Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,570 results · page 22 of 32

Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 30 of 46).CVE-2018-11172 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 30 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 29 of 46).CVE-2018-11171 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 29 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 28 of 46).CVE-2018-11170 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 28 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 27 of 46).CVE-2018-11169 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 27 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 26 of 46).CVE-2018-11168 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 26 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 25 of 46).CVE-2018-11167 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 25 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 24 of 46).CVE-2018-11166 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 24 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 23 of 46).CVE-2018-11165 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 23 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 22 of 46).CVE-2018-11164 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 22 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 21 of 46).CVE-2018-11163 · Other software · Quest · reported by MITREHigh 7.2
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 21 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 20 of 46).CVE-2018-11162 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 20 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 19 of 46).CVE-2018-11161 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 19 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 18 of 46).CVE-2018-11160 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 18 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 17 of 46).CVE-2018-11159 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 17 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 16 of 46).CVE-2018-11158 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 16 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 15 of 46).CVE-2018-11157 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 15 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 14 of 46).CVE-2018-11156 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 14 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 13 of 46).CVE-2018-11155 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 13 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 12 of 46).CVE-2018-11154 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 12 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 11 of 46).CVE-2018-11153 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 11 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 10 of 46).CVE-2018-11152 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 10 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 9 of 46).CVE-2018-11151 · Other software · Quest · reported by MITREHigh 7.2
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 9 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 8 of 46).CVE-2018-11150 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 8 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46).CVE-2018-11149 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46).CVE-2018-11148 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 5 of 46).CVE-2018-11147 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 5 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 4 of 46).CVE-2018-11146 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 4 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 3 of 46).CVE-2018-11145 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 3 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 2 of 46).CVE-2018-11144 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 2 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46).CVE-2018-11143 · Other software · Quest · reported by MITRECritical 9.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46).
Product
Disk Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
May 3, 2018The web application backup file in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows is encrypted with a hard-coded cryptograCVE-2018-10167 · Network & remote access · Tp-link · reported by MITREHigh 7.5
The web application backup file in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows is encrypted with a hard-coded cryptographic key, so anyone who knows that key and the algorithm can decrypt it. A low-privilege user could decrypt and modify the backup file in order to elevate their privileges. This is fixed in version 2.6.1_Windows.
Product
EAP Controller
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com coresecurity.com
Apr 24, 2018The Backup Server component in SAP Sybase ASE 15.7 before SP51 allows remote attackers to bypass access restrictions and perform database dumps by leveraging faCVE-2013-7245 · Other software · Sybase · reported by MITREHigh 7.5
The Backup Server component in SAP Sybase ASE 15.7 before SP51 allows remote attackers to bypass access restrictions and perform database dumps by leveraging failure to validate credentials, aka SAP Security Note 1927859.
Product
Adaptive Server Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.spiderlabs.com www3.trustwave.com
Apr 10, 2018The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd paCVE-2014-3114 · WordPress plugins & themes · reported by MITRECritical 9.8
The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd parameter to functions/ezpz-archive-cmd.php.
Affected
up to 12.03.10
What to do
Affects up to 12.03.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com openwall.com
Mar 14, 2018It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to CVE-2018-6329 · Other software · Unitrends · reported by MITRECritical 9.8
It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to place a privilege escalation exploit on the target system and subsequently execute arbitrary commands.
Product
Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.unitrends.com support.unitrends.com
Mar 14, 2018It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticatedCVE-2018-6328 · Other software · Kaseya · reported by MITRECritical 9.8
It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes.
Product
Unitrends Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.unitrends.com support.unitrends.com
Mar 6, 2018Versions of SnapCenter 2.0 through 3.0.1 allow unauthenticated remote attackers to view and modify backup related data via the Plug-in for NAS File Services.CVE-2017-15519 · Other software · NetApp · reported by security-alert@netapp.comHigh 7.2
Versions of SnapCenter 2.0 through 3.0.1 allow unauthenticated remote attackers to view and modify backup related data via the Plug-in for NAS File Services. All users are urged to move to version 3.0.1 and perform the mitigation steps or upgrade to 4.0 following the product documentation.
