Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

1,291 results · page 22 of 26

May 6, 2015ftagent.exe in EMC AutoStart 5.4.x and 5.5.x before 5.5.0.508 HF4 allows remote attackers to execute arbitrary commands via crafted packets.CVE-2015-0538 · Other software · EMC · reported by security_alert@emc.comHigh 9.3
ftagent.exe in EMC AutoStart 5.4.x and 5.5.x before 5.5.0.508 HF4 allows remote attackers to execute arbitrary commands via crafted packets.
Product
Autostart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Mar 8, 2015Integer overflow in the SkAutoSTArray implementation in include/core/SkTemplates.h in the filters implementation in Skia, as used in Google Chrome before 41.0.2CVE-2015-1214 · Other software · Redhat · reported by chrome-cve-admin@google.comHigh 7.5
Integer overflow in the SkAutoSTArray implementation in include/core/SkTemplates.h in the filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a reset action with a large count value, leading to an out-of-bounds write operation.
Product
Enterprise Linux Desktop Supplementary
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record googlechromereleases.blogspot.com rhn.redhat.com
Feb 27, 2015Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gainCVE-2015-0884 · Other software · Toshiba · reported by vultures@jpcert.or.jpMedium 6.9
Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.
Product
Bluetooth Stack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp kb.cert.org
Jan 1, 2015Cross-site scripting (XSS) vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTMCVE-2011-5307 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
Product
PhotoSmash
Affected
1.01 to 1.01
What to do
Affects 1.01 to 1.01. Update PhotoSmash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record htbridge.com htbridge.com
Dec 3, 2014Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attackers to inject arbitrarCVE-2014-9236 · Other software · Zoph · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) photographer_id or (2) _crumb parameter.
Product
Zoph
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Dec 3, 2014Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands CVE-2014-9235 · Other software · Zoph · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) _action parameter to group.php or (2) user.php or the (3) location_id parameter to photos.php in php/.
Product
Zoph
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Oct 21, 2014The Recetas de Tragos (aka com.wRecetasdeTragos) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middleCVE-2014-7751 · Other software · Fotoschilenas · reported by cret@cert.orgMedium 5.4
The Recetas de Tragos (aka com.wRecetasdeTragos) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Recetas DE Tragos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Oct 20, 2014The Secretos de belleza (aka com.rareartifact.secretosdebelleza83A55CB8) application 1.0 for Android does not verify X.509 certificates from SSL servers, which CVE-2014-7492 · Other software · Tejonstore · reported by cret@cert.orgMedium 5.4
The Secretos de belleza (aka com.rareartifact.secretosdebelleza83A55CB8) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Secretos DE Belleza
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Oct 16, 2014The Pregnancy Tips (aka com.rareartifact.tipsforpregnant71C80129) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows CVE-2014-6986 · Other software · Fotoschilenas · reported by cret@cert.orgMedium 5.4
The Pregnancy Tips (aka com.rareartifact.tipsforpregnant71C80129) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Pregnancy Tips
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Oct 15, 2014The Akne Ernahrung (aka com.rareartifact.akneernahrung72010074) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows maCVE-2014-6949 · Other software · Fotoschilenas · reported by cret@cert.orgMedium 5.4
The Akne Ernahrung (aka com.rareartifact.akneernahrung72010074) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Akne Ernahrung
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Sep 11, 2014The Sylphone (aka com.sylpheo.prospectosyl) application 5.3.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle atCVE-2014-5875 · Other software · Sylpheo · reported by cret@cert.orgMedium 5.4
The Sylphone (aka com.sylpheo.prospectosyl) application 5.3.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Sylphone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Sep 8, 2014The Kicksend: Share & Print Photos (aka com.kicksend.android) application 3.3.2.18 for Android does not verify X.509 certificates from SSL servers, which allowsCVE-2014-5651 · Other software · Kicksend · reported by cret@cert.orgMedium 5.4
The Kicksend: Share & Print Photos (aka com.kicksend.android) application 3.3.2.18 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Kicksend\
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Sep 8, 2014The Angry Gran Toss (aka com.aceviral.angrygrantoss) application 1.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-CVE-2014-5564 · Other software · Aceviral · reported by cret@cert.orgMedium 5.4
The Angry Gran Toss (aka com.aceviral.angrygrantoss) application 1.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Angry Gran Toss
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Aug 22, 2014Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5CVE-2014-3587 · Other software · Christos Zoulas · reported by Red HatMedium 4.3
Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.
