Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list
34added in the last 30 days
303new WordPress flaws this week
390,007entries in the database

83 results · page 2 of 2

  • Oct 9, 2019A security vulnerability exists in the Zingbox Inspector versions 1.294 and earlier, that could allow an attacker to supply an invalid software update image to CVE-2019-15019 · Other software · Zingbox · reported by psirt@paloaltonetworks.comCritical 9.8

    A security vulnerability exists in the Zingbox Inspector versions 1.294 and earlier, that could allow an attacker to supply an invalid software update image to the Zingbox Inspector.

    Product
    Inspector
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 9, 2019A security vulnerability exists in the Zingbox Inspector versions 1.280 and earlier, where authentication is not required when binding the Inspector instance toCVE-2019-15018 · Other software · Zingbox · reported by psirt@paloaltonetworks.comHigh 7.5

    A security vulnerability exists in the Zingbox Inspector versions 1.280 and earlier, where authentication is not required when binding the Inspector instance to a different customer tenant.

    Product
    Inspector
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 9, 2019The SSH service is enabled on the Zingbox Inspector versions 1.294 and earlier, exposing SSH to the local network.CVE-2019-15017 · Other software · Zingbox · reported by psirt@paloaltonetworks.comHigh 8.4

    The SSH service is enabled on the Zingbox Inspector versions 1.294 and earlier, exposing SSH to the local network. When combined with PAN-SA-2019-0027, this can allow an attacker to authenticate to the service using hardcoded credentials.

    Product
    Inspector
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 9, 2019An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that allows for unsanitized data provided by CVE-2019-15016 · Other software · Zingbox · reported by psirt@paloaltonetworks.comHigh 8.8

    An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that allows for unsanitized data provided by an authenticated user to be passed from the web UI into the database.

    Product
    Inspector
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 9, 2019In the Zingbox Inspector, versions 1.294 and earlier, hardcoded credentials for root and inspector user accounts are present in the system software, which can rCVE-2019-15015 · Other software · Zingbox · reported by psirt@paloaltonetworks.comHigh 8.4

    In the Zingbox Inspector, versions 1.294 and earlier, hardcoded credentials for root and inspector user accounts are present in the system software, which can result in unauthorized users gaining access to the system.

    Product
    Inspector
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 9, 2019A command injection vulnerability exists in the Zingbox Inspector versions 1.286 and earlier, that allows for an authenticated user to execute arbitrary system CVE-2019-15014 · Other software · Zingbox · reported by psirt@paloaltonetworks.comHigh 8.8

    A command injection vulnerability exists in the Zingbox Inspector versions 1.286 and earlier, that allows for an authenticated user to execute arbitrary system commands in the CLI.

    Product
    Inspector
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 30, 2019A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1.CVE-2019-10141 · Other software · RedHat · reported by Red HatHigh 8.3

    A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service.

    Product
    openstack-ironic-inspector
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 28, 2018A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection anCVE-2018-15365 · Other software · Trend Micro · reported by security@trendmicro.comMedium 5.4

    A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability.

    Product
    Trend Micro Deep Discovery Inspector
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 23, 2018There exists one NULL pointer dereference vulnerability in AP4_JsonInspector::AddField in Ap4Atom.cpp in Bento4 1.5.1-624, which can allow attackers to cause a CVE-2018-14543 · Other software · Axiosys · reported by MITREMedium 5.5

    There exists one NULL pointer dereference vulnerability in AP4_JsonInspector::AddField in Ap4Atom.cpp in Bento4 1.5.1-624, which can allow attackers to cause a denial-of-service via a crafted mp4 file. This vulnerability can be triggered by the executable mp4dump.

    Product
    Bento4
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 17, 2018The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution.CVE-2018-7160 · Other software · The Node.js Project · reported by cve-request@iojs.orgHigh 8.8

    The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.

    Product
    Node.js
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 3, 2017Denial of Service vulnerability in Trend Micro Deep Discovery Email Inspector 2.5.1 allows remote attackers to delete arbitrary files on vulnerable installationCVE-2017-11382 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.5

    Denial of Service vulnerability in Trend Micro Deep Discovery Email Inspector 2.5.1 allows remote attackers to delete arbitrary files on vulnerable installations, thus disabling the service. Formerly ZDI-CAN-4350.

