Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

1,570 results · page 20 of 32

Jan 20, 2020The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/.CVE-2020-7241 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date strings with a 2020_{0..1}{0..2}_{0..3}{0..9} format, guessing UNIX timestamps, and making HTTPS requests with the complete guessed URL.
Product
WP Database Backup
Affected
up to 5.5
What to do
Affects up to 5.5. Update WP Database Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 9, 2020A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton IntCVE-2016-5311 · Other software · Symantec · reported by secure@symantec.comHigh 7.8
A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton Internet Security, Norton 360, Endpoint Protection Small Business Edition Cloud, and Endpoint Protection Cloud Client due to a DLL-preloading without path restrictions, which could let a local malicious user obtain system privileges.
Product
Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton Internet Security, Norton 360
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jan 6, 2020An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PUT /obs/obm7/file/upload" request with the base64-eCVE-2020-5846 · Other software · Ahsay · reported by MITREHigh 8.8
An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PUT /obs/obm7/file/upload" request with the base64-encoded pathname in the X-RSW-custom-encode-path HTTP header, and the content in the HTTP request body. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full system access as the configured user (e.g., Administrator) when starting from any authenticated session (e.g., a trial account). This is fixed in the 83/830122/cbs-*-hotfix-task26000 builds.
Product
Cloud Backup Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wbsec.nl wbsec.nl
Dec 27, 2019In K7 Ultimate Security 16.0.0117, the module K7BKCExt.dll (aka the backup module) improperly validates the administrative privileges of the user, allowing an aCVE-2019-16896 · Other software · K7computing · reported by MITREHigh 7.8
In K7 Ultimate Security 16.0.0117, the module K7BKCExt.dll (aka the backup module) improperly validates the administrative privileges of the user, allowing an arbitrary file write via a symbolic link attack with file restoration functionality.
Product
K7 Ultimate Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com support.k7computing.com
Dec 19, 2019A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable.CVE-2019-19341 · Other software · RedHat · reported by Red HatMedium 5.5
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable. These files include both the SECRET_KEY and the database backup. Any user with access to the Tower server, and knowledge of when a backup is run, could retrieve every credential stored in Tower. Access to data is the highest threat with this vulnerability.
Product
Tower
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com bugzilla.redhat.com
Nov 29, 2019HiSuite with 9.1.0.305 and earlier versions and 9.1.0.305(MAC) and earlier versions and HwBackup with earlier versions before 9.1.1.308 have a brute forcing encCVE-2019-5263 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
HiSuite with 9.1.0.305 and earlier versions and 9.1.0.305(MAC) and earlier versions and HwBackup with earlier versions before 9.1.1.308 have a brute forcing encrypted backup data vulnerability. Huawei smartphone user backup information can be obtained by brute forcing the password for encrypting the backup.
Product
Hisuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huawei.com huawei.com
Nov 25, 2019IBM Spectrum Protect Backup-Archive Client 7.1 and 8.1 may be vulnerable to a denial of service attack due to a timing issue between client and server TCP/IP coCVE-2019-4406 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.4
IBM Spectrum Protect Backup-Archive Client 7.1 and 8.1 may be vulnerable to a denial of service attack due to a timing issue between client and server TCP/IP communications. IBM X-Force ID: 162477.
Product
Spectrum Protect Backup-Archive Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Nov 25, 2019IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments 7.1 and 8.1 creates directories/files in the CIT sub directory thatCVE-2018-2025 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.4
IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments 7.1 and 8.1 creates directories/files in the CIT sub directory that are read/writable by everyone. IBM X-Force ID: 155551.
Product
Spectrum Protect Backup-Archive Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Nov 14, 2019Moodle before 2.2.2 has users' private files included in course backupsCVE-2012-1156 · Other software · Moodle · reported by Red HatHigh 7.5
Moodle before 2.2.2 has users' private files included in course backups
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Nov 7, 2019ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.CVE-2013-1425 · Other software · ldap-git-backup · reported by security@debian.orgMedium 5.5
ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.
Product
ldap-git-backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com security-tracker.debian.org
Oct 28, 2019Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCeCVE-2019-5538 · Other software · VMware · reported by security@vmware.comMedium 5.9
Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server Appliance (6.7 before 6.7u3a and 6.5 before 6.5u3d) may allow a malicious actor to intercept sensitive data in transit over SCP. A malicious actor with man-in-the-middle positioning between vCenter Server Appliance and a backup target may be able to intercept sensitive data in transit during File-Based Backup and Restore operations.