Product
File
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com php.net
Jul 26, 2014Directory traversal vulnerability in the toServerObject function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers toCVE-2014-2626 · Other software · HP · reported by hp-security-alert@hp.comHigh 9.4
Directory traversal vulnerability in the toServerObject function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to create files, and consequently execute arbitrary code, via crafted input, aka ZDI-CAN-2024.
Product
Network Virtualization
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com
Jul 9, 2014Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allCVE-2014-3478 · Other software · Christos Zoulas · reported by Red HatMedium 6.5
Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.
Product
File
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com lists.opensuse.org
Jul 9, 2014The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote aCVE-2014-0207 · Other software · Christos Zoulas · reported by Red HatMedium 6.5
The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.
Product
File
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com lists.opensuse.org
Jul 3, 2014file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consuCVE-2014-3538 · Other software · Christos Zoulas · reported by Red HatMedium 5
file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
Product
File
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com mx.gw.com
Jun 19, 2014Stack-based buffer overflow in the U3D.8BI library plugin in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to exCVE-2012-2052 · Other software · Adobe · reported by AdobeHigh 9.3
Stack-based buffer overflow in the U3D.8BI library plugin in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to execute arbitrary code via a long Collada asset element in a DAE file, as demonstrated by the cameraYFov value in the contributor comments element.
Product
Photoshop Cs5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org retrogod.altervista.org
May 26, 2014The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to download avatar photos of arbitrary users via unspecifCVE-2013-3981 · Other software · IBM · reported by psirt@us.ibm.comMedium 5
The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to download avatar photos of arbitrary users via unspecified vectors.
Product
Sametime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com exchange.xforce.ibmcloud.com
Apr 21, 2014The default configuration of IBM 4690 OS, as used in Toshiba Global Commerce Solutions 4690 POS and other products, hashes passwords with the ADXCRYPT algorithmCVE-2014-0361 · Other software · Toshibacommerce · reported by cret@cert.orgLow 3
The default configuration of IBM 4690 OS, as used in Toshiba Global Commerce Solutions 4690 POS and other products, hashes passwords with the ADXCRYPT algorithm, which makes it easier for context-dependent attackers to obtain sensitive information via unspecified cryptanalysis of an ADXCSOUF.DAT file.
Product
4690 Point Of Sale Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com kb.cert.org
Apr 19, 2014Cross-site request forgery (CSRF) vulnerability in TopAccess (aka the web-based management utility) on TOSHIBA TEC e-Studio 232, 233, 282, and 283 devices allowCVE-2014-1990 · Other software · Toshibatec · reported by vultures@jpcert.or.jpMedium 6.8
Cross-site request forgery (CSRF) vulnerability in TopAccess (aka the web-based management utility) on TOSHIBA TEC e-Studio 232, 233, 282, and 283 devices allows remote attackers to hijack the authentication of administrators for requests that change passwords.
Product
E-studio-232
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Mar 24, 2014The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which aCVE-2013-7345 · Other software · Christos Zoulas · reported by MITREMedium 5
The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.
Product
File
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.gw.com rhn.redhat.com
Mar 24, 2014Cross-site scripting (XSS) vulnerability in the quiz_question_tostring function in mod/quiz/editlib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x befoCVE-2014-2571 · Other software · Moodle · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the quiz_question_tostring function in mod/quiz/editlib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to inject arbitrary web script or HTML via a quiz question.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org openwall.com
Mar 19, 2014Multiple SQL injection vulnerabilities in bbs/ajax.autosave.php in GNUboard 5.x and possibly earlier allow remote authenticated users to execute arbitrary SQL cCVE-2014-2339 · Other software · SIR · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in bbs/ajax.autosave.php in GNUboard 5.x and possibly earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) subject or (2) content parameter.
Product
Gnuboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org securityfocus.com
Mar 18, 2014/sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in error messCVE-2014-2534 · Other software · Blackberry · reported by MITREMedium 4.9
/sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in error messages, as demonstrated by reading the root password hash in /etc/shadow.
Product
QNX Neutrino Rtos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Mar 18, 2014/sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arbitrary program name as a command-line arCVE-2014-2533 · Other software · Blackberry · reported by MITREHigh 7.2
/sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arbitrary program name as a command-line argument.
Product
QNX Neutrino Rtos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Mar 14, 2014Photos Backend in Apple iOS before 7.1 does not properly manage the asset-library cache during deletions, which allows physically proximate attackers to obtain CVE-2014-1281 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 1.9
Photos Backend in Apple iOS before 7.1 does not properly manage the asset-library cache during deletions, which allows physically proximate attackers to obtain sensitive photo data by launching the Photos app and looking under a transparent image.
