Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,591 results · page 205 of 392
Jun 16, 2017The "First Citizens Bank-Mobile Banking" by First Citizens Bank (AL) app 3.0.0 -- aka first-citizens-bank-mobile-banking/id566037101 for iOS does not verify X.5CVE-2017-9577 · Other software · Fcbl · reported by MITREMedium 5.9
The "First Citizens Bank-Mobile Banking" by First Citizens Bank (AL) app 3.0.0 -- aka first-citizens-bank-mobile-banking/id566037101 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- First Citizens Bank-mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "Middleton Community Bank Mobile Banking" by Middleton Community Bank app 3.0.0 -- aka middleton-community-bank-mobile-banking/id721843238 for iOS does not CVE-2017-9576 · Other software · Mononabank · reported by MITREMedium 5.9
The "Middleton Community Bank Mobile Banking" by Middleton Community Bank app 3.0.0 -- aka middleton-community-bank-mobile-banking/id721843238 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Middleton Community Bank Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "FVB Mobile Banking" by First Volunteer Bank of Tennessee app 3.1.1 -- aka fvb-mobile-banking/id551018004 for iOS does not verify X.509 certificates from SSCVE-2017-9575 · Other software · Meafinancial · reported by MITREMedium 5.9
The "FVB Mobile Banking" by First Volunteer Bank of Tennessee app 3.1.1 -- aka fvb-mobile-banking/id551018004 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- FVB Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "KC Area Credit Union Mobile Banking" by K C Area Credit Union app 3.0.1 -- aka kc-area-credit-union-mobile-banking/id1097607736 for iOS does not verify X.5CVE-2017-9574 · Other software · Meafinancial · reported by MITREMedium 5.9
The "KC Area Credit Union Mobile Banking" by K C Area Credit Union app 3.0.1 -- aka kc-area-credit-union-mobile-banking/id1097607736 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- KC Area Credit Union Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The North Adams State Bank (Ursa) nasb-mobile-banking/id980573797 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-theCVE-2017-9573 · Other software · Northadamsbank · reported by MITREMedium 5.9
The North Adams State Bank (Ursa) nasb-mobile-banking/id980573797 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Nasb Mobile Bank
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The athens-state-bank-mobile-banking/id719748589 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackersCVE-2017-9572 · Other software · Athensstatebank · reported by MITREMedium 5.9
The athens-state-bank-mobile-banking/id719748589 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Athens State Bank Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The Citizens Community Bank (TN) ccb-mobile-banking/id610030469 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-mCVE-2017-9571 · Other software · Ccbank · reported by MITREMedium 5.9
The Citizens Community Bank (TN) ccb-mobile-banking/id610030469 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- CCB Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The mount-vernon-bank-trust-mobile-banking/id542706679 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attCVE-2017-9570 · Other software · Meafinancial · reported by MITREMedium 5.9
The mount-vernon-bank-trust-mobile-banking/id542706679 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Mount Vernon Bank & Trust Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The Citizens Bank (TX) cbtx-on-the-go/id892396102 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackerCVE-2017-9569 · Other software · Citizensbanktx · reported by MITREMedium 5.9
The Citizens Bank (TX) cbtx-on-the-go/id892396102 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Cbtx ON The GO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The financial-plus-mobile-banking/id731070564 app 3.0.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers toCVE-2017-9568 · Other software · Myfpcu · reported by MITREMedium 5.9
The financial-plus-mobile-banking/id731070564 app 3.0.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Financial Plus Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The avb-bank-mobile-banking/id592565443 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoofCVE-2017-9567 · Other software · Meafinancial · reported by MITREMedium 5.9
The avb-bank-mobile-banking/id592565443 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- AVB Bank Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The fsb-dequeen-mobile-banking/id1091025340 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to sCVE-2017-9566 · Other software · Meafinancial · reported by MITREMedium 5.9
The fsb-dequeen-mobile-banking/id1091025340 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- FSB Dequeen Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The first-security-bank-sleepy-eye-mobile/id870531890 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attaCVE-2017-9565 · Other software · Meafinancial · reported by MITREMedium 5.9
The first-security-bank-sleepy-eye-mobile/id870531890 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- First Security Bank Sleepy EYE Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The community-banks-cb2go/id445828071 app 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof sCVE-2017-9564 · Other software · Meafinancial · reported by MITREMedium 5.9
The community-banks-cb2go/id445828071 app 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Community Banks Cb2go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The First Citizens Community Bank fccb/id809930960 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackeCVE-2017-9563 · Other software · Meafinancial · reported by MITREMedium 5.9
The First Citizens Community Bank fccb/id809930960 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Fccb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The Freedom First freedom-1st-credit-union-mobile-banking/id1085229458 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-iCVE-2017-9562 · Other software · Meafinancial · reported by MITREMedium 5.9
The Freedom First freedom-1st-credit-union-mobile-banking/id1085229458 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Freedom 1st Credit Union Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The Lee Bank & Trust lbtc-mobile/id1068984753 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers toCVE-2017-9561 · Other software · Lbtc · reported by MITREMedium 5.9