Product
Vcenter Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vmware.com vmware.com
Oct 28, 2019Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCeCVE-2019-5537 · Other software · VMware · reported by security@vmware.comMedium 5.9
Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server Appliance (6.7 before 6.7u3a and 6.5 before 6.5u3d) may allow a malicious actor to intercept sensitive data in transit over FTPS and HTTPS. A malicious actor with man-in-the-middle positioning between vCenter Server Appliance and a backup target may be able to intercept sensitive data in transit during File-Based Backup and Restore operations.
Product
Vcenter Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vmware.com vmware.com
Oct 8, 2019In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files.CVE-2018-21025 · Other software · Centreon · reported by MITRECritical 9.8
In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files.
Product
Centreon VM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Aug 28, 2019CloudBerry Backup v6.1.2.34 allows local privilege escalation via a Pre or Post backup action.CVE-2019-15720 · Other software · Cloudberrylab · reported by MITREHigh 7.8
CloudBerry Backup v6.1.2.34 allows local privilege escalation via a Pre or Post backup action. With only user-level access, a user can modify the backup plan and add a Pre backup action script that executes on behalf of NT AUTHORITY\SYSTEM.
Product
Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sevenlayers.com sevenlayers.com
Aug 21, 2019Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote aCVE-2019-11602 · Other software · Bosch · reported by MITREMedium 5.3
Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to gather information about the file system structure.
Product
IOT Gateway Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.bosch.com psirt.bosch.com
Aug 21, 2019A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allCVE-2019-11601 · Other software · Bosch · reported by MITREHigh 7.5
A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location.
Product
IOT Gateway Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.bosch.com psirt.bosch.com
Aug 21, 2019A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway SoCVE-2019-11897 · Other software · Bosch · reported by psirt@bosch.comHigh 8.6
A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this could potentially allow an attacker to read sensitive zip files from the local server.
Product
IoT Gateway Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.bosch.com psirt.bosch.com
Aug 13, 2019The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.CVE-2017-18488 · WordPress plugins & themes · reported by MITREMedium 6.1
The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.
Product
Backup Guard
Fixed in
1.1.47
What to do
Update Backup Guard to 1.1.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The wp-database-backup plugin before 5.1.2 for WordPress has XSS.CVE-2019-14949 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-database-backup plugin before 5.1.2 for WordPress has XSS.
Product
wp-database-backup
Fixed in
5.1.2
What to do
Update wp-database-backup to 5.1.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.CVE-2016-10876 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.
Product
wp-database-backup
Fixed in
4.3.1
What to do
Update wp-database-backup to 4.3.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The wp-database-backup plugin before 4.3.1 for WordPress has XSS.CVE-2016-10875 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-database-backup plugin before 4.3.1 for WordPress has XSS.
Product
wp-database-backup
Fixed in
4.3.1
What to do
Update wp-database-backup to 4.3.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.CVE-2016-10874 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.
Product
wp-database-backup
Fixed in
4.3.3
What to do
Update wp-database-backup to 4.3.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The wp-database-backup plugin before 4.3.3 for WordPress has XSS.CVE-2016-10873 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-database-backup plugin before 4.3.3 for WordPress has XSS.
Product
wp-database-backup
Fixed in
4.3.3
What to do
Update wp-database-backup to 4.3.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 2, 2019In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).CVE-2017-18413 · Websites & servers · Cpanel · reported by MITREHigh 7.8
In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284).CVE-2017-18410 · Websites & servers · Cpanel · reported by MITREMedium 6.5
In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283).CVE-2017-18409 · Websites & servers · Cpanel · reported by MITREMedium 6.5
In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345).CVE-2017-18405 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).CVE-2017-18397 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323).CVE-2017-18391 · Websites & servers · Cpanel · reported by MITRELow 2.5
cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net forums.cpanel.net
Aug 2, 2019cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322).CVE-2017-18390 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).CVE-2017-18383 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration (SEC-383).CVE-2018-20948 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration (SEC-383).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342).CVE-2018-20940 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 68.0.27 allows a user to discover contents of directories (that are not owned by that user) by leveraging backups (SEC-339).CVE-2018-20939 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 68.0.27 allows a user to discover contents of directories (that are not owned by that user) by leveraging backups (SEC-339).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338).CVE-2018-20909 · Websites & servers · Cpanel · reported by MITREHigh 7.1
cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429).CVE-2018-20905 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421).CVE-2018-20903 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).CVE-2018-20887 · Websites & servers · Cpanel · reported by MITRECritical 9.8
cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).CVE-2018-20865 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 26, 2019An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50.CVE-2019-10267 · Other software · Ahsay · reported by MITREHigh 8.8
An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full access to the system, as the configured user (e.g., Administrator).
