Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,387 results · page 21 of 28
Dec 6, 2018DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.CVE-2018-19913 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.
- Product
- Domainmod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Nov 29, 2018DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.CVE-2018-19752 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.
- Product
- Domainmod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Nov 29, 2018DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.CVE-2018-19751 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.
- Product
- Domainmod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Nov 29, 2018DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields.CVE-2018-19750 · Other software · Domainmod · reported by MITREMedium 5.4
DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields.
- Product
- Domainmod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Nov 28, 2018ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified page_id.CVE-2018-19620 · Other software · Showdoc · reported by MITREMedium 4.3
ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified page_id.
- Product
- Showdoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2018ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified page_id, as demonstrated by reading note content, or discoveCVE-2018-19609 · Other software · Showdoc · reported by MITREMedium 6.5
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified page_id, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL.
- Product
- Showdoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2018Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.CVE-2018-19352 · Other software · Jupyter · reported by MITREMedium 6.1
Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.
- Product
- Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2018Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server.CVE-2018-19351 · Other software · Jupyter · reported by MITREMedium 6.1
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.
- Product
- Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2018The server in mubu note 2018-11-11 has XSS by configuring an account with a crafted name value (along with an arbitrary username value), and then creating and sCVE-2018-19286 · Other software · Mubu · reported by MITREMedium 6.1
The server in mubu note 2018-11-11 has XSS by configuring an account with a crafted name value (along with an arbitrary username value), and then creating and sharing a note.
- Product
- Curtain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2018Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page.CVE-2018-18553 · Other software · Leanote · reported by MITREMedium 6.1
Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page.
- Product
- Leanote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2018A BIOS password extraction vulnerability has been reported on certain consumer notebooks with firmware F.22 and others.CVE-2017-2751 · Other software · HP Inc. · reported by hp-security-alert@hp.comMedium 4.6
A BIOS password extraction vulnerability has been reported on certain consumer notebooks with firmware F.22 and others. The BIOS password was stored in CMOS in a way that allowed it to be extracted. This applies to consumer notebooks launched in early 2014.
- Product
- HP 240 G1 Notebook PC and certain other consumer notebooks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Oct 2, 2018In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially alCVE-2018-9069 · Other software · Lenovo Group LTD · reported by psirt@lenovo.comMedium 5.9
In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS.
- Product
- IdeaPad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Sep 24, 2018This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Notes Fixed in version 2.0.02.31.CVE-2018-10501 · Computers, phones & browsers · Samsung · reported by zdi-disclosures@trendmicro.comHigh 7
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Notes Fixed in version 2.0.02.31. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of ZIP files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the application. Was ZDI-CAN-5358.
- Product
- Samsung Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Aug 30, 2018The EPSON iPrint application 6.6.3 for Android contains hard-coded API and Secret keys for the Dropbox, Box, Evernote and OneDrive services.CVE-2018-14901 · Other software · Epson · reported by MITREHigh 7.5
The EPSON iPrint application 6.6.3 for Android contains hard-coded API and Secret keys for the Dropbox, Box, Evernote and OneDrive services.
- Product
- Iprint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvdalabs.comvdalabs.com
Aug 24, 2018An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB.CVE-2018-11502 · Other software · Moderator LOG Notes Project · reported by MITREMedium 6.5
An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. An attacker can remotely delete all mod notes and mod note logs in the modCP and ACP via CSRF.
- Product
- Moderator LOG Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Aug 2, 2018exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers CVE-2018-14851 · Websites & servers · PHP · reported by MITREMedium 5.5
exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2018The Notes Client Single Logon feature in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3, and 9.0 on Windows allows local users to discover passwords via CVE-2013-0522 · Other software · IBM · reported by psirt@us.ibm.comHigh 7
The Notes Client Single Logon feature in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3, and 9.0 on Windows allows local users to discover passwords via vectors involving an unspecified operating system communication mechanism for password transmission between Windows and Notes. IBM X-Force ID: 82531.
- Product
- Lotus Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comwww-01.ibm.com
Jul 11, 2018Open redirect vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to redirect users to arbitrary web sites and condCVE-2013-0594 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
Open redirect vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. IBM X-Force ID: 83383.
