Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
100 results · page 2 of 2
Sep 5, 2024Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email, and contact# in /clientdetails/admin/regCVE-2024-44728 · Other software · sourcecodehero · reported by MITREMedium 6.1
Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email, and contact# in /clientdetails/admin/regester.php.
- Product
- event_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php.CVE-2024-44727 · Other software · sourcecodehero · reported by MITRECritical 9.8
Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php.
- Product
- event_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2024-45399 · Other software · indico · reported by GitHubMedium 4.3
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4, corresponding to Flask-Multipass prior to version 0.5.5, there is a Cross-Site-Scripting vulnerability during account creation when redirecting to the `next` URL. Exploitation requires initiating the account creation process with a maliciously crafted link, and then finalizing the signup process. Because of this, it can only target newly created (and thus unprivileged) Indico users. Indico 3.3.4 upgrades the dependency on Flask-Multipass to version 0.5.5, which fixes the issue. Those who build the Indico package themselves and cannot upgrade can update the `flask-multipass` dependency to `>=0.5.5` which fixes the vulnerability. Otherwise one could configure one's web server to disallow requests containing a query string with a `next` parameter that starts with `javascript:`.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0.CVE-2024-33994 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session details via the 'view' parameter in '/event/index.php'.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0.CVE-2024-33993 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session details via the 'view' parameter in /candidate/index.php'.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0.CVE-2024-33992 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the 'view' parameter in '/student/index.php'.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0.CVE-2024-33991 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the 'view' parameter in '/eventwinner/index.php'.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0.CVE-2024-33990 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the 'id' and 'view' parameters in '/user/index.php'.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0.CVE-2024-33989 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the 'eventdate' and 'events' parameters in 'port/event_print.php'.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0.CVE-2024-33988 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate' and 'YearLevel' parameters in '/report/attendance_print.php'.
- Product
- School Attendance Monitoring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0.CVE-2024-33987 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate', 'YearLevel', 'eventdate', 'events', 'Users' and 'YearLevel' parameters in '/report/index.php'.
- Product
- School Attendance Monitoring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0.CVE-2024-33986 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'View' parameter in '/department/index.php'.
- Product
- School Attendance Monitoring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0.CVE-2024-33985 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'View' parameter in '/course/index.php'.
- Product
- School Attendance Monitoring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0.CVE-2024-33984 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate' and 'YearLevel' parameters in '/AttendanceMonitoring/report/index.php'.
- Product
- School Attendance Monitoring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0.CVE-2024-33983 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate' and 'YearLevel' parameters in '/AttendanceMonitoring/report/attendance_print.php'.
- Product
- School Attendance Monitoring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0.CVE-2024-33982 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'StudentID' parameter in '/AttendanceMonitoring/student/controller.php'.
- Product
- School Attendance Monitoring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2024Event Management Tickets Booking: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-5059 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Event Management Tickets Booking.This issue affects Event Management Tickets Booking: from n/a through 1.4.0.
- Product
- Event Management Tickets Booking
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Event Management Tickets Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 30, 2024Event Monster – Event Management, Tickets Booking, Upcoming Event: PHP Object InjectionCVE-2024-1895 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.9 via deserialization via shortcode of untrusted input from a custom meta value. This makes it possible for authenticated attackers, with contributor access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- Event Monster – Event Management, Tickets Booking, Upcoming Event
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Event Monster – Event Management, Tickets Booking, Upcoming Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 26, 2024SQL Injection vulnerability in /event-management-master/backend/register.php in PuneethReddyHC Event Management 1.0 allows attackers to run arbitrary SQL commanCVE-2024-28322 · Other software · puneethreddyhc · reported by MITRECritical 9.8
SQL Injection vulnerability in /event-management-master/backend/register.php in PuneethReddyHC Event Management 1.0 allows attackers to run arbitrary SQL commands via the event_id parameter in a crafted POST request.
- Product
- event_management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Apr 7, 2024A vulnerability classified as problematic has been found in PuneethReddyHC Event Management 1.0.CVE-2024-3433 · Other software · PuneethReddyHC · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in PuneethReddyHC Event Management 1.0. Affected is an unknown function of the file /backend/register.php. The manipulation of the argument event_id/full_name/email/mobile/college/branch leads to cross site scripting. It is possible to launch the attack remotely. VDB-259614 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Event Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Apr 7, 2024A vulnerability was found in PuneethReddyHC Event Management 1.0.CVE-2024-3432 · Other software · PuneethReddyHC · reported by VulDBMedium 5.5
A vulnerability was found in PuneethReddyHC Event Management 1.0. It has been rated as critical. This issue affects some unknown processing of the file /backend/register.php. The manipulation of the argument event_id/full_name/email/mobile/college/branch leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259613 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Event Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Feb 13, 2024sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid.CVE-2024-24751 · Other software · derhansen · reported by GitHubMedium 4.3
sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the `RedirectResponse` from the `$this->redirect()` function was never handled. This issue has been addressed in version 7.4.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- sf_event_mgt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management).CVE-2024-20916 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.3
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). The supported version that is affected is 13.5.0.0. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Manager Base Platform accessible data as well as unauthorized access to critical data or complete access to all Oracle Enterprise Manager Base Platform accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L).