Product
SnapCenter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com security.netapp.com
Mar 5, 2018Backup feature of SIP module in Huawei DP300 V500R002C00; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC400; V500R002C00SPC500; V500R00CVE-2017-17144 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.3
Backup feature of SIP module in Huawei DP300 V500R002C00; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC400; V500R002C00SPC500; V500R002C00SPC600; V500R002C00SPC800; V500R002C00SPC900; V500R002C00SPCa00; RP200 V500R002C00SPC200; V600R006C00; V600R006C00SPC200; RSE6500 V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC300T; V500R002C00SPC500; V500R002C00SPC600; V500R002C00SPC700; V500R002C00T; TE30 V100R001C10; V100R001C10SPC100; V100R001C10SPC200B010; V100R001C10SPC300; V100R001C10SPC500; V100R001C10SPC600; V100R001C10SPC700B010; V100R001C10SPC800; V500R002C00SPC200; V500R002C00SPC500; V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC900; V500R002C00SPCb00; V600R006C00; TE40 V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC900; V500R002C00SPCb00; V600R006C00; V600R006C00SPC200; TE50 V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPCb00; V600R006C00; V600R006C00SPC200; TE60 V100R001C01SPC100; V100R001C01SPC107TB010; V100R001C10; V100R001C10SPC300; V100R001C10SPC400; V100R001C10SPC500; V100R001C10SPC600; V100R001C10SPC700; V100R001C10SPC800; V100R001C10SPC900; V500R002C00; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V
Product
DP300; RP200; RSE6500; TE30; TE40; TE50; TE60; TP3106; TP3206; ViewPoint 9030; eSpace U1960; eSpace U1981
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huawei.com huawei.com
Feb 28, 2018Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/bacCVE-2015-4117 · Other software · Vestacp · reported by MITREHigh 8.8
Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/backup/index.php.
Product
Control Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vestacp.com exploit-db.com
Feb 23, 2018Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name parameteCVE-2014-3206 · Other software · Seagate · reported by MITRECritical 9.8
Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name parameter to localhost/backupmgmt/pre_connect_check.php.
Product
Blackarmor NAS 220 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 23, 2018backupmgt/pre_connect_check.php in Seagate BlackArmor NAS contains a hard-coded password of '!~@##$$%FREDESWWSED' for a backdoor user.CVE-2014-3205 · Other software · Seagate · reported by MITRECritical 9.8
backupmgt/pre_connect_check.php in Seagate BlackArmor NAS contains a hard-coded password of '!~@##$$%FREDESWWSED' for a backdoor user.
Product
Blackarmor NAS 220 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 22, 2018Backup Download exists in the Proclaim 9.1.1 component for Joomla! via a direct request for a .sql file under backup/.CVE-2018-7317 · Other software · Christianwebministries · reported by MITREHigh 7.5
Backup Download exists in the Proclaim 9.1.1 component for Joomla! via a direct request for a .sql file under backup/.
Product
Proclaim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 20, 2018The "Photo,Video Locker-Calculator" application 12.0 for Android has android:allowBackup="true" in AndroidManifest.xml, which allows attackers to obtain sensitiCVE-2017-16835 · Other software · Photo,video Locker-calculator Project · reported by MITREHigh 7.5
The "Photo,Video Locker-Calculator" application 12.0 for Android has android:allowBackup="true" in AndroidManifest.xml, which allows attackers to obtain sensitive cleartext information via an "adb backup '-f smart.calculator.gallerylock'" command.
Product
Photo,video Locker-calculator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ds-security.com ds-security.com
Feb 19, 2018GEAR Software CD DVD Filter driver (aka GEARAspiWDM.sys), as used in Symantec Backup Exec System Recovery 8.5 and BESR 2010, Symantec System Recovery 2011, NortCVE-2011-3477 · Other software · Symantec · reported by MITREMedium 5.5
GEAR Software CD DVD Filter driver (aka GEARAspiWDM.sys), as used in Symantec Backup Exec System Recovery 8.5 and BESR 2010, Symantec System Recovery 2011, Norton 360, and Norton Ghost, allows local users to cause a denial of service (system crash) via unspecified vectors.
