Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,424 results · page 22 of 29

Feb 18, 2019Insufficient file protection in uninstall routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enablCVE-2019-0104 · Other software · Intel · reported by secure@intel.comMedium 5.5
Insufficient file protection in uninstall routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.
Product
Data Center Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Feb 18, 2019Insufficient file protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable CVE-2019-0103 · Other software · Intel · reported by secure@intel.comMedium 5.5
Insufficient file protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.
Product
Data Center Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Feb 18, 2019Insufficient session authentication in web server for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an unauthenticated user to potentially enaCVE-2019-0102 · Other software · Intel · reported by secure@intel.comHigh 8.8
Insufficient session authentication in web server for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Product
Data Center Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org securityfocus.com
Jan 10, 2019Improper file verification in install routine for Intel(R) SGX SDK and Platform Software for Windows before 2.2.100 may allow an escalation of privilege via locCVE-2018-18098 · Other software · Intel Corporation · reported by secure@intel.comHigh 7.3
Improper file verification in install routine for Intel(R) SGX SDK and Platform Software for Windows before 2.2.100 may allow an escalation of privilege via local access.
Product
Intel(R) SGX SDK and Platform Software for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Jan 9, 2019Untrusted search path vulnerability in Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ 3.08 and earlier allows an attacker to gaCVE-2018-0667 · Other software · MICRONET CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ 3.08 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Product
Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ 3.08 and earlier
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mnc.co.jp jvn.jp
Jan 8, 2019SAP Work and Inventory Manager (Agentry_SDK , before 7.0, 7.1) allows an attacker to prevent legitimate users from accessing a service, either by crashing or flCVE-2019-0241 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.5
SAP Work and Inventory Manager (Agentry_SDK , before 7.0, 7.1) allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
Product
SAP Work and Inventory Manager (Agentry_SDK)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com launchpad.support.sap.com
Jan 3, 2019An exploitable buffer overflow vulnerability exists in the HTTP header-parsing function of the Webroot BrightCloud SDK.CVE-2018-4012 · Other software · Webroot · reported by talos-cna@cisco.comCritical 9
An exploitable buffer overflow vulnerability exists in the HTTP header-parsing function of the Webroot BrightCloud SDK. The function bc_http_read_header incorrectly handles overlong headers, leading to arbitrary code execution. An unauthenticated attacker could impersonate a remote BrightCloud server to trigger this vulnerability.
Product
Brightcloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Dec 18, 2018An exploitable vulnerability exists in the HTTP client functionality of the Webroot BrightCloud SDK.CVE-2018-4015 · Other software · Webroot · reported by talos-cna@cisco.comHigh 8.1
An exploitable vulnerability exists in the HTTP client functionality of the Webroot BrightCloud SDK. The configuration of the HTTP client does not enforce a secure connection by default, resulting in a failure to validate TLS certificates. An attacker could impersonate a remote BrightCloud server to exploit this vulnerability.
Product
Brightcloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Nov 19, 2018Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials.CVE-2018-15759 · Other software · Pivotal · reported by security_alert@emc.comCritical 9.1
Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious user may make many requests to the service broker with different credentials, allowing them to infer valid credentials and gain access to perform broker operations.
Product
On Demand Services SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com pivotal.io
Nov 14, 2018The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the error.php error_msg parameter.CVE-2018-19190 · Other software · Amazon · reported by MITREMedium 6.1
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the error.php error_msg parameter.
Product
Payfort-php-sdk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com seekurity.com
Nov 14, 2018The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in an error.php ecCVE-2018-19189 · Other software · Amazon · reported by MITREMedium 6.1
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in an error.php echo statement.
Product
Payfort-php-sdk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com seekurity.com
Nov 14, 2018The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the success.php fort_id parameter.CVE-2018-19188 · Other software · Amazon · reported by MITREMedium 6.1
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the success.php fort_id parameter.
Product
Payfort-php-sdk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com github.com
Nov 14, 2018The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in a success.php eCVE-2018-19187 · Other software · Amazon · reported by MITREMedium 6.1
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in a success.php echo statement.
Product
Payfort-php-sdk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com seekurity.com
Nov 14, 2018The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the route.php paymentMethod parameter.CVE-2018-19186 · Other software · Amazon · reported by MITREMedium 6.1
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the route.php paymentMethod parameter.