    Product
    Trend Micro Deep Discovery Email Inspector
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 30, 2017The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows remote attackers to enable a Remote Web Inspector that is aCVE-2017-9494 · Other software · Motorola · reported by MITREMedium 5.3

    The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows remote attackers to enable a Remote Web Inspector that is accessible from the public Internet.

    Product
    Mx011anm Firmware
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 28, 2017Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI LibrarCVE-2017-5682 · Other software · Intel · reported by secure@intel.comHigh 7.3

    Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI Library, Intel Trace Analyzer and Collector, Intel Integrated Performance Primitives, Cryptography for Intel Integrated Performance Primitives, Intel Math Kernel Library, Intel Data Analytics Acceleration Library, and Intel Threading Building Blocks before 2017 Update 2 allows an attacker to launch a process with escalated privileges.

    Product
    Advisor
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 11, 2016Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8_inspector/V8Debugger.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on WindowsCVE-2016-5164 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.1

    Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8_inspector/V8Debugger.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML into the Developer Tools (aka DevTools) subsystem via a crafted web site, aka "Universal XSS (UXSS)."

    Product
    Chrome
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 30, 2016hotfix_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7, 3.8 SP1 (3.81), and 3.8 SP2 (3.82) allows remote administrators to execute arbitrary code vCVE-2016-5840 · Other software · Trend Micro · reported by MITREHigh 7.2

    hotfix_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7, 3.8 SP1 (3.81), and 3.8 SP2 (3.82) allows remote administrators to execute arbitrary code via shell metacharacters in the filename parameter of the Content-Disposition header.

    Product
    Deep Discovery Inspector
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 25, 2015OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and CVE-2015-5306 · Other software · Openstack · reported by Red HatMedium 6.8

    OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.

    Product
    Ironic Inspector
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 24, 2015Cross-site scripting (XSS) vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject arbitrary web script CVE-2015-6663 · Network & remote access · SAP · reported by MITREMedium 4.3

    Cross-site scripting (XSS) vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject arbitrary web script or HTML via crafted client name data, aka SAP Security Note 2152669.

    Product
    Afaria
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 23, 2015Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.CVE-2015-2873 · Other software · Trendmicro · reported by cret@cert.orgMedium 5.5

    Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allows remote attackers to obtain sensitive information or change the configuration via a direct request to the (1) system log URL, (2) whitelist URL, or (3) blacklist URL.

    Product
    Deep Discovery Inspector
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 23, 2015Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1CVE-2015-2872 · Other software · Trendmicro · reported by cret@cert.orgMedium 4.3

    Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allow remote attackers to inject arbitrary web script or HTML via (1) crafted input to index.php that is processed by certain Internet Explorer 7 configurations or (2) crafted input to the widget feature.

    Product
    Deep Discovery Inspector
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 18, 2014Cross-site scripting (XSS) vulnerability in the Process Inspector in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3 and 8.5.x through 8.5.5 allows remCVE-2014-6173 · Other software · IBM · reported by psirt@us.ibm.comLow 3.5

    Cross-site scripting (XSS) vulnerability in the Process Inspector in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3 and 8.5.x through 8.5.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

    Product
    Business Process Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 24, 2013WebKit in Apple Safari before 6.1 disables the Private Browsing feature upon a launch of the Web Inspector, which makes it easier for context-dependent attackerCVE-2013-5130 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5

    WebKit in Apple Safari before 6.1 disables the Private Browsing feature upon a launch of the Web Inspector, which makes it easier for context-dependent attackers to obtain browsing information by leveraging LocalStorage/ files.

    Product
    Safari
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 21, 2012The Style Inspector in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 does not properly restrict the context of HTML markup and Cascading StyleCVE-2012-4210 · Computers, phones & browsers · Mozilla · reported by MITREHigh 9.3

    The Style Inspector in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 does not properly restrict the context of HTML markup and Cascading Style Sheets (CSS) token sequences, which allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted stylesheet.

