Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,675 results · page 23 of 34
Dec 13, 2021Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all versionsCVE-2021-39934 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attributeCVE-2021-24955 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- User Registration, Login Form, User Profile & Membership
- Fixed in
- 3.2.3
- What to do
- Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard pageCVE-2021-24954 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard page, leading to a Reflected Cross-Site Scripting issue
- Product
- User Registration, Login Form, User Profile & Membership
- Fixed in
- 3.2.3
- What to do
- Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 8, 2021Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2.CVE-2021-43534 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
Dec 1, 2021In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make CVE-2021-44227 · Other software · GNU · reported by MITREHigh 8.8
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
- Product
- Mailman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netlists.debian.org
Nov 12, 2021iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add.CVE-2020-21141 · Other software · Idreamsoft · reported by MITREHigh 8.8
iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2021Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have accCVE-2021-39897 · Websites & servers · GitLab · reported by cve@gitlab.comLow 2.6
Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have access even after the subgroup is transferred
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2021Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident.CVE-2021-39902 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2021Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary code, via thCVE-2020-23754 · Websites & servers · Php-fusion · reported by MITRECritical 9.6
Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary code, via the polls feature.
- Product
- Phpfusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comuser-images.githubusercontent.com
Oct 25, 2021Galette is a membership management web application geared towards non profit organizations.CVE-2021-21319 · Other software · galette · reported by GitHubMedium 6.8
Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround (this is the default state). Malicious javascript code can be executed (not stored) on login and retrieve password pages. This issue is patched in version 0.9.5.
- Product
- galette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.galette.eugithub.com
Oct 7, 2021JEECMS x1.1 contains a stored cross-site scripting (XSS) vulnerability in the component of /member-vipcenter.htm, which allows attackers to execute arbitrary weCVE-2020-21729 · Other software · Jeecms · reported by MITREMedium 5.4
JEECMS x1.1 contains a stored cross-site scripting (XSS) vulnerability in the component of /member-vipcenter.htm, which allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Jeecms X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Maccms 10 contains a cross-site scripting (XSS) vulnerability in the Editing function under the Member module.CVE-2020-21434 · Other software · Maccms · reported by MITREMedium 5.4
Maccms 10 contains a cross-site scripting (XSS) vulnerability in the Editing function under the Member module. This vulnerability is exploited via a crafted payload in the nickname text field.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details.CVE-2021-41118 · Other software · Universal-Omega · reported by GitHubMedium 5.3
The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. In affected versions unsanitised input of regular expression date within the parameters of the DPL parser function, allowed for the possibility of ReDoS (Regex Denial of Service). This has been resolved in version 3.3.6. If you are unable to update you may also set `$wgDplSettings['functionalRichness'] = 0;` or disable DynamicPageList3 to mitigate.
- Product
- DynamicPageList3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021Improper privileges management vulnerability in McAfee Endpoint Security (ENS) Windows prior to 10.7.0 September 2021 Update allows local users to access files CVE-2021-31843 · Other software · McAfee,LLC · reported by trellixpsirt@trellix.comHigh 7.3
Improper privileges management vulnerability in McAfee Endpoint Security (ENS) Windows prior to 10.7.0 September 2021 Update allows local users to access files which they would otherwise not have access to via manipulating junction links to redirect McAfee folder operations to an unintended location.
- Product
- McAfee Endpoint Security (ENS) for WIndows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkc.mcafee.comkc.mcafee.com
Sep 17, 2021XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a local user to initiateCVE-2021-31842 · Other software · McAfee,LLC · reported by trellixpsirt@trellix.comMedium 5
XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a local user to initiate high CPU and memory consumption resulting in a Denial of Service attack through carefully editing the EPDeploy.xml file and then executing the setup process.
- Product
- McAfee Endpoint Security (ENS) for WIndows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkc.mcafee.comkc.mcafee.com
Sep 15, 2021Cross Site Request Forgery (CSRF) in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/index.php?module=member&action=add'.CVE-2020-19159 · Other software · Laiketui · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/index.php?module=member&action=add'.
- Product
- Laiketui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2021In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerable to man-in-the-middle attack if using pCVE-2021-41033 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgHigh 8.1
In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerable to man-in-the-middle attack if using p2 repos that are HTTP; that can then be exploited to serve incorrect p2 metadata and entirely alter the local installation, particularly by installing plug-ins that may then run malicious code.