The Lee Bank & Trust lbtc-mobile/id1068984753 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- LEE Bank & Trust
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The cayuga-lake-national-bank/id1151601539 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spCVE-2017-9560 · Other software · Cayugalakenationalbank · reported by MITREMedium 5.9
The cayuga-lake-national-bank/id1151601539 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Cayuga Lake National Bank
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The MEA Financial vision-bank/id420406345 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoCVE-2017-9559 · Other software · Meafinancial · reported by MITREMedium 5.9
The MEA Financial vision-bank/id420406345 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Vision Bank
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The wawa-employees-credit-union-mobile/id1158082793 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackCVE-2017-9558 · Other software · Wawacu · reported by MITREMedium 5.9
The wawa-employees-credit-union-mobile/id1158082793 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Wawa Employees Credit Union Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2017A spoofing vulnerability exists in when Microsoft Outlook for Mac does not sanitize html properly, aka "Microsoft Outlook for Mac Spoofing Vulnerability".CVE-2017-8545 · Email & office · Microsoft Corporation · reported by secure@microsoft.comMedium 6.5
A spoofing vulnerability exists in when Microsoft Outlook for Mac does not sanitize html properly, aka "Microsoft Outlook for Mac Spoofing Vulnerability".
- Product
- Microsoft Outlook for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jun 14, 2017Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to trCVE-2016-8746 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.9
Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true.
- Product
- Apache Ranger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comcwiki.apache.org
Jun 12, 2017nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, CVE-2014-9984 · Other software · GNU · reported by MITRECritical 9.8
nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.
- Product
- Glibc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jun 9, 2017The Cybozu kintone mobile for Android 1.0.6 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof sCVE-2016-7816 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 5.9
The Cybozu kintone mobile for Android 1.0.6 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- kintone mobile for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comjvn.jp
Jun 8, 2017IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accCVE-2016-6093 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
- Product
- Security Key Lifecycle Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Jun 8, 2017Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack vCVE-2016-5648 · Other software · Acer · reported by cret@cert.orgMedium 5.3
Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack via a crafted SSL certificate.
- Product
- Acer Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 8, 2017The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers to cause a denial ofCVE-2017-9022 · Other software · Strongswan · reported by MITREHigh 7.5
The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers to cause a denial of service (floating point exception and process crash) via a crafted certificate.
- Product
- Strongswan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Jun 7, 2017markdown-it before 4.1.0 does not block data: URLs.CVE-2015-3295 · Other software · Markdown-it Project · reported by MITREMedium 5.3
markdown-it before 4.1.0 does not block data: URLs.
- Product
- Markdown-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Jun 7, 2017IBM BigFix Compliance (TEMA SUAv1 SCA SCM) 1.9.70 does not require that users should have strong passwords by default, which makes it easier for attackers to coCVE-2017-1196 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM BigFix Compliance (TEMA SUAv1 SCA SCM) 1.9.70 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 123671.
- Product
- Endpoint Manager for Security and Compliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Jun 7, 2017OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive information.CVE-2015-7514 · Other software · Openstack · reported by Red HatMedium 6.5
OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive information.
- Product
- Ironic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.redhat.com
Jun 6, 2017PostgreSQL PL/Java after 9.0 does not honor access controls on large objects.CVE-2016-0768 · Other software · Postgresql · reported by Red HatHigh 7.5
PostgreSQL PL/Java after 9.0 does not honor access controls on large objects.
- Product
- Postgresql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtada.github.iotada.github.io
Jun 6, 2017The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other impoCVE-2017-5243 · Other software · Rapid7 · reported by cve@rapid7.comHigh 8.5
The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and makes the installations vulnerable to a range of MITM, downgrade, and decryption attacks.
- Product
- Nexpose hardware appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.rapid7.comcommunity.rapid7.com
Jun 2, 2017BigTree CMS through 4.2.18 does not prevent a user from deleting their own account.CVE-2017-9378 · Other software · Bigtreecms · reported by MITREMedium 6.5
BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks (such as data backups) to complete before a user is deleted.
- Product
- Bigtree CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2017Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishingCVE-2017-9303 · Other software · Laravel · reported by MITREMedium 6.1
Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.
- Product
- Laravel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comlaravel-news.com
May 28, 2017The lexer_process_char_literal function in jerry-core/parser/js/js-lexer.c in JerryScript 1.0 does not skip memory allocation for empty strings, which allows reCVE-2017-9250 · Other software · Jerryscript · reported by MITREHigh 7.5
The lexer_process_char_literal function in jerry-core/parser/js/js-lexer.c in JerryScript 1.0 does not skip memory allocation for empty strings, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed JavaScript source code, related to the jmem_heap_free_block function.