- Product
- Enterprise Manager Base Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2023Event Monster – Event Management, Tickets Booking, Upcoming Event: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47525 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Event Monster – Event Management, Tickets Booking, Upcoming Event allows Stored XSS.This issue affects Event Monster – Event Management, Tickets Booking, Upcoming Event: from n/a through 1.3.2.
- Product
- Event Monster – Event Management, Tickets Booking, Upcoming Event
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Event Monster – Event Management, Tickets Booking, Upcoming Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 21, 2023Indico is an open source a general-purpose, web based event management tool.CVE-2023-37901 · Other software · indico · reported by GitHubMedium 5.4
Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges (such as a speaker) and then someone else to attempt to delete this content. Considering that event organizers may want to delete suspicious-looking content when spotting it, there is a non-negligible risk of such an attack to succeed. The risk of this could be further increased when combined with some some social engineering pointing the victim towards this content. Users need to update to Indico 3.2.6 as soon as possible. See the docs for instructions on how to update. Users who cannot upgrade should only let trustworthy users manage categories, create events or upload materials ("submission" privileges on a contribution/event). This should already be the case in a properly-configured setup when it comes to category/event management. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update t
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.getindico.iogithub.com
Feb 4, 2023A vulnerability, which was classified as critical, was found in Calendar Event Management System 2.3.0.CVE-2023-0675 · Other software · Calendar Event Management System Project · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Calendar Event Management System 2.3.0. This affects an unknown part. The manipulation of the argument start/end leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220197 was assigned to this vulnerability.
- Product
- Calendar Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023A vulnerability was found in Calendar Event Management System 2.3.0.CVE-2023-0663 · Other software · Calendar Event Management System Project · reported by VulDBHigh 7.3
A vulnerability was found in Calendar Event Management System 2.3.0. It has been rated as critical. This issue affects some unknown processing of the component Login Page. The manipulation of the argument name/pwd leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-220175.
- Product
- Calendar Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2022Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /Royal_Event/update_image.php.CVE-2022-38323 · Other software · Event Management System Project · reported by MITREHigh 7.2
Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /Royal_Event/update_image.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management in Synology Calendar before 2.4.5-10930 aCVE-2022-22682 · Network & remote access · Synology · reported by security@synology.comMedium 6.5
Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management in Synology Calendar before 2.4.5-10930 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Synology Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
May 5, 2022Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.CVE-2022-28080 · Other software · Event Management System Project · reported by MITREHigh 8.8
Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.
- Product
- Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 18, 2022RSVP and Event Management: Does not have any authorisation checksCVE-2022-1054 · WordPress plugins & themes · reported by WPScanMedium 5.3
The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events
- Product
- RSVP and Event Management
- Fixed in
- 2.7.8
- What to do
- Update RSVP and Event Management to 2.7.8 or newer.
Mar 2, 2022Event Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the full_name parameter under register.php.CVE-2022-25114 · Other software · Event Management Project · reported by MITREMedium 6.1
Event Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the full_name parameter under register.php.
- Product
- Event Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2021The IBM Cloud APM 8.1.4 server will issue a DNS request to resolve any hostname specified in the Cloud Event Management Webhook URL configuration definition.CVE-2020-4719 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.9
The IBM Cloud APM 8.1.4 server will issue a DNS request to resolve any hostname specified in the Cloud Event Management Webhook URL configuration definition. This could enable an authenticated user with admin authorization to create DNS query strings that are not hostnames. IBM X-Force ID: 187861.
- Product
- Cloud APM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 2, 2020The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosure (participant data, CVE-2020-25026 · Other software · Derhansen · reported by MITREMedium 4.3
The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosure (participant data, and event data via email) because of Broken Access Control.
- Product
- Event Management And Registration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2020Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management).CVE-2020-2622 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6
Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions that are affected are 12.1.0.5, 13.2.0.0 and 13.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Enterprise Manager Base Platform accessible data as well as unauthorized update, insert or delete access to some of Enterprise Manager Base Platform accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Enterprise Manager Base Platform. CVSS 3.0 Base Score 6.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L).
- Product
- Enterprise Manager Base Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2019A vulnerability in the Event Management Service daemon (emsd) of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of servCVE-2019-1711 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the Event Management Service daemon (emsd) of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this vulnerability by repeatedly sending unauthenticated gRPC requests to the affected device. A successful exploit could cause the emsd process to crash, resulting in a DoS condition. Resolved in Cisco IOS XR 6.5.1 and later.