- Product
- Eclipse Equinox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.eclipse.orgbugs.eclipse.org
Sep 13, 2021Membership & Content Restriction – Paid Member Subscriptions: Did not sanitiseCVE-2021-24728 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.
- Product
- Membership & Content Restriction – Paid Member Subscriptions
- Fixed in
- 2.4.2
- What to do
- Update Membership & Content Restriction – Paid Member Subscriptions to 2.4.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Sep 9, 2021A stored cross-site scripting (XSS) vulnerability in the /member/picture/album component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTCVE-2020-19289 · Other software · Jeesns · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the /member/picture/album component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the new album tab.
- Product
- Jeesns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021Konnichiwa! Membership: Reflected Cross-Site ScriptingCVE-2021-38317 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Konnichiwa! Membership WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the plan_id parameter in the ~/views/subscriptions.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.8.3.
- Product
- Konnichiwa! Membership
- Affected
- up to 0.8.3
- What to do
- Affects up to 0.8.3. Update Konnichiwa! Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 6, 2021An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated before inserting to aCVE-2021-24392 · WordPress plugins & themes · reported by WPScanHigh 7.2
An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- WordPress Membership SwiftCloud.io
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WordPress Membership SwiftCloud.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 24, 2021An issue in the handling of group membership was resolved with improved logic.CVE-2021-30943 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
An issue in the handling of group membership was resolved with improved logic. This issue is fixed in iOS 15.2 and iPadOS 15.2, watchOS 8.3, macOS Monterey 12.1. A malicious user may be able to leave a messages group but continue to receive messages in that group.
- Product
- watchOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Aug 23, 2021Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain thaCVE-2021-22251 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain that should be blocked by group settings
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2021LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for: Was affected by an IDOR issueCVE-2021-24562 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers and grades
- Product
- LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for
- Fixed in
- 4.21.2
- What to do
- Update LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for to 4.21.2 or newer.
Full record and what to do →NVD recordmake.lifterlms.comwpscan.com
Aug 17, 2021Mozilla developers and community members reported memory safety bugs present in Firefox 90.CVE-2021-29990 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 91.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
Aug 9, 2021The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/registCVE-2021-24522 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could be used in an XSS attack which could lead to wp-admin access. Further, the plugin in several places assigned $_POST as $_GET which meant that in some cases this could be replicated with just $_GET parameters and no need for $_POST values.
- Product
- User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar)
- Fixed in
- 3.1.11
- What to do
- Update User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) to 3.1.11 or newer.
Aug 2, 2021User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar): Did not sanitise or escape some of its settings before saving them and outputting them back in the pageCVE-2021-24450 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar)
- Fixed in
- 3.1.8
- What to do
- Update User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) to 3.1.8 or newer.
Aug 2, 2021About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership: Does not properly sanitise its Biography fieldCVE-2021-24443 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the affected user profile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an admin, inducing them to view their profile with a malicious payload adding a rogue account for example.
- Product
- About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership
- Fixed in
- 1.0.7
- What to do
- Update About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership to 1.0.7 or newer.
Jul 30, 2021muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a CVE-2021-37601 · Other software · Prosody · reported by MITREHigh 7.5
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.
- Product
- Prosody
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.fedoraproject.org
Jul 12, 2021SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid.CVE-2020-21133 · Other software · Metinfo · reported by MITRECritical 9.8
SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2021Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above alloCVE-2021-25439 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above allows untrusted applications to cause arbitrary webpage loading in webview.
- Product
- Samsung Members
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jul 8, 2021Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above alloCVE-2021-25438 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.8
Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above allows untrusted applications to cause local file inclusion in webview.
- Product
- Samsung Members
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jul 8, 2021Information exposure vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above allows CVE-2021-25432 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Information exposure vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above allows untrusted applications to access chat data.
