Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

1,914 results · page 22 of 39

Dec 18, 2019Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially allCVE-2019-18996 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7.1
Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially allowing an attacker with access to the local file system the execution of code in the application’s context.
Product
PB610 Panel Builder 600
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record search.abb.com search.abb.com
Dec 18, 2019The HMISimulator component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier fails to validate the content-length field for HTTP requests, exposing CVE-2019-18995 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 4.3
The HMISimulator component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier fails to validate the content-length field for HTTP requests, exposing HMISimulator to denial of service via crafted HTTP requests manipulating the content-length setting.
Product
PB610 Panel Builder 600
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record search.abb.com search.abb.com
Dec 18, 2019Due to a lack of file length check, the HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier crashes when trying to load an empty *CVE-2019-18994 · Other software · ABB · reported by cybersecurity@ch.abb.comLow 3.9
Due to a lack of file length check, the HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier crashes when trying to load an empty *.JPR application file. An attacker with access to the file system might be able to cause application malfunction such as denial of service.
Product
ABB PB610 Panel Builder 600
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record search.abb.com search.abb.com
Dec 17, 2019CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx, aCVE-2019-15235 · Other software · Control-webpanel · reported by MITREMedium 6.5
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to gain access to the victim's password (for the OS and phpMyAdmin) via an attacker account. This is different from CVE-2019-14782.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record centos-webpanel.com packetstormsecurity.com
Dec 17, 2019CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /tmp directory, and tCVE-2019-14782 · Other software · Control-webpanel · reported by MITREMedium 6.5
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /tmp directory, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to make a request to extract the victim's password (for the OS and phpMyAdmin) via an attacker account.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record centos-webpanel.com packetstormsecurity.com
Dec 5, 2019The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because itCVE-2019-19609 · Other software · Strapi · reported by MITREHigh 7.2
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.
Product
Strapi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Nov 13, 2019Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter.CVE-2019-18793 · Other software · Parallels · reported by MITREMedium 6.1
Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter.
Product
Parallels Plesk Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Nov 8, 2019NVIDIA Windows GPU Display Driver, R390 driver version, contains a vulnerability in NVIDIA Control Panel in which it incorrectly loads Windows system DLLs withoCVE-2019-5694 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.5
NVIDIA Windows GPU Display Driver, R390 driver version, contains a vulnerability in NVIDIA Control Panel in which it incorrectly loads Windows system DLLs without validating the path or signature (also known as a binary planting or DLL preloading attack), which may lead to denial of service or information disclosure through code execution. The attacker requires local system access.
Product
NVIDIA GPU Display Driver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvidia.custhelp.com safebreach.com
Oct 31, 2019Stored XSS in filemanager2.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.885 exists via the cmd_arg parameter.CVE-2019-16295 · Other software · Control-webpanel · reported by MITREMedium 4.6
Stored XSS in filemanager2.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.885 exists via the cmd_arg parameter. This can be exploited by a local attacker who supplies a crafted filename within a directory visited by the victim.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com centos-webpanel.com
Oct 31, 2019plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.CVE-2019-16251 · WordPress plugins & themes · reported by MITREMedium 4.3
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.
Product
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpvulndb.com
Oct 25, 2019In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to obtain web configuraCVE-2019-13525 · Other software · Honeywell · reported by ics-cert@hq.dhs.govMedium 5.3
In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data, which can be accessed without authentication over the network.
Product
Ip-ak2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov us-cert.gov
Oct 24, 2019clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management.CVE-2019-18418 · Other software · Clonos · reported by MITRECritical 9.8
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management.
Product
Clonos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Oct 24, 2019A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via theCVE-2019-18419 · Other software · Clonos · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Product
Clonos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 21, 2019In FusionPBX up to v4.5.7, the file app\basic_operator_panel\resources\content.php uses an unsanitized "eavesdrop_dest" variable coming from the URL, which is rCVE-2019-16988 · Other software · Fusionpbx · reported by MITREMedium 6.1
In FusionPBX up to v4.5.7, the file app\basic_operator_panel\resources\content.php uses an unsanitized "eavesdrop_dest" variable coming from the URL, which is reflected on 3 occasions in HTML, leading to XSS.