Product
Payfort-php-sdk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seekurity.com seekurity.com
Oct 19, 2018A vulnerability exists in the file reading procedure in Open Design Alliance Drawings SDK 2019Update1 on non-Windows platforms in which attackers could perform CVE-2018-18224 · Other software · Opendesign · reported by MITREHigh 8.1
A vulnerability exists in the file reading procedure in Open Design Alliance Drawings SDK 2019Update1 on non-Windows platforms in which attackers could perform read operations past the end, or before the beginning, of the intended buffer. This can allow attackers to obtain sensitive information from process memory or cause a crash.
Product
Drawings SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com opendesign.com
Oct 19, 2018Open Design Alliance Drawings SDK 2019Update1 has a vulnerability during the reading of malformed files, allowing attackers to obtain sensitive information fromCVE-2018-18223 · Other software · Opendesign · reported by MITREHigh 8.1
Open Design Alliance Drawings SDK 2019Update1 has a vulnerability during the reading of malformed files, allowing attackers to obtain sensitive information from process memory or cause a crash.
Product
Drawings SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com opendesign.com
Oct 10, 2018A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK using MQTT protocol accesses objects in memory, aka "Azure IoT DeviCVE-2018-8531 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK using MQTT protocol accesses objects in memory, aka "Azure IoT Device Client SDK Memory Corruption Vulnerability." This affects Hub Device Client SDK, Azure IoT Edge.
Product
Hub Device Client SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com portal.msrc.microsoft.com
Sep 12, 2018A spoofing vulnerability exists for the Azure IoT Device Provisioning for the C SDK library using the HTTP protocol on Windows platform, aka "Azure IoT SDK SpooCVE-2018-8479 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.6
A spoofing vulnerability exists for the Azure IoT Device Provisioning for the C SDK library using the HTTP protocol on Windows platform, aka "Azure IoT SDK Spoofing Vulnerability." This affects C SDK.
Product
C SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com portal.msrc.microsoft.com
Sep 12, 2018Escalation of privilege in Reference UI in Intel Data Center Manager SDK 5.0 and before may allow an unauthorized remote unauthenticated user to potentially exeCVE-2018-3679 · Other software · Intel Corporation · reported by secure@intel.comCritical 9.6
Escalation of privilege in Reference UI in Intel Data Center Manager SDK 5.0 and before may allow an unauthorized remote unauthenticated user to potentially execute code via administrator privileges.
Product
Intel(R) Data Center Manager SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Aug 20, 2018The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against pCVE-2018-1656 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.4
The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882.
Product
SDK, Java Technology Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com securityfocus.com
Aug 20, 2018A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflict a denial-of-service attack with specialCVE-2018-1517 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflict a denial-of-service attack with specially crafted String data. IBM X-Force ID: 141681.
Product
SDK, Java Technology Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com securityfocus.com
Aug 6, 2018A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2.CVE-2016-4404 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comCritical 9.8
A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via a memory allocation issue.
Product
HP Keyview
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Aug 6, 2018A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2.CVE-2016-4403 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comCritical 9.8
A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via memory corruption.
Product
HP Keyview
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Aug 6, 2018A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2.CVE-2016-4402 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comCritical 9.8
A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via buffer overflow.
Product
HP Keyview
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Aug 2, 2018paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verification_code parameter, resulting in code execution.CVE-2017-6215 · Other software · Paypal · reported by MITREMedium 5.4
paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verification_code parameter, resulting in code execution.
Product
PHP Permissions SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 2, 2018paypal/invoice-sdk-php is vulnerable to reflected XSS in samples/permissions.php via the permToken parameter, resulting in code execution.CVE-2017-6213 · Other software · Paypal · reported by MITREMedium 5.4
paypal/invoice-sdk-php is vulnerable to reflected XSS in samples/permissions.php via the permToken parameter, resulting in code execution.
Product
PHP Invoice SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 31, 2018This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader.CVE-2018-14311 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XFA events. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6331.