- Product
- Samsung Members
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 24, 2021Mozilla developers and community members reported memory safety bugs present in Firefox 87.CVE-2021-29947 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Mozilla developers and community members reported memory safety bugs present in Firefox 87. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 88.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 16, 2021SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php.CVE-2020-22198 · Other software · Dedecms · reported by MITRECritical 9.8
SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2021An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations iCVE-2021-22215 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.5
An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations in other projects
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2021A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforced.CVE-2020-14388 · Other software · Redhat · reported by Red HatMedium 6.3
A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforced. This flaw allows an authenticated user to bypass normal account restrictions and access API services where they do not have permission.
- Product
- 3scale API Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
May 24, 2021The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4CVE-2021-24308 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.
- Fixed in
- 4.21.1
- What to do
- Update the plugin to 4.21.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 24, 2021Ultimate Member – User Profile, User Registration, Login & Membership: Did not properly sanitiseCVE-2021-24306 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link to edit user's own profile, leading to an authenticated reflected Cross-Site Scripting issue. Knowledge of the targeted username is required to exploit this, and attackers would then need to make the related logged in user open a malicious link.
- Product
- Ultimate Member – User Profile, User Registration, Login & Membership
- Fixed in
- 2.1.20
- What to do
- Update Ultimate Member – User Profile, User Registration, Login & Membership to 2.1.20 or newer.
May 17, 2021Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0CVE-2021-29044 · Other software · Liferay · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments parameter.
- Product
- Digital Experience Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.liferay.devportal.liferay.dev
May 10, 2021In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3.CVE-2020-23369 · Other software · Yzmcms · reported by MITREMedium 6.1
In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3.
- Product
- Yzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2021An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and below, and 3.9.00.9 iCVE-2021-25374 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 8.6
An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and below, and 3.9.00.9 in Android P(9.0) and above allows remote attackers to access a user data related with Samsung Account.
- Product
- Samsung Members
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 2, 2021Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the /magnoliaPublic/travel/members/login.html mgnlUserId parameteCVE-2021-25894 · Other software · Magnolia-cms · reported by MITREMedium 6.1
Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the /magnoliaPublic/travel/members/login.html mgnlUserId parameter.
- Product
- Magnolia CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.magnolia-cms.comitas.vn
Mar 31, 2021The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 beforeCVE-2020-36286 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.3
The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a group exists & members of groups if they are assigned to publicly visible issue field.
- Product
- Jira Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comjira.atlassian.com
Mar 31, 2021On all 7.x versions (fixed in 8.0.0), when set up for auto failover, a BIG-IQ Data Collection Device (DCD) cluster member that receives an undisclosed message mCVE-2021-22996 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
On all 7.x versions (fixed in 8.0.0), when set up for auto failover, a BIG-IQ Data Collection Device (DCD) cluster member that receives an undisclosed message may cause the corosync process to abort. This behavior may lead to a denial-of-service (DoS) and impact the stability of a BIG-IQ high availability (HA) cluster. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
- Product
- Big-iq Centralized Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Mar 31, 2021Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8.CVE-2021-23987 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Mar 18, 2021Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross-site scripting vulnerabilities allowingCVE-2021-24128 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross-site scripting vulnerabilities allowing medium-privileged authenticated attacker (contributor+) to inject arbitrary web script or HTML via the 'Description/biography' of a member.
- Product
- Team Members
- Fixed in
- 5.0.4
- What to do
- Update Team Members to 5.0.4 or newer.
Mar 17, 2021the Paid Memberships Pro versions prior to 2.5.6: SQL injectionCVE-2021-20678 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- the Paid Memberships Pro versions prior to 2.5.6
- Fixed in
- 2.5.6
- What to do
- Update the Paid Memberships Pro versions prior to 2.5.6 to 2.5.6 or newer.
Mar 15, 2021IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient.CVE-2021-20440 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient. An attacker who is a valid user in the user registry used by API Manager can use a stolen invitation link and register themselves as a member of an API provider organization. IBM X-Force ID: 196536.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 4, 2021Calling of non-existent provider in Samsung Members prior to version 2.4.81.13 (in Android O(8.1) and below) and 3.8.00.13 (in Android P(9.0) and above) allows CVE-2021-25343 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Calling of non-existent provider in Samsung Members prior to version 2.4.81.13 (in Android O(8.1) and below) and 3.8.00.13 (in Android P(9.0) and above) allows unauthorized actions including denial of service attack by hijacking the provider.
- Product
- Samsung Members
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.