Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
206 results · page 2 of 5
Oct 27, 2025An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to eCVE-2025-61481 · Other software · reported by MITRECritical 10
An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the administrator’s browser and intercept credentials.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.mikrotik.comhelp.mikrotik.com
Oct 27, 2025HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36 wiCVE-2025-12055 · Other software · MPDV Mikrolab GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.5
HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36 with Servicepack 8 (week 36/2025), which allows an attacker to read arbitrary files from the Windows operating system. The "Filename" parameter of the public $SCHEMAS$ ressource is vulnerable and can be exploited easily.
- Product
- MIP 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comseclists.org
Sep 25, 2025A vulnerability has been found in MikroTik RouterOS 7.CVE-2025-10948 · Network & remote access · MikroTik · reported by VulDBHigh 7.4
A vulnerability has been found in MikroTik RouterOS 7. This affects the function parse_json_element of the file /rest/ip/address/print of the component libjson.so. The manipulation leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.20.1 and 7.21beta2 mitigates this issue. You should upgrade the affected component. The vendor replied: "Our bug tracker reports that your issue has been fixed. This means that we plan to release a RouterOS update with this fix. Make sure to upgrade to the next release when it comes out."
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability.CVE-2025-9276 · Other software · Cockroach Labs · reported by zdi-disclosures@trendmicro.comCritical 9.8
Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability. This vulnerability could allow remote attackers to bypass authentication on systems that use the affected version of the Cockroach Labs cockroach-k8s-request-cert container image. The specific flaw exists within the configuration of the system shadow file. The issue results from a blank password setting for the root user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-22195.
- Product
- cockroach-k8s-request-cert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kron Technologies Kron PAM allows Stored XSS.CVE-2025-5254 · Other software · Kron Technologies · reported by iletisim@usom.gov.trMedium 6.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kron Technologies Kron PAM allows Stored XSS. This issue affects Kron PAM: before 3.7.
- Product
- Kron PAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jul 25, 2025Allocation of Resources Without Limits or Throttling vulnerability in Kron Technologies Kron PAM allows HTTP DoS.CVE-2025-5253 · Other software · Kron Technologies · reported by iletisim@usom.gov.trMedium 6.5
Allocation of Resources Without Limits or Throttling vulnerability in Kron Technologies Kron PAM allows HTTP DoS. This issue affects Kron PAM: before 3.7.
- Product
- Kron PAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jul 3, 2025A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2.CVE-2025-6563 · Network & remote access · MikroTik · reported by 1c6b5737-9389-4011-8117-89fa251edfb2Medium 4.8
A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also be converted to a GET request, allowing an attacker to send a specifically crafted URL that automatically logs in the victim (into the attacker's account) and triggers the payload.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025A misconfiguration in the default settings of MikroTik RouterOS 7 and fixed in v7.14 allows incoming IPv6 UDP traceroute packets.CVE-2023-47310 · Other software · reported by MITREMedium 6.5
A misconfiguration in the default settings of MikroTik RouterOS 7 and fixed in v7.14 allows incoming IPv6 UDP traceroute packets.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB CVE-2024-12143 · Other software · Mobilteg Mobile Informatics · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB allows SQL Injection. This issue affects Mikro Hand Terminal - MikroDB. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
- Product
- Mikro Hand Terminal - MikroDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jun 25, 2025Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability.CVE-2025-6443 · Network & remote access · Mikrotik · reported by zdi-disclosures@trendmicro.comHigh 7.2
Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of remote IP addresses when processing VXLAN traffic. The issue results from the lack of validation of the remote IP address against configured values prior to allowing ingress traffic into the internal network. An attacker can leverage this vulnerability to gain access to internal network resources. Was ZDI-CAN-26415.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025Krowd: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32595 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Krowd krowd allows PHP Local File Inclusion.This issue affects Krowd: from n/a through < 1.5.0.
- Product
- Krowd
- What to do
- Update Krowd to the newest version.
Jun 4, 2025kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary conCVE-2025-48710 · Other software · kro.run · reported by MITREMedium 4.1
kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes.
- Product
- kro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comorca.security
May 29, 2025MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability.CVE-2024-54952 · Network & remote access · Mikrotik · reported by MITREHigh 7.5
MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Remote, unauthenticated attackers can exploit this issue by sending specially crafted packets, triggering a null pointer dereference. This leads to a Remote Denial of Service (DoS), rendering the SMB service unavailable.
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2025A flaw was found in Stackrox, where it is vulnerable to Cross-site scripting (XSS) if the script code is included in a small subset of table cells.CVE-2025-5198 · Other software · Red Hat · reported by Red HatMedium 5
A flaw was found in Stackrox, where it is vulnerable to Cross-site scripting (XSS) if the script code is included in a small subset of table cells. The only known potential exploit is if the script is included in the name of a Kubernetes “Role” object* that is applied to a secured cluster. This object can be used by a user with access to the cluster or through a compromised third-party product.