Product
Fusionpbx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com resp3ctblog.wordpress.com
Oct 11, 2019Genesys PureEngage Digital (eServices) 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet.jsp (ActionColor, ClientNickNameColor, Email, email, or email_CVE-2019-17176 · Other software · Genesys · reported by MITREMedium 6.1
Genesys PureEngage Digital (eServices) 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet.jsp (ActionColor, ClientNickNameColor, Email, email, or email_address parameter).
Product
Eservices Chat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Oct 9, 2019cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).CVE-2019-17380 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Oct 9, 2019cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527).CVE-2019-17379 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Oct 9, 2019cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526).CVE-2019-17378 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Oct 9, 2019cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524).CVE-2019-17377 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Oct 9, 2019cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521).CVE-2019-17376 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Oct 9, 2019cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).CVE-2019-17375 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Oct 9, 2019OTCMS v3.85 has CSRF in the admin/member_deal.php Admin Panel page, leading to creation of a new management group account, as demonstrated by superadmin.CVE-2019-17369 · Other software · Otcms · reported by MITREMedium 6.5
OTCMS v3.85 has CSRF in the admin/member_deal.php Admin Panel page, leading to creation of a new management group account, as demonstrated by superadmin.
Product
Otcms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 6, 2019Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue.CVE-2019-17225 · Other software · Intelliants · reported by MITREMedium 5.4
Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue.
Product
Subrion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Sep 30, 2019In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel.CVE-2019-16993 · Websites & servers · Phpbb · reported by MITREHigh 8.8
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
Product
Phpbb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.debian.org
Sep 27, 2019phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature.CVE-2019-13376 · Websites & servers · Phpbb · reported by MITREMedium 6.5
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS
Product
Phpbb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.phpbb.com ssd-disclosure.com
Sep 25, 2019The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameCVE-2015-9429 · WordPress plugins & themes · reported by MITREMedium 6.5
The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter.
Product
yith-maintenance-mode
Fixed in
1.2.0
What to do
Update yith-maintenance-mode to 1.2.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 17, 2019A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels (all versions of - HMIGTO, HMISTO, XBTGH, HMIGTU, HMCVE-2019-6833 · Other software · Schneider Electric SE · reported by cybersecurity@se.comMedium 6.5
A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels (all versions of - HMIGTO, HMISTO, XBTGH, HMIGTU, HMIGTUX, HMISCU, HMISTU, XBTGT, XBTGT, HMIGXO, HMIGXU), which could cause a temporary freeze of the HMI when a high rate of frames is received. When the attack stops, the buffered commands are processed by the HMI panel.
Product
Magelis HMI Panels
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.cse.iitk.ac.in schneider-electric.com
Sep 16, 2019The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.CVE-2016-10972 · WordPress plugins & themes · reported by MITRECritical 9.8
The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.
Product
newspaper
Fixed in
6.7.2
What to do
Update newspaper to 6.7.2 or newer.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Sep 11, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage value of a victim accounCVE-2019-14725 · Other software · Control-webpanel · reported by MITREMedium 4.3
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage value of a victim account via an attacker account.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record centos-webpanel.com github.com
Sep 11, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an e-mail forwarding destination of a victiCVE-2019-14724 · Other software · Control-webpanel · reported by MITREHigh 7.5
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an e-mail forwarding destination of a victim's account via an attacker account.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record centos-webpanel.com github.com
Sep 10, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a domain from a victim's account via an aCVE-2019-14730 · Other software · Control-webpanel · reported by MITREMedium 4.3
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a domain from a victim's account via an attacker account.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record centos-webpanel.com github.com
Sep 10, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a sub-domain from a victim's account via CVE-2019-14729 · Other software · Control-webpanel · reported by MITREMedium 4.3
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a sub-domain from a victim's account via an attacker account.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record centos-webpanel.com github.com
Sep 10, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to add an e-mail forwarding destination to a victimCVE-2019-14728 · Other software · Control-webpanel · reported by MITREMedium 4.3
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to add an e-mail forwarding destination to a victim's account via an attacker account.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record centos-webpanel.com github.com
Sep 10, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail password of a victim account vCVE-2019-14727 · Other software · Control-webpanel · reported by MITREMedium 4.3
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail password of a victim account via an attacker account.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record centos-webpanel.com github.com
Sep 10, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to access and delete DNS records of a victim's accoCVE-2019-14726 · Other software · Control-webpanel · reported by MITREMedium 5.4
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to access and delete DNS records of a victim's account via an attacker account.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record centos-webpanel.com github.com
Sep 10, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a victim's e-mail account via an attackerCVE-2019-14723 · Other software · Control-webpanel · reported by MITREMedium 4.3
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a victim's e-mail account via an attacker account.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record centos-webpanel.com github.com
Sep 10, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete an e-mail forwarding destination from a vCVE-2019-14722 · Other software · Control-webpanel · reported by MITREMedium 4.3
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete an e-mail forwarding destination from a victim's account via an attacker account.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record centos-webpanel.com github.com
Sep 10, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove a target user from phpMyAdmin via an attaCVE-2019-14721 · Other software · Control-webpanel · reported by MITREMedium 6.5
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove a target user from phpMyAdmin via an attacker account.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record centos-webpanel.com github.com
Sep 10, 2019The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.CVE-2017-18609 · WordPress plugins & themes · reported by MITREMedium 6.1
The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.