- Product
- Inotes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comwww-01.ibm.com
Jul 11, 2018Cross-site scripting (XSS) vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to inject arbitrary web script or HTCVE-2013-0592 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
Cross-site scripting (XSS) vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 83815.
- Product
- Inotes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comwww-01.ibm.com
Jul 11, 2018IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to bypass the remote image filtering mechanism and obtain sensitive information CVE-2013-0589 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to bypass the remote image filtering mechanism and obtain sensitive information via a crafted e-mail message. IBM X-Force ID: 83371.
- Product
- Inotes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comwww-01.ibm.com
Jul 8, 2018Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element.CVE-2018-13433 · Other software · Boostnote · reported by MITREMedium 6.1
Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element.
- Product
- Boostnote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2018The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crashCVE-2018-10360 · Other software · File Project · reported by MITREMedium 6.5
The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.
- Product
- File
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
May 28, 2018An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB.CVE-2018-11430 · Other software · Moderator LOG Notes Project · reported by MITREMedium 5.4
An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. The XSS is located in the mod notes textarea.
- Product
- Moderator LOG Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
May 26, 2018The isfootnote function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) viaCVE-2018-11503 · Other software · Discount Project · reported by MITREMedium 5.5
The isfootnote function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file, as demonstrated by mkd2html.
- Product
- Discount
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
May 21, 2018jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382).CVE-2017-2607 · Other software · [UNKNOWN] · reported by Red HatMedium 4.2
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins users, or users with SCM access, could configure jobs or modify build scripts such that they print serialized console notes that perform cross-site scripting attacks on Jenkins users viewing the build logs.
- Product
- jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.combugzilla.redhat.com
May 21, 2018An issue was discovered in the Admin Notes plugin 1.1 for MyBB.CVE-2018-11092 · Other software · Admin Notes Project · reported by MITREMedium 6.5
An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table (aka Clear Table) action.
- Product
- Admin Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.mybb.comgithub.com
May 9, 2018Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Note in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitraCVE-2018-8912 · Network & remote access · Synology · reported by security@synology.comMedium 6.5
Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Note in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitrary web script or HTML via the commit_msg parameter.
- Product
- Note Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
May 9, 2018Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitrary CVE-2018-8911 · Network & remote access · Synology · reported by security@synology.comMedium 6.5
Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments.
- Product
- Note Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Apr 18, 2018Vulnerability in the PeopleSoft Enterprise HCM Shared Components component of Oracle PeopleSoft Products (subcomponent: Notepad).CVE-2018-2878 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the PeopleSoft Enterprise HCM Shared Components component of Oracle PeopleSoft Products (subcomponent: Notepad). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Shared Components. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise HCM Shared Components, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Shared Components accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise HCM Shared Components accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- PeopleSoft Enterprise HCM Shared Components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Mar 29, 2018The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a SerializableCVE-2015-2004 · Other software · Gracenote · reported by psirt@us.ibm.comCritical 9.8
The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
- Product
- Gnsdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalephsecurity.comusenix.org
Mar 21, 2018Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cross site scripting.CVE-2017-0923 · Websites & servers · GitLab · reported by support@hackerone.comMedium 6.1
Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cross site scripting.
- Product
- GitLab Community and Enterprise Editions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comhackerone.com
Mar 18, 2018In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context.CVE-2018-8768 · Other software · Jupyter · reported by MITREHigh 7.8
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
- Product
- Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.debian.org
Mar 14, 2018In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the User Notes list view.CVE-2018-8045 · Websites & servers · Joomla · reported by MITREHigh 8.8
In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the User Notes list view.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Mar 14, 2018In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), useCVE-2018-2402 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.6
In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), user credentials may be stored in clear text in the indexserver trace files of the control system. An attacker with the required authorizations on the control system may be able to access the user credentials and gain unauthorized access to data in the captured or target system.
- Product
- SAP HANA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comblogs.sap.com
Mar 13, 2018IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path.CVE-2018-1437 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path. A local attacker could exploit this vulnerability to DLL hijacking to execute arbitrary code on the system or cause the application to crash. IBM X-Force ID: 139565.