- Product
- Red Hat Advanced Cluster Security 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Feb 24, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tekrom Technology T-Soft E-Commerce allows Cross-SiCVE-2025-0545 · Websites & servers · Tekrom Technology · reported by iletisim@usom.gov.trMedium 4.7
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tekrom Technology T-Soft E-Commerce allows Cross-Site Scripting (XSS). This issue affects T-Soft E-Commerce: before v5.
- Product
- T-Soft E-Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 12, 2025parse-duraton is software that allows users to convert a human readable duration to milliseconds.CVE-2025-25283 · Other software · jkroso · reported by GitHubHigh 7.5
parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to an event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively, and an out of memory that would crash a running Node.js application due to a string size of roughly 10 MB that utilizes unicode characters. Version 2.1.3 contains a patch.
- Product
- parse-duration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2.CVE-2024-54772 · Network & remote access · Mikrotik · reported by MITREMedium 5.4
An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18. A discrepancy in response size between connection attempts made with a valid username and those with an invalid username allows attackers to enumerate for valid accounts.
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket: Reflected Cross-Site ScriptingCVE-2024-12438 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'start_date’ and 'end_date' parameters in all versions up to, and including, 4.75 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket
- Affected
- up to 4.75
- What to do
- Affects up to 4.75. Update WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 27, 2024Improper Certificate Validation in Checkmk Exchange plugin MikroTik allows attackers in MitM position to intercept traffic.CVE-2024-38861 · Other software · Tomtretbar · reported by security@checkmk.comMedium 4.9
Improper Certificate Validation in Checkmk Exchange plugin MikroTik allows attackers in MitM position to intercept traffic. This issue affects MikroTik: from 2.0.0 through 2.5.5, from 0.4a_mk through 2.0a.
- Product
- Mikrotik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2024A flaw was found in Kroxylicious.CVE-2024-8285 · Other software · Red Hat · reported by Red HatMedium 5.9
A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perform a Man-in-the-Middle attack or compromise any external systems, such as DNS or network routing configuration. This issue is considered a high complexity attack, with additional high privileges required, as the attack would need access to the Kroxylicious configuration or a peer system. The result of a successful attack impacts both data integrity and confidentiality.
- Product
- Streams for Apache Kafka 2.8.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
May 2, 2024Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-32154 · Network & remote access · Mikrotik · reported by zdi-disclosures@trendmicro.comHigh 7.5
Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Router Advertisement Daemon. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-19797.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Mar 19, 2024Implementations of UDP application protocol are vulnerable to network loops.CVE-2024-2169 · Network & remote access · MikroTik · reported by cret@cert.orgHigh 7.5
Implementations of UDP application protocol are vulnerable to network loops. An unauthenticated attacker can use maliciously-crafted packets against a vulnerable implementation that can lead to Denial of Service (DOS) and/or abuse of resources.
- Product
- RouterOS-TFTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Nov 14, 2023MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API.CVE-2023-41570 · Network & remote access · Mikrotik · reported by MITREMedium 5.3
MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API.
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordenricobassetti.itenricobassetti.it
Sep 7, 2023The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue.CVE-2023-30800 · Network & remote access · MikroTik · reported by VulnCheckHigh 7.5
The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTTP request. As a result, the web interface crashes and is immediately restarted. The issue was fixed in RouterOS 6.49.10 stable. RouterOS version 7 is not affected.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulncheck.comvulncheck.com
Jul 19, 2023MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue.CVE-2023-30799 · Network & remote access · MikroTik · reported by VulnCheckCritical 9.1
MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface. The attacker can abuse this vulnerability to execute arbitrary code on the system.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 12, 2023An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon.CVE-2020-20021 · Network & remote access · Mikrotik · reported by MITREHigh 7.5
An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon.
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
May 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in TheOnlineHero - Tom Skroza Admin Block Country plugin <= 7.1.4 versions.CVE-2023-24007 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in TheOnlineHero - Tom Skroza Admin Block Country plugin <= 7.1.4 versions.
- Affected
- up to 7.1.4
- What to do
- Affects up to 7.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 27, 2023An issue in the bridge2 component of MikroTik RouterOS v6.40.5 allows attackers to cause a Denial of Service (DoS) via crafted packets.CVE-2023-24094 · Network & remote access · Mikrotik · reported by MITREHigh 7.5
An issue in the bridge2 component of MikroTik RouterOS v6.40.5 allows attackers to cause a Denial of Service (DoS) via crafted packets.
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2023Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Kron Tech Single Connect on Windows allows Privilege Abuse.CVE-2023-0882 · Other software · Kron Tech · reported by iletisim@usom.gov.trHigh 8.8
Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Kron Tech Single Connect on Windows allows Privilege Abuse. This issue affects Single Connect: 2.16.
- Product
- Single Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.krontech.comsiberguvenlik.gov.tr
Dec 5, 2022Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process.CVE-2022-45315 · Other software · MicroTik · reported by MITREMedium 6.4
Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process. This vulnerability allows authenticated attackers to execute arbitrary code via a crafted packet.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2022Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process.CVE-2022-45313 · Network & remote access · Mikrotik · reported by MITREHigh 8.8
Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. This vulnerability allows attackers to execute arbitrary code via a crafted nova message.