    Product
    Firefox
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 2, 2011Buffer overflow in the inspector serialization functionality in Google Chrome before 13.0.782.107 allows user-assisted remote attackers to have an unspecified iCVE-2011-2788 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.8

    Buffer overflow in the inspector serialization functionality in Google Chrome before 13.0.782.107 allows user-assisted remote attackers to have an unspecified impact via unknown vectors.

    Product
    Chrome
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 11, 2011WebKit in Apple Safari before 5.0.4, when the Web Inspector is used, does not properly handle the window.console._inspectorCommandLineAPI property, which allowsCVE-2011-0169 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 2.6

    WebKit in Apple Safari before 5.0.4, when the Web Inspector is used, does not properly handle the window.console._inspectorCommandLineAPI property, which allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted web site.

    Product
    Safari
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 4, 2010libguestfs before 1.5.23, as used in virt-v2v, virt-inspector 1.5.3 and earlier, and possibly other products, when a raw-format disk image is used, allows localCVE-2010-3851 · Other software · Libguestfs · reported by Red HatMedium 4.7

    libguestfs before 1.5.23, as used in virt-v2v, virt-inspector 1.5.3 and earlier, and possibly other products, when a raw-format disk image is used, allows local guest OS administrators to read files from the host via a crafted (1) qcow2, (2) VMDK, or (3) VDI header, related to lack of support for a disk format specifier.

    Product
    Libguestfs
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 10, 2009Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web scrCVE-2009-1715 · Computers, phones & browsers · Apple · reported by MITREMedium 4.3

    Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to script execution with incorrect privileges.

    Product
    Safari
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 10, 2009Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web scrCVE-2009-1714 · Computers, phones & browsers · Apple · reported by MITREMedium 4.3

    Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to the improper escaping of HTML attributes.

    Product
    Safari
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 4, 2008SQL injection vulnerability in Wiz-Ad 1.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.CVE-2007-6719 · Other software · Inspector IT · reported by MITREHigh 7.5

    SQL injection vulnerability in Wiz-Ad 1.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

    Product
    Wiz-ad
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 6, 2008The SysInspector AntiStealth driver (esiasdrv.sys) 3.0.65535.0 in ESET System Analyzer Tool 1.1.1.0 allows local users to execute arbitrary code via a certain MCVE-2008-4451 · Other software · Eset Software · reported by MITREHigh 7.2

    The SysInspector AntiStealth driver (esiasdrv.sys) 3.0.65535.0 in ESET System Analyzer Tool 1.1.1.0 allows local users to execute arbitrary code via a certain METHOD_NEITHER IOCTL request to \Device\esiasdrv that overwrites a pointer.

    Product
    System Analyzer Tool
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 20, 2008MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to cause a (1) denial of service (exception and crash) via a UDP packet to the SCVE-2008-1402 · Other software · Mg-soft · reported by MITREHigh 7.1

    MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to cause a (1) denial of service (exception and crash) via a UDP packet to the SNMP Trap Service (MgWTrap3.exe) or (2) denial of service (device freeze or memory consumption) via a malformed request to the Net Inspector Server (niengine).

    Product
    NET Inspector
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 20, 2008Format string vulnerability in the Net Inspector HTTP server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to exeCVE-2008-1401 · Other software · Mg-soft · reported by MITREMedium 4.3

    Format string vulnerability in the Net Inspector HTTP server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to execute arbitrary code via format string specifiers in the URI, which is recorded in a log file.

    Product
    NET Inspector
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 20, 2008Directory traversal vulnerability in the Net Inspector HTTP Server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers CVE-2008-1400 · Other software · Mg-soft · reported by MITREMedium 5

    Directory traversal vulnerability in the Net Inspector HTTP Server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) or "../" (dot dot slash) in the URI.

    Product
    NET Inspector
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 22, 2001Directory traversal vulnerability in the web server for (1) Elron Internet Manager (IM) Message Inspector and (2) Anti-Virus before 3.0.4 allows remote attackerCVE-2001-0571 · Other software · Elron · reported by MITREMedium 5

    Directory traversal vulnerability in the web server for (1) Elron Internet Manager (IM) Message Inspector and (2) Anti-Virus before 3.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the requested URL.

    Product
    IM Anti Virus
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.