Product
Iphone OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Dec 24, 2013Multiple SQL injection vulnerabilities in Classifieds Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to demo/clasCVE-2013-7216 · Other software · Etoshop · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Classifieds Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to demo/classifieds/product.asp, or (2) UserID or (3) Password field to demo/classifieds/admin.asp.
Product
Classifieds Creator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org osvdb.org
Dec 20, 2013Multiple SQL injection vulnerabilities in C2C Forward Auction Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) pa parameter to aCVE-2013-7193 · Other software · Etoshop · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in C2C Forward Auction Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) pa parameter to auction/asp/list.asp, or the (2) UserID or (3) Password to auction/casp/admin.asp.
Product
C2c Forward Auction Creator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org osvdb.org
Dec 20, 2013Multiple SQL injection vulnerabilities in Dynamic Biz Website Builder (QuickWeb) allow remote attackers to execute arbitrary SQL commands via the (1) id parametCVE-2013-7192 · Other software · Etoshop · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Dynamic Biz Website Builder (QuickWeb) allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/news-events/newdetail.asp, or the (2) UserID or (3) Password to login.asp.
Product
Dynamic BIZ Website Builder Quickweb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Dec 4, 2013lgtosync.sys in VMware Workstation 9.x before 9.0.3, VMware Player 5.x before 5.0.3, VMware Fusion 5.x before 5.0.4, VMware ESXi 4.0 through 5.1, and VMware ESXCVE-2013-3519 · Other software · VMware · reported by MITREHigh 7.9
lgtosync.sys in VMware Workstation 9.x before 9.0.3, VMware Player 5.x before 5.0.3, VMware Fusion 5.x before 5.0.4, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1, when a 32-bit Windows guest OS is used, allows guest OS users to gain guest OS privileges via an application that performs a crafted memory allocation.
Product
Esxi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vmware.com vmware.com
Jul 12, 2013Buffer overflow in phrelay in BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 in the QNX Software Development Platform allows remote attackers to cause a denial CVE-2013-2688 · Other software · Blackberry · reported by MITREMedium 5.4
Buffer overflow in phrelay in BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 in the QNX Software Development Platform allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted packets to TCP port 4868 that leverage improper handling of the /dev/photon device file.
Product
QNX Software Development Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aluigi.altervista.org ics-cert.us-cert.gov
Jul 12, 2013Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2) QNX Momentics Tool Suite through 6.5.0 CVE-2013-2687 · Other software · Blackberry · reported by MITREHigh 7.8
Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2) QNX Momentics Tool Suite through 6.5.0 SP1 in the QNX Software Development Platform allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted packets to TCP port 4868.
Product
QNX Momentics Tool Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aluigi.altervista.org ics-cert.us-cert.gov
Mar 8, 2013The default configuration in gnome-screensaver 3.5.4 through 3.6.0 sets the AutostartCondition line to fallback mode in the .desktop file, which prevents the prCVE-2013-1050 · Other software · Gnome · reported by security@ubuntu.comHigh 7.2
The default configuration in gnome-screensaver 3.5.4 through 3.6.0 sets the AutostartCondition line to fallback mode in the .desktop file, which prevents the program from starting automatically after login and allows physically proximate attackers to bypass screen locking and access an unattended workstation.
Product
Gnome Screensaver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ubuntu.com bugs.launchpad.net
Jan 13, 2013Use-after-free vulnerability in the obj_toSource function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, ThunderbirdCVE-2013-0756 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 9.3
Use-after-free vulnerability in the obj_toSource function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted web page referencing JavaScript Proxy objects that are not properly handled during garbage collection.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Jan 13, 2013Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0CVE-2013-0753 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 9.3
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via crafted web content.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Jan 13, 2013The XBL.__proto__.toString implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, ThuCVE-2013-0748 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
The XBL.__proto__.toString implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 makes it easier for remote attackers to bypass the ASLR protection mechanism by calling the toString function of an XBL object.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Dec 13, 2012Buffer overflow in Adobe Photoshop Camera Raw before 7.3 allows attackers to execute arbitrary code via unspecified vectors.CVE-2012-5680 · Other software · Adobe · reported by AdobeHigh 10
Buffer overflow in Adobe Photoshop Camera Raw before 7.3 allows attackers to execute arbitrary code via unspecified vectors.
Product
Camera RAW
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com adobe.com
Dec 13, 2012Buffer underflow in Adobe Photoshop Camera Raw before 7.3 allows attackers to execute arbitrary code via unspecified vectors.CVE-2012-5679 · Other software · Adobe · reported by AdobeHigh 7.5
Buffer underflow in Adobe Photoshop Camera Raw before 7.3 allows attackers to execute arbitrary code via unspecified vectors.