Product
Foxit ActiveX Pro SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Jul 24, 2018Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution.CVE-2017-3210 · Other software · Portrait Display · reported by cret@cert.orgHigh 7.8
Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution. A number of applications developed using the Portrait Displays SDK do not use secure permissions when running. These applications run the component pdiservice.exe with NT AUTHORITY/SYSTEM permissions. This component is also read/writable by all Authenticated Users. This allows local authenticated attackers to run arbitrary code with SYSTEM privileges. The following applications have been identified by Portrait Displays as affected: Fujitsu DisplayView Click: Version 6.0 and 6.01. The issue was fixed in Version 6.3. Fujitsu DisplayView Click Suite: Version 5. The issue is addressed by patch in Version 5.9. HP Display Assistant: Version 2.1. The issue was fixed in Version 2.11. HP My Display: Version 2.0. The issue was fixed in Version 2.1. Philips Smart Control Premium: Versions 2.23, 2.25. The issue was fixed in Version 2.26.
Product
SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org securityfocus.com
Jul 24, 2018On the iOS platform, the ThreatMetrix SDK versions prior to 3.2 fail to validate SSL certificates provided by HTTPS connections, which may allow an attacker to CVE-2017-3182 · Other software · ThreatMetrix · reported by cret@cert.orgMedium 6.8
On the iOS platform, the ThreatMetrix SDK versions prior to 3.2 fail to validate SSL certificates provided by HTTPS connections, which may allow an attacker to perform a man-in-the-middle (MITM) attack. ThreatMetrix is a security library for mobile applications, which aims to provide fraud prevention and device identity capabilities. The ThreatMetrix SDK versions prior to 3.2 do not validate SSL certificates on the iOS platform. An affected application will communicate with https://h-sdk.online-metrix.net, regardless of whether the connection is secure or not. An attacker on the same network as or upstream from the iOS device may be able to view or modify ThreatMetrix network traffic that should have been protected by HTTPS.
Product
SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org securityfocus.com
Jul 19, 2018espritblock eos4j, an unofficial SDK for EOS, through 2018-07-12 mishandles floating-point numbers with more than four digits after the decimal point, which migCVE-2018-14439 · Other software · Eblock · reported by MITREHigh 7.5
espritblock eos4j, an unofficial SDK for EOS, through 2018-07-12 mishandles floating-point numbers with more than four digits after the decimal point, which might allow attackers to trigger currency transfers of unintended amounts.
Product
Eos4j
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bishijie.com github.com
Jul 8, 2018WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL.CVE-2018-13439 · Other software · Tencent · reported by MITREHigh 7.5
WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL.
Product
Wechat PAY
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jun 12, 2018Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 (as well as in RTsoft's Dink Smallwood HD / ProtonSDK version) before 3.14 allow an attackCVE-2018-0496 · Other software · Dinknetwork · reported by security@debian.orgHigh 7.5
Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 (as well as in RTsoft's Dink Smallwood HD / ProtonSDK version) before 3.14 allow an attacker to overwrite arbitrary files on the user's system.
Product
Dfarc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.savannah.gnu.org lists.debian.org
Jun 11, 2018Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability.CVE-2016-9903 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. This vulnerability affects Firefox < 50.1.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jun 4, 2018node-air-sdk is an AIR SDK for nodejs.CVE-2016-10647 · Other software · HackerOne · reported by support@hackerone.comHigh 8.1
node-air-sdk is an AIR SDK for nodejs. node-air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Product
node-air-sdk node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 1, 2018air-sdk is a NPM wrapper for the Adobe AIR SDK.CVE-2016-10603 · Other software · HackerOne · reported by support@hackerone.comHigh 8.1
air-sdk is a NPM wrapper for the Adobe AIR SDK. air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Product
air-sdk node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
Jun 1, 2018wasdk is a toolkit for creating WebAssembly modules.CVE-2016-10587 · Other software · HackerOne · reported by support@hackerone.comHigh 8.1
wasdk is a toolkit for creating WebAssembly modules. wasdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Product
wasdk node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
May 29, 2018cue-sdk-node is a Corsair Cue SDK wrapper for node.js.CVE-2016-10590 · Other software · HackerOne · reported by support@hackerone.comHigh 8.1
cue-sdk-node is a Corsair Cue SDK wrapper for node.js. cue-sdk-node downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.
