.com

  • Dec 9, 2014Cross-site scripting (XSS) vulnerability in the mail administration login panel in Scalix Web Access 11.4.6.12377 allows remote attackers to inject arbitrary weCVE-2014-9352 · Other software · Scalix · reported by MITREMedium 4.3

    Cross-site scripting (XSS) vulnerability in the mail administration login panel in Scalix Web Access 11.4.6.12377 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Product
    Web Access
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordseclists.orgsecurityfocus.com

  • Dec 10, 2013Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2 and SP3 and 2013 Cumulative Update 2 and 3 allows remote atCVE-2013-5072 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.3

    Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2 and SP3 and 2013 Cumulative Update 2 and 3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability."

    Product
    Exchange Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comdocs.microsoft.com

  • Dec 6, 2012Cross-site scripting (XSS) vulnerability in KENT-WEB ACCESS REPORT 5.02 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors rCVE-2012-5176 · Other software · Kent-web · reported by vultures@jpcert.or.jpMedium 4.3

    Cross-site scripting (XSS) vulnerability in KENT-WEB ACCESS REPORT 5.02 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to tag embedding.

    Product
    Access Report
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordjvn.jpjvndb.jvn.jp

  • Dec 6, 2012Cross-site scripting (XSS) vulnerability in KENT-WEB ACCESS REPORT 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors reCVE-2012-5175 · Other software · Kent-web · reported by vultures@jpcert.or.jpMedium 4.3

    Cross-site scripting (XSS) vulnerability in KENT-WEB ACCESS REPORT 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to access-log data.

    Product
    Access Report
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordjvn.jpjvndb.jvn.jp

  • Aug 25, 2012EMC ApplicationXtender Desktop before 6.5 SP2 and ApplicationXtender Web Access .NET before 6.5 SP2 allow remote attackers to upload files to any location, and CVE-2012-2289 · Other software · EMC · reported by security_alert@emc.comHigh 7.5

    EMC ApplicationXtender Desktop before 6.5 SP2 and ApplicationXtender Web Access .NET before 6.5 SP2 allow remote attackers to upload files to any location, and possibly execute arbitrary code, via unspecified vectors.

    Product
    Applicationxtender Desktop
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordarchives.neohapsis.comsecuritytracker.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.