Product
Camera RAW
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com adobe.com
Sep 6, 2012Untrusted search path vulnerability in FotoSlate 4.0 Build 146 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working dCVE-2011-5153 · Other software · Acdsee · reported by MITREMedium 6.3
Untrusted search path vulnerability in FotoSlate 4.0 Build 146 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .plp file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Fotoslate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com secunia.com
Sep 4, 2012Heap-based buffer overflow in Photoshop.exe in Adobe Photoshop CS5 12.x before 12.0.5, CS5.1 12.1.x before 12.1.1, and CS6 13.x before 13.0.1 allows remote attaCVE-2012-0275 · Other software · Adobe · reported by PSIRT-CNA@flexerasoftware.comHigh 10
Heap-based buffer overflow in Photoshop.exe in Adobe Photoshop CS5 12.x before 12.0.5, CS5.1 12.1.x before 12.1.1, and CS6 13.x before 13.0.1 allows remote attackers to execute arbitrary code via a crafted TIFF image with SGI24LogLum compression.
Product
Photoshop Cs5.5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com adobe.com
Aug 31, 2012Buffer overflow in Adobe Photoshop CS6 13.x before 13.0.1 allows remote attackers to execute arbitrary code via a crafted file.CVE-2012-4170 · Other software · Adobe · reported by AdobeHigh 9.3
Buffer overflow in Adobe Photoshop CS6 13.x before 13.0.1 allows remote attackers to execute arbitrary code via a crafted file.
Product
Photoshop Cs6
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com securityfocus.com
Aug 25, 2012Integer overflow in plug-ins/common/psd.c in the Adobe Photoshop PSD plugin in GIMP 2.2.13 and earlier allows remote attackers to cause a denial of service and CVE-2012-3402 · Other software · Gimp · reported by Red HatMedium 6.8
Integer overflow in plug-ins/common/psd.c in the Adobe Photoshop PSD plugin in GIMP 2.2.13 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted channels header value in a PSD image file, which triggers a heap-based buffer overflow, a different vulnerability than CVE-2009-3909.
Product
Gimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com secunia.com
Aug 14, 2012Cross-site request forgery (CSRF) vulnerability in the Autosave module 6.x before 6.x-2.10 and 7.x-2.x before 7.x-2.0 for Drupal allows remote attackers to hijaCVE-2012-2097 · Other software · Larry Garfield · reported by Red HatMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Autosave module 6.x before 6.x-2.10 and 7.x-2.x before 7.x-2.0 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests involving "submitting saved results to a node."
Product
Autosave
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Jul 17, 2012file before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted Composite Document File (CDF) file that triggers (1) an CVE-2012-1571 · Other software · Christos Zoulas · reported by Red HatMedium 6.5
file before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted Composite Document File (CDF) file that triggers (1) an out-of-bounds read or (2) an invalid pointer dereference.
Product
File
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mx.gw.com debian.org
Jul 16, 2012admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to oCVE-2011-4287 · Other software · Moodle · reported by Red HatMedium 6.8
admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org moodle.org
Jun 30, 2012Unspecified vulnerability on HP Photosmart Wireless e-All-in-One B110, e-All-in-One D110, Plus e-All-in-One B210, eStation All-in-One C510, Ink Advantage e-All-CVE-2012-2017 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Unspecified vulnerability on HP Photosmart Wireless e-All-in-One B110, e-All-in-One D110, Plus e-All-in-One B210, eStation All-in-One C510, Ink Advantage e-All-in-One K510, and Premium Fax e-All-in-One C410 printers allows remote attackers to cause a denial of service via unknown vectors.
Product
Photosmart E-all-in-one Printer Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20000.www2.hp.com securitytracker.com
Jun 21, 2012Cross-site request forgery (CSRF) vulnerability in the Comment Moderation module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to hijack the authentCVE-2012-2716 · Other software · David Stosik · reported by Red HatMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Comment Moderation module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to hijack the authentication of administrators for requests that publish comments.
Product
Comment Moderation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Jun 12, 2012The toStaticHTML API (aka the SafeHTML component) in Microsoft Internet Explorer 8 and 9, Communicator 2007 R2, and Lync 2010 and 2010 Attendee does not properlCVE-2012-1858 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
The toStaticHTML API (aka the SafeHTML component) in Microsoft Internet Explorer 8 and 9, Communicator 2007 R2, and Lync 2010 and 2010 Attendee does not properly handle event attributes and script, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted HTML document, aka "HTML Sanitization Vulnerability."
Product
Lync
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov us-cert.gov

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.