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comgithub.com
May 25, 2017The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length.CVE-2014-0097 · Other software · Pivotal · reported by security_alert@emc.comHigh 7.3
The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.
- Product
- Spring Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2017The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology related to 80-byte block headers with a variety of initial 64-byte chunks folCVE-2017-9230 · Other software · bitcoin · reported by MITREHigh 7.5
The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology related to 80-byte block headers with a variety of initial 64-byte chunks followed by the same 16-byte chunk, multiple candidate root values ending with the same 4 bytes, and calculations involving sqrt numbers. This violates the security assumptions of (1) the choice of input, outside of the dedicated nonce area, fed into the Proof-of-Work function should not change its difficulty to evaluate and (2) every Proof-of-Work function execution should be independent. NOTE: a number of persons feel that this methodology is a benign mining optimization, not a vulnerability
- Product
- bitcoin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmit.edusecurityfocus.com
May 22, 2017The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allow_ptr_leaks value available for restricting the output ofCVE-2017-9150 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allow_ptr_leaks value available for restricting the output of the print_bpf_insn function, which allows local users to obtain sensitive address information via crafted bpf system calls.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orgkernel.org
May 22, 2017The TNEFFillMapi function in lib/ytnef.c in libytnef in ytnef through 1.9.2 does not ensure a nonzero count value before a certain memory allocation, which alloCVE-2017-9146 · Other software · Ytnef Project · reported by MITREHigh 8.8
The TNEFFillMapi function in lib/ytnef.c in libytnef in ytnef through 1.9.2 does not ensure a nonzero count value before a certain memory allocation, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted tnef file.
- Product
- Ytnef
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggithub.com
May 19, 2017/admin/loginc.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code']) == 1, which leads to CAPTCHA bypass by emptying $_POST['captcha'].CVE-2017-9091 · Other software · Allen Disk Project · reported by MITREHigh 7.5
/admin/loginc.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code']) == 1, which leads to CAPTCHA bypass by emptying $_POST['captcha'].
- Product
- Allen Disk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2017reg.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code'])==1, which makes it possible to bypass the CAPTCHA via an empty $_POST['captcha'].CVE-2017-9090 · Other software · Allen Disk Project · reported by MITREHigh 7.5
reg.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code'])==1, which makes it possible to bypass the CAPTCHA via an empty $_POST['captcha'].
- Product
- Allen Disk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2017The IPv6 fragmentation implementation in the Linux kernel through 4.11.1 does not consider that the nexthdr field may be associated with an invalid option, whicCVE-2017-9074 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
The IPv6 fragmentation implementation in the Linux kernel through 4.11.1 does not consider that the nexthdr field may be associated with an invalid option, which allows local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orgdebian.org
May 18, 2017In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not propCVE-2017-9061 · WordPress plugins & themes · reported by MITREMedium 6.1
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.
- Fixed in
- 4.7.5
- What to do
- Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
May 16, 2017The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstratCVE-2016-10372 · Other software · EIR · reported by MITRECritical 9.8
The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstrated by opening WAN access to TCP port 80, retrieving the login password (which defaults to the Wi-Fi password), and using the NewNTPServer feature.
- Product
- D1000 Modem Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevicereversing.wordpress.comghostbin.com
May 15, 2017The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain seCVE-2017-8943 · Other software · Puma · reported by MITREMedium 5.9
The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Pumatrac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2017The YottaMark ShopWell - Healthy Diet & Grocery Food Scanner app 5.3.7 through 5.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows mCVE-2017-8942 · Other software · Yottamark Inc. · reported by MITREMedium 5.9
The YottaMark ShopWell - Healthy Diet & Grocery Food Scanner app 5.3.7 through 5.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Shopwell - Healthy Diet & Grocery Food Scanner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2017The Interval International app 3.3 through 3.5.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof CVE-2017-8941 · Other software · Interval International · reported by MITREMedium 5.9
The Interval International app 3.3 through 3.5.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Interval International
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2017The Zipongo - Healthy Recipes and Grocery Deals app before 6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacCVE-2017-8940 · Other software · Zipongo Inc. · reported by MITREMedium 5.9
The Zipongo - Healthy Recipes and Grocery Deals app before 6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Healthy Recipes And Grocery Deals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2017The Radio Javan app 9.3.4 through 9.6.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers aCVE-2017-8938 · Other software · Radiojavan · reported by MITREMedium 5.9
The Radio Javan app 9.3.4 through 9.6.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Radio Javan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2017The Life Before Us Yo app 2.5.8 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtaiCVE-2017-8937 · Other software · Life Before US · reported by MITREMedium 5.9
The Life Before Us Yo app 2.5.8 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Yo.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.