Product
Cloud Backup Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 26, 2019An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50.CVE-2019-10266 · Other software · Ahsay · reported by MITREHigh 7.5
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file structure and even the content of files without authentication.
Product
Cloud Backup Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com wbsec.nl
Jul 26, 2019An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50.CVE-2019-10265 · Other software · Ahsay · reported by MITREHigh 7.5
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. On the /cbs/system/ShowAdvanced.do "File Explorer" screen, it is possible to change the directory in the JavaScript code. If changed to (for example) "C:" then one can browse the whole server.
Product
Cloud Backup Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wbsec.nl wbsec.nl
Jul 26, 2019An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50.CVE-2019-10264 · Other software · Ahsay · reported by MITREHigh 7.2
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. With a valid administrator account, the "Move / Import / Export Users" screen has an Import Users option. This option accepts a ZIP archive containing a users.xml file that can trigger XXE.
Product
Cloud Backup Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wbsec.nl wbsec.nl
Jul 26, 2019An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50.CVE-2019-10263 · Other software · Ahsay · reported by MITREMedium 6.1
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When creating a trial account, it is possible to inject XSS in the Alias field, allowing the attacker to retrieve the admin's cookie and take over the account.
Product
Cloud Backup Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wbsec.nl wbsec.nl
Jul 22, 2019The IBM Spectrum Protect 7.1 and 8.1 Backup-Archive Client is vulnerable to a buffer overflow.CVE-2019-4267 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
The IBM Spectrum Protect 7.1 and 8.1 Backup-Archive Client is vulnerable to a buffer overflow. This could allow execution of arbitrary code on the local system or the application to crash. IBM X-Force ID: 160200.
Product
Spectrum Protect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com exchange.xforce.ibmcloud.com
Jul 22, 2019A IBM Spectrum Protect 7.l client backup or archive operation running for an HP-UX VxFS object is silently skipping Access Control List (ACL) entries from backuCVE-2019-4236 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.4
A IBM Spectrum Protect 7.l client backup or archive operation running for an HP-UX VxFS object is silently skipping Access Control List (ACL) entries from backup or archive if there are more than twelve ACL entries associated with the object in total. As a result, it could allow a local attacker to restore or retrieve the object with incorrect ACL entries. IBM X-Force ID: 159418.
Product
Spectrum Protect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Jun 18, 2019In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin/CClientThread.cpp CClientThread::ProcesCVE-2018-20013 · Other software · Urbackup · reported by MITREHigh 7.5
In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin/CClientThread.cpp CClientThread::ProcessPacket metadata_id!=0 assertion, leading to shutting down the client application.
Product
Urbackup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record urbackup.org github.com
Jun 17, 2019app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation, which allows authCVE-2019-11410 · Other software · Fusionpbx · reported by MITREHigh 7.2
app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to execute commands on the host.
Product
Fusionpbx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.gdssecurity.com github.com
Jun 7, 2019In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin/CClientThread.cpp CClientThread::GetFilCVE-2018-20014 · Other software · Urbackup · reported by MITREHigh 7.5
In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin/CClientThread.cpp CClientThread::GetFileHashAndMetadata NULL pointer dereference, leading to shutting down the client application.
Product
Urbackup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record urbackup.org github.com
Jun 3, 2019ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerability, which allows remote attackers to view CVE-2019-12310 · Other software · Exagrid · reported by MITRECritical 9.8
ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerability, which allows remote attackers to view and retrieve verbose logging information. Files within this directory were observed to contain sensitive run-time information, including Base64 encoded 'support' credentials, leading to administrative access of the device.
Product
Backup Appliance Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exagrid.com inquisitllc.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.