- Product
- Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Mar 13, 2018IBM Notes 8.5 and 9.0 is vulnerable to a DLL hijacking attack.CVE-2018-1435 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM Notes 8.5 and 9.0 is vulnerable to a DLL hijacking attack. A remote attacker could trick a user to double click a malicious executable in an attacker-controlled directory, which could result in code execution. IBM X-Force ID: 139563.
- Product
- Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Mar 13, 2018CryptoNote version version 0.8.9 and possibly later contain a local RPC server which does not require authentication, as a result the walletd and the simplewallCVE-2018-1000093 · Other software · Cryptonote · reported by MITREHigh 8.8
CryptoNote version version 0.8.9 and possibly later contain a local RPC server which does not require authentication, as a result the walletd and the simplewallet RPC daemons will process any commands sent to them, resulting in remote command execution and a takeover of the cryptocurrency wallet if an attacker can trick an application such as a web browser into connecting and sending a command for example. This attack appears to be exploitable via a victim visiting a webpage hosting malicious content that trigger such behavior.
- Product
- Cryptonote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2018Cross-site scripting (XSS) vulnerability in Jease 2.11 allows remote authenticated users to inject arbitrary web script or HTML via a content section note.CVE-2014-8780 · Other software · Jease · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in Jease 2.11 allows remote authenticated users to inject arbitrary web script or HTML via a content section note.
- Product
- Jease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comvulnerability-lab.com
Feb 19, 2018IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system.CVE-2018-1411 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138710.
- Product
- Client Application Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2018IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system.CVE-2018-1410 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138709.
- Product
- Client Application Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2018IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system.CVE-2018-1409 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138708.
- Product
- Client Application Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2018IBM Notes 8.5 and 9.0 could allow a local attacker to execute arbitrary commands by carefully crafting a command line sent via the shared memory IPC.CVE-2017-1720 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Notes 8.5 and 9.0 could allow a local attacker to execute arbitrary commands by carefully crafting a command line sent via the shared memory IPC. IBM X-Force ID: 134807.
- Product
- Client Application Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2018IBM Notes and Domino NSD 8.5 and 9.0 could allow an authenticated local user without administrative privileges to gain System privilege.CVE-2017-1714 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM Notes and Domino NSD 8.5 and 9.0 could allow an authenticated local user without administrative privileges to gain System privilege. IBM X-Force ID: 134633.
- Product
- Client Application Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2018IBM iNotes 8.5 and 9.0 SUService can be misguided into running malicious code from a DLL masquerading as a windows DLL in the temp directory.CVE-2017-1711 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM iNotes 8.5 and 9.0 SUService can be misguided into running malicious code from a DLL masquerading as a windows DLL in the temp directory. IBM X-Force ID: 134532.
- Product
- Client Application Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2018The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to CVE-2018-6872 · Other software · GNU · reported by MITREMedium 5.5
The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (out-of-bounds read and segmentation violation) via a note with a large alignment.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jan 2, 2018Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integrationCVE-2017-1000492 · Other software · Leanote · reported by MITREMedium 6.1
Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration
- Product
- Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2018Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notesCVE-2017-1000459 · Other software · Leanote · reported by MITREMedium 6.1
Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes
- Product
- Leanote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2017IBM iNotes is vulnerable to cross-site scripting.CVE-2017-1421 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- iNotes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Dec 12, 2017SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of tyCVE-2017-16691 · Network & remote access · SAP · reported by cna@sap.comMedium 6.5
SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of type 'SAR'. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible to append a tampered file to the SAR archive using SAPCAR tool and during the extraction, digital signature verification fails but the tampered file is extracted.
- Product
- SAP Note Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comblogs.sap.com
Dec 3, 2017Cross-Site Scripting (XSS) exists in SAP Business Objects Financial Consolidation before 2017-06-13, aka SAP Security Note 2422292.CVE-2017-14516 · Network & remote access · SAP · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) exists in SAP Business Objects Financial Consolidation before 2017-06-13, aka SAP Security Note 2422292.
- Product
- Businessobjects Financial Consolidation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.sap.comblogs.sap.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.