Product
magic-fields
Fixed in
1.7.2
What to do
Update magic-fields to 1.7.2 or newer.
Full record and what to do →NVD record sumofpwn.nl wordpress.org
Aug 26, 2019The WEB control panel before 2019-04-30 for ClonOS allows SQL injection in clonos.php.CVE-2019-15571 · Other software · Clonos Project · reported by MITRECritical 9.8
The WEB control panel before 2019-04-30 for ClonOS allows SQL injection in clonos.php.
Product
Clonos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 21, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list pCVE-2019-13476 · Other software · Control-webpanel · reported by MITREMedium 5.4
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Aug 21, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to discover phpMyAdmin passwords (of any user in /eCVE-2019-14246 · Other software · Centos-webpanel · reported by MITREMedium 6.5
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to discover phpMyAdmin passwords (of any user in /etc/passwd) via an attacker account.
Product
Centos Web Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 21, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete databases (such as oauthv2) from the servCVE-2019-14245 · Other software · Centos-webpanel · reported by MITREMedium 6.5
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete databases (such as oauthv2) from the server via an attacker account.
Product
Centos Web Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 21, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comparing response timesCVE-2019-13599 · Other software · Control-webpanel · reported by MITREMedium 5.3
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comparing response times.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 21, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root accountCVE-2019-13477 · Other software · Control-webpanel · reported by MITREHigh 8.8
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root account.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Aug 20, 2019Zebra Industrial Printers All Versions, Zebra printers are shipped with unrestricted end-user access to front panel options.CVE-2019-10960 · Other software · Zebra · reported by ics-cert@hq.dhs.govHigh 7.5
Zebra Industrial Printers All Versions, Zebra printers are shipped with unrestricted end-user access to front panel options. If the option to use a passcode to limit the functionality of the front panel is applied, specially crafted packets could be sent over the same network to a port on the printer and the printer will respond with an array of information that includes the front panel passcode for the printer. Once the passcode is retrieved, an attacker must have physical access to the front panel of the printer to enter the passcode to access the full functionality of the front panel.
Product
Zt610 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov us-cert.gov
Aug 16, 2019The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.CVE-2017-18544 · WordPress plugins & themes · reported by MITREHigh 8.8
The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.
Product
invite-anyone
Fixed in
1.3.16
What to do
Update invite-anyone to 1.3.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019A command injection vulnerability in UploadHandler.php in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to rootCVE-2019-12792 · Other software · Vestacp · reported by MITREHigh 8.8
A command injection vulnerability in UploadHandler.php in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root.
Product
Control Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cardaci.xyz github.com
Aug 15, 2019A directory traversal vulnerability in the v-list-user script in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users CVE-2019-12791 · Other software · Vestacp · reported by MITREHigh 8.8
A directory traversal vulnerability in the v-list-user script in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root via the password reset form.
Product
Control Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cardaci.xyz github.com
Aug 15, 2019OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and InCVE-2019-15081 · Other software · Opencart · reported by MITREMedium 4.8
OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages.
Product
Opencart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.