Product
Backup Exec System Recovery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com symantec.com
Feb 16, 2018The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers wiCVE-2017-18091 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.8
The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jira.atlassian.com
Feb 16, 2018Untrusted search path vulnerability in "FLET'S Azukeru Backup Tool" version 1.5.2.6 and earlier allows an attacker to gain privileges via a Trojan horse DLL in CVE-2018-0515 · Other software · NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in "FLET'S Azukeru Backup Tool" version 1.5.2.6 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Product
"FLET'S Azukeru Backup Tool"
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record flets.com jvn.jp
Feb 15, 2018The SIP backup feature in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW MCVE-2017-15336 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.3
The SIP backup feature in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R002C00, V500R002C10, NIP6300 V500R001C00, V500R001C20, V500R001C30, V500R001C50, NIP6600 V500R001C00, V500R001C20, V500R001C30, V500R001C50, NIP6800 V500R001C50, RP200 V500R002C00, V600R006C00, SVN5600 V200R003C00, V200R003C10, SVN5800 V200R003C00, V200R003C10, SVN5800-C V200R003C00, V200R003C10, SeMG9811 V300R001C01, Secospace USG6300 V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6500 V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6600 V100R001C00, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, TE30 V100R001C02, V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V100R001C01, V100R001C10, V500R002C00, V600R006C00, USG9500 V500R001C00, V500R001C20, V500R001C30, USG9520 V300R001C01, V300R001C20, USG9560 V300R001C01, V300R001C20, USG9580 V300R001C01, V300R
Product
DP300,IPS Module,NGFW Module,NIP6300,NIP6600,NIP6800,RP200,SVN5600,SVN5800,SVN5800-C,SeMG9811,Secospace USG6300,Secospace USG6500,Secospace USG6600,TE30,TE40,TE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huawei.com huawei.com
Feb 15, 2018The SIP backup feature in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW MCVE-2017-15335 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.3
The SIP backup feature in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R002C00, V500R002C10, NIP6300 V500R001C00, V500R001C20, V500R001C30, V500R001C50, NIP6600 V500R001C00, V500R001C20, V500R001C30, V500R001C50, NIP6800 V500R001C50, RP200 V500R002C00, V600R006C00, SVN5600 V200R003C00, V200R003C10, SVN5800 V200R003C00, V200R003C10, SVN5800-C V200R003C00, V200R003C10, SeMG9811 V300R001C01, Secospace USG6300 V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6500 V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6600 V100R001C00, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, TE30 V100R001C02, V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V100R001C01, V100R001C10, V500R002C00, V600R006C00, USG9500 V500R001C00, V500R001C20, V500R001C30, USG9520 V300R001C01, V300R001C20, USG9560 V300R001C01, V300R001C20, USG9580 V300R001C01, V300R
Product
DP300,IPS Module,NGFW Module,NIP6300,NIP6600,NIP6800,RP200,SVN5600,SVN5800,SVN5800-C,SeMG9811,Secospace USG6300,Secospace USG6500,Secospace USG6600,TE30,TE40,TE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huawei.com huawei.com
Feb 15, 2018The SIP backup feature in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW MCVE-2017-15334 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.3
The SIP backup feature in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R002C00, V500R002C10, NIP6300 V500R001C00, V500R001C20, V500R001C30, V500R001C50, NIP6600 V500R001C00, V500R001C20, V500R001C30, V500R001C50, NIP6800 V500R001C50, RP200 V500R002C00, V600R006C00, SVN5600 V200R003C00, V200R003C10, SVN5800 V200R003C00, V200R003C10, SVN5800-C V200R003C00, V200R003C10, SeMG9811 V300R001C01, Secospace USG6300 V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6500 V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6600 V100R001C00, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, TE30 V100R001C02, V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V100R001C01, V100R001C10, V500R002C00, V600R006C00, USG9500 V500R001C00, V500R001C20, V500R001C30, USG9520 V300R001C01, V300R001C20, USG9560 V300R001C01, V300R001C20, USG9580 V300R001C01, V300R
Product
DP300,IPS Module,NGFW Module,NIP6300,NIP6600,NIP6800,RP200,SVN5600,SVN5800,SVN5800-C,SeMG9811,Secospace USG6300,Secospace USG6500,Secospace USG6600,TE30,TE40,TE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huawei.com huawei.com
Feb 8, 2018Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3.CVE-2017-15914 · Other software · Borgbackup · reported by MITREHigh 8.8
Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3.
Product
Borg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record borgbackup.readthedocs.io borgbackup.readthedocs.io
Feb 8, 2018This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup 11.2.0.13.CVE-2018-1163 · Other software · Quest · reported by zdi-disclosures@trendmicro.comCritical 9.8
This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup 11.2.0.13. The specific flaw exists within JSON RPC Request handling. By setting the checksession parameter to a specific value, it is possible to bypass authentication to critical functions. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-4752.
Product
Quest NetVault Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.