- Product
- Cisco IOS XR Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Nov 16, 2018School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.CVE-2018-18795 · Other software · School Event Management System Project · reported by MITRECritical 9.8
School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Nov 16, 2018School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.CVE-2018-18794 · Other software · School Event Management System Project · reported by MITREHigh 8.8
School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Nov 16, 2018School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos.CVE-2018-18793 · Other software · School Event Management System Project · reported by MITRECritical 9.8
School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Sep 27, 2017SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recuCVE-2017-14760 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recurrence_id parameter to /wp-admin/admin.php.
- Product
- event-espresso-free (aka Event Espresso Lite)
- Affected
- up to 3.1.37.12.l
- What to do
- Affects up to 3.1.37.12.l. Update event-espresso-free (aka Event Espresso Lite) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsstrunk.comsstrunk.com
May 16, 2017A vulnerability in the Event Management Service daemon (emsd) of Cisco IOS XR routers could allow an unauthenticated, remote attacker to cause a denial of serviCVE-2017-3876 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the Event Management Service daemon (emsd) of Cisco IOS XR routers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this vulnerability by repeatedly sending unauthenticated gRPC requests to the affected device. A successful exploit could allow the attacker to crash the device in such a manner that manual intervention is required to recover. This vulnerability affects all Cisco IOS XR platforms that are running release 6.1.1 of Cisco IOS XR Software when the gRPC service is enabled on the device. The gRPC service is not enabled by default. Cisco Bug IDs: CSCvb14441.
- Product
- IOS XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jan 5, 2017Authentication bypass vulnerability in Enterprise Security Manager (ESM) and License Manager (LM) in Intel Security McAfee Security Information and Event ManageCVE-2016-8006 · Other software · Mcafee · reported by secure@intel.comMedium 4.4
Authentication bypass vulnerability in Enterprise Security Manager (ESM) and License Manager (LM) in Intel Security McAfee Security Information and Event Management (SIEM) 9.6.0 MR3 allows an administrator to make changes to other SIEM users' information including user passwords without supplying the current administrator password a second time via the GUI or GUI terminal commands.
- Product
- Security Information And Event Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordquantumleap.itsecurityfocus.com
Dec 13, 2016A vulnerability in the HTTP 2.0 request handling code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Event Management SerCVE-2016-9205 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the HTTP 2.0 request handling code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Event Management Service daemon (emsd) to crash, resulting in a denial of service (DoS) condition. More Information: CSCvb14425. Known Affected Releases: 6.1.1.BASE. Known Fixed Releases: 6.1.2.6i.MGBL 6.1.22.9i.MGBL 6.2.1.14i.MGBL.
- Product
- IOS XR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Oct 28, 2016Multiple GET parameters in the vulnerability scan scheduler of AlienVault OSSIM and USM before 5.3.2 are vulnerable to reflected XSS.CVE-2016-8583 · Other software · Alienvault · reported by MITREMedium 6.1
Multiple GET parameters in the vulnerability scan scheduler of AlienVault OSSIM and USM before 5.3.2 are vulnerable to reflected XSS.
- Product
- Open Source Security Information And Event Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comalienvault.com
Oct 28, 2016A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database infCVE-2016-8582 · Other software · Alienvault · reported by MITRECritical 9.8
A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE.
- Product
- Open Source Security Information And Event Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comalienvault.com
Oct 28, 2016A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal seCVE-2016-8581 · Other software · Alienvault · reported by MITREMedium 6.1
A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal session IDs of logged in users when the current sessions are viewed by an administrator.
- Product
- Open Source Security Information And Event Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comalienvault.com
Oct 28, 2016PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2.CVE-2016-8580 · Other software · Alienvault · reported by MITRECritical 9.8
PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes.
- Product
- Open Source Security Information And Event Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comalienvault.com
Sep 26, 2016Cross-site scripting (XSS) vulnerability in AlienVault OSSIM before 5.3 and USM before 5.3 allows remote attackers to inject arbitrary web script or HTML via thCVE-2016-6913 · Other software · Alienvault · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in AlienVault OSSIM before 5.3 and USM before 5.3 allows remote attackers to inject arbitrary web script or HTML via the back parameter to ossim/conf/reload.php.
- Product
- Open Source Security Information And Event Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Aug 18, 2011The event-management implementation in Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properlCVE-2011-2981 · Computers, phones & browsers · Mozilla · reported by MITREHigh 9.3
The event-management implementation in Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly select the context for script to run in, which allows remote attackers to bypass the Same Origin Policy or execute arbitrary JavaScript code with chrome privileges via a crafted web site.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jul 20, 2011Unspecified vulnerability in the Event Management component in Oracle Database Server 10.1.0.5, 10.2.0.3, and 10.2.0.4, and Oracle Enterprise Manager Grid ContrCVE-2011-0830 · Other software · Oracle · reported by secalert_us@oracle.comMedium 4.3
Unspecified vulnerability in the Event Management component in Oracle Database Server 10.1.0.5, 10.2.0.3, and 10.2.0.4, and Oracle Enterprise Manager Grid Control 10.1.0.6, allows remote attackers to affect integrity via unknown vectors related to Rules Management UI.
- Product
- Database Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.