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red.CVE-2017-20149 · Network & remote access · Mikrotik · reported by MITRECritical 9.8
The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated user can trigger the vulnerability by sending a crafted HTTP request. An attacker can use this vulnerability to execute arbitrary code on the affected system, as exploited in the wild in mid-2017 and later.
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.combleepingcomputer.com
Aug 26, 2022Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch.CVE-2022-36522 · Network & remote access · Mikrotik · reported by MITREMedium 6.5
Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comseclists.org
Aug 24, 2022The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the hostCVE-2022-34960 · Network & remote access · Mikrotik · reported by MITRECritical 9.8
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the host device. This allows the attacker to mount any arbitrary file to any location on the host.
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1.CVE-2022-2595 · Other software · kromitgmbh · reported by security@huntr.devCritical 10
Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1.
- Product
- kromitgmbh/titra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1.CVE-2022-2098 · Other software · kromitgmbh · reported by security@huntr.devCritical 9.8
Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1.
- Product
- kromitgmbh/titra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Cross-site Scripting (XSS) - DOM in GitHub repository kromitgmbh/titra prior to 0.77.0.CVE-2022-2029 · Other software · kromitgmbh · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - DOM in GitHub repository kromitgmbh/titra prior to 0.77.0.
- Product
- kromitgmbh/titra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Cross-site Scripting (XSS) - Generic in GitHub repository kromitgmbh/titra prior to 0.77.0.CVE-2022-2028 · Other software · kromitgmbh · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository kromitgmbh/titra prior to 0.77.0.
- Product
- kromitgmbh/titra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0.CVE-2022-2027 · Other software · kromitgmbh · reported by security@huntr.devHigh 8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0.
- Product
- kromitgmbh/titra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/titra prior to 0.77.0.CVE-2022-2026 · Other software · kromitgmbh · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/titra prior to 0.77.0.
- Product
- kromitgmbh/titra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-client process.CVE-2021-36614 · Network & remote access · Mikrotik · reported by MITREMedium 6.5
Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-client process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
May 11, 2022Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp process.CVE-2021-36613 · Network & remote access · Mikrotik · reported by MITREMedium 6.5
Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Mar 16, 2022In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code execution.CVE-2021-41987 · Network & remote access · Mikrotik · reported by MITREHigh 8.1
In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code execution. The attacker must know the scep_server_name value. This affects RouterOS 6.46.8, 6.47.9, and 6.47.10.
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmikrotik.comteamt5.org
Feb 28, 2022A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted FTP requests.CVE-2020-22845 · Network & remote access · Mikrotik · reported by MITREHigh 7.5
A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted FTP requests.
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commikrotik.com
Feb 28, 2022A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted SMB requests.CVE-2020-22844 · Network & remote access · Mikrotik · reported by MITREHigh 7.5
A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted SMB requests.
- Product
- Routeros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commikrotik.com
Jan 27, 2022Single Connect does not perform an authorization check when using the "sc-assigned-credential-ui" module.CVE-2021-44795 · Other software · Kron · reported by iletisim@usom.gov.trMedium 5.3
Single Connect does not perform an authorization check when using the "sc-assigned-credential-ui" module. A remote attacker could exploit this vulnerability to modify users permissions. The exploitation of this vulnerability might allow a remote attacker to delete permissions from other users without authenticating.
- Product
- Single Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jan 27, 2022Single Connect does not perform an authorization check when using the "sc-diagnostic-ui" module.CVE-2021-44794 · Other software · Kron · reported by iletisim@usom.gov.trMedium 5.3
Single Connect does not perform an authorization check when using the "sc-diagnostic-ui" module. A remote attacker could exploit this vulnerability to access the device information page. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information.
- Product
- Single Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jan 27, 2022Single Connect does not perform an authorization check when using the sc-reports-ui" module.CVE-2021-44793 · Other software · Kron · reported by iletisim@usom.gov.trHigh 8.6
Single Connect does not perform an authorization check when using the sc-reports-ui" module. A remote attacker could exploit this vulnerability to access the device configuration page and export the data to an external file. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information including the database credentials. Since the database runs with high privileges it is possible to execute commands with the attained credentials.
- Product
- Single Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jan 27, 2022Single Connect does not perform an authorization check when using the "log-monitor" module.CVE-2021-44792 · Other software · Kron · reported by iletisim@usom.gov.trMedium 5.3
Single Connect does not perform an authorization check when using the "log-monitor" module. A remote attacker could exploit this vulnerability to access the logging interface. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information.
- Product
- Single Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Oct 5, 2021Omikron MultiCash Desktop 4.00.008.SP5 relies on a client-side authentication mechanism.CVE-2021-41286 · Other software · Omikron · reported by MITREHigh 7.8
Omikron MultiCash Desktop 4.00.008.SP5 relies on a client-side authentication mechanism. When a user logs into the application, the validity of the password is checked locally. All communication to the database backend is made via the same technical account. Consequently, an attacker can attach a debugger to the process or create a patch that manipulates the behavior of the login function. When the function always returns the success value (corresponding to a correct password), an attacker can login with any desired account, such as the administrative account of the application.
- Product
- Multicash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.