Product
cue-sdk-node node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodesecurity.io nodesecurity.io
May 9, 2018A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "AzuCVE-2018-8119 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.6
A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Azure IoT SDK Spoofing Vulnerability." This affects C# SDK, C SDK, Java SDK.
Product
C# SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com portal.msrc.microsoft.com
Apr 24, 2018A code execution vulnerability exists in the kdu_buffered_expand function of the Kakadu SDK 7.9.CVE-2017-2812 · Other software · Kakadu Software · reported by talos-cna@cisco.comHigh 8.8
A code execution vulnerability exists in the kdu_buffered_expand function of the Kakadu SDK 7.9. A specially crafted JPEG 2000 file can be read by the program and can lead to an out of bounds write causing an exploitable condition to arise.
Product
Kakadu SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com talosintelligence.com
Apr 24, 2018A code execution vulnerability exists in the Kakadu SDK 7.9's parsing of compressed JPEG 2000 images.CVE-2017-2811 · Other software · Kakadu Software · reported by talos-cna@cisco.comHigh 8.8
A code execution vulnerability exists in the Kakadu SDK 7.9's parsing of compressed JPEG 2000 images. A specially crafted JPEG 2000 file can be read by the program, and can lead to an out of bounds write causing an exploitable condition to arise.
Product
Kakadu SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com talosintelligence.com
Apr 18, 2018Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Image Export SDK).CVE-2018-2801 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1
Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Image Export SDK). The supported version that is affected is 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L).
Product
Outside In Technology
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com securityfocus.com
Mar 29, 2018The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly CVE-2015-2020 · Other software · Myscript · reported by psirt@us.ibm.comCritical 9.8
The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Product
Myscript
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record alephsecurity.com usenix.org
Mar 29, 2018The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a SerializableCVE-2015-2004 · Other software · Gracenote · reported by psirt@us.ibm.comCritical 9.8
The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Product
Gnsdk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record alephsecurity.com usenix.org
Mar 29, 2018The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable clCVE-2015-2003 · Other software · Pjsip · reported by psirt@us.ibm.comCritical 9.8
The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Product
Pjsua2 SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record alephsecurity.com usenix.org
Mar 29, 2018The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class CVE-2015-2002 · Other software · Esri · reported by psirt@us.ibm.comCritical 9.8
The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Product
Arcgisruntime SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record alephsecurity.com usenix.org
Mar 29, 2018The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperlCVE-2015-2001 · Other software · Metaio · reported by psirt@us.ibm.comCritical 9.8
The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Product
Metaio SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record alephsecurity.com usenix.org
Mar 29, 2018The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly pCVE-2015-2000 · Other software · Jumio · reported by psirt@us.ibm.comCritical 9.8
The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Product
Jumio SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record alephsecurity.com usenix.org
Mar 20, 2018Edger8r tool in the Intel SGX SDK before version 2.1.2 (Linux) and 1.9.6 (Windows) may generate code that is susceptible to a side channel potentially allowing CVE-2018-3626 · Other software · Intel Corporation · reported by secure@intel.comMedium 4.7
Edger8r tool in the Intel SGX SDK before version 2.1.2 (Linux) and 1.9.6 (Windows) may generate code that is susceptible to a side channel potentially allowing a local user to access unauthorized information.
Product
SGX SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com security-center.intel.com
Mar 16, 2018UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reporCVE-2018-1000134 · Other software · Pingidentity · reported by MITRECritical 9.8
UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contains an Incorrect Access Control vulnerability in process function in SimpleBindRequest class doesn't check for empty password when running in synchronous mode. commit with applied fix https://github.com/pingidentity/ldapsdk/commit/8471904a02438c03965d21367890276bc25fa5a6#diff-f6cb23b459be1ec17df1da33760087fd that can result in Ability to impersonate any valid user. This attack appear to be exploitable via Providing valid username and empty password against servers that do not do additional validation as per https://tools.ietf.org/html/rfc4513#section-5.1.1. This vulnerability appears to have been fixed in after commit 8471904a02438c03965d21367890276bc25fa5a6.
Product
Ldapsdk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com access.redhat.com
Mar 5, 2018Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a BleichenbacCVE-2017-17428 · Other software · Cavium · reported by MITREMedium 5.9
Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.
Product
Nitrox SSL SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.