Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

2,235 results · page 24 of 45

Feb 7, 2021CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) tCVE-2021-3122 · Other software · NCR · reported by MITRECritical 9.8
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: the vendor's position is that exploitation occurs only on devices with a certain "misconfiguration."
Product
Command Center Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com rdf2.alohaenterprise.com
Feb 4, 2021A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smalleCVE-2020-27249 · Other software · Softmaker · reported by talos-cna@cisco.comHigh 7.8
A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0004 and 0x0015, an attacker can entice the victim to open a document to trigger this vulnerability. This affects SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014).
Product
Planmaker 2021
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Feb 4, 2021A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smalleCVE-2020-27248 · Other software · Softmaker · reported by talos-cna@cisco.comHigh 7.8
A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0003 and 0x0014, an attacker can entice the victim to open a document to trigger this vulnerability. This affects SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014).
Product
Planmaker 2021
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Feb 4, 2021A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smalleCVE-2020-27247 · Other software · Softmaker · reported by talos-cna@cisco.comHigh 7.8
A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0002, an attacker can entice the victim to open a document to trigger this vulnerability. This affects SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014).
Product
Planmaker 2021
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Feb 4, 2021A memory corruption vulnerability exists in the Excel Document SST Record 0x00fc functionality of SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (RevisCVE-2020-13586 · Other software · Softmaker · reported by talos-cna@cisco.comHigh 7.8
A memory corruption vulnerability exists in the Excel Document SST Record 0x00fc functionality of SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014). A specially crafted malformed file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Product
Planmaker 2021
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Feb 4, 2021An exploitable heap-based buffer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application.CVE-2020-13580 · Other software · Softmaker · reported by talos-cna@cisco.comHigh 7.8
An exploitable heap-based buffer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafted document can cause the document parser to explicitly trust a length from a particular record type and use it to write a 16-bit null relative to a buffer allocated on the stack. Due to a lack of bounds-checking on this value, this can allow an attacker to write to memory outside of the buffer and controllably corrupt memory. This can allow an attacker to earn code execution under the context of the application. An attacker can entice the victim to open a document to trigger this vulnerability.
Product
Planmaker 2021
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Feb 4, 2021An exploitable integer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application.CVE-2020-13579 · Other software · Softmaker · reported by talos-cna@cisco.comHigh 7.8
An exploitable integer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafted document can cause the document parser perform arithmetic that may overflow which can result in an undersized heap allocation. Later when copying data from the file into this allocation, a heap-based buffer overflow will occur which can corrupt memory. These types of memory corruptions can allow for code execution under the context of the application. An attacker can entice the victim to open a document to trigger this vulnerability.
Product
Planmaker 2021
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Jan 26, 2021A specially crafted Markdown document could cause the execution of malicious JavaScript code in Caret Editor before 4.0.0-rc22.CVE-2020-20269 · Other software · Caret · reported by MITRECritical 9.8
A specially crafted Markdown document could cause the execution of malicious JavaScript code in Caret Editor before 4.0.0-rc22.
Product
Caret
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 19, 2021XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section.CVE-2021-3137 · Other software · Xwiki · reported by MITREMedium 5.4
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section.
Product
Xwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 19, 2021HGiga EIP product contains SQL Injection vulnerability.CVE-2021-22851 · Other software · HGiga · reported by twcert@cert.org.twCritical 9.8
HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain database schema and data.
Product
OAKSv20 OAKlouds-document_v3 2.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chtsecurity.com twcert.org.tw
Jan 19, 2021HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions.CVE-2021-22850 · Other software · HGiga · reported by twcert@cert.org.twMedium 5.3
HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions.
Product
OAKSv20 OAKlouds-document_v3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chtsecurity.com twcert.org.tw
Jan 12, 2021OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/<share-token>?delivery=view URI.CVE-2021-23929 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/<share-token>?delivery=view URI.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jan 7, 2021The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures.CVE-2018-18689 · Other software · Avanquest · reported by MITREMedium 5.3
The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, a Signature Wrapping vulnerability exists in multiple products. An attacker can use /ByteRange and xref manipulations that are not detected by the signature-validation logic. This affects Foxit Reader before 9.4 and PhantomPDF before 8.3.9 and 9.x before 9.4. It also affects eXpert PDF 12 Ultimate, Expert PDF Reader, Nitro Pro, Nitro Reader, PDF Architect 6, PDF Editor 6 Pro, PDF Experte 9 Ultimate, PDFelement6 Pro, PDF Studio Viewer 2018, PDF Studio Pro, PDF-XChange Editor and Viewer, Perfect PDF 10 Premium, Perfect PDF Reader, Soda PDF, and Soda PDF Desktop.
Product
Expert PDF Ultimate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-insecurity.org pdf-insecurity.org
Jan 7, 2021The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures.CVE-2018-18688 · Other software · Code-industry · reported by MITREMedium 5.3
The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, an Incremental Saving vulnerability exists in multiple products. When an attacker uses the Incremental Saving feature to add pages or annotations, Body Updates are displayed to the user without any action by the signature-validation logic. This affects Foxit Reader before 9.4 and PhantomPDF before 8.3.9 and 9.x before 9.4. It also affects LibreOffice, Master PDF Editor, Nitro Pro, Nitro Reader, Nuance Power PDF Standard, PDF Editor 6 Pro, PDFelement6 Pro, PDF Studio Viewer 2018, PDF Studio Pro, Perfect PDF 10 Premium, and Perfect PDF Reader.
Product
Master PDF Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-insecurity.org pdf-insecurity.org
Jan 6, 2021An exploitable signed conversion vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker application.CVE-2020-13545 · Other software · Softmaker · reported by talos-cna@cisco.comHigh 7.8
An exploitable signed conversion vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker application. A specially crafted document can cause the document parser to miscalculate a length used to allocate a buffer, later upon usage of this buffer the application will write outside its bounds resulting in a heap-based memory corruption. An attacker can entice the victim to open a document to trigger this vulnerability.
Product
Softmaker Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Jan 6, 2021An exploitable sign extension vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker application.CVE-2020-13544 · Other software · Softmaker · reported by talos-cna@cisco.comHigh 7.8
An exploitable sign extension vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker application. A specially crafted document can cause the document parser to sign-extend a length used to terminate a loop, which can later result in the loop’s index being used to write outside the bounds of a heap buffer during the reading of file data. An attacker can entice the victim to open a document to trigger this vulnerability.
Product
Softmaker Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Jan 4, 2021HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks.CVE-2020-26293 · Other software · mganss · reported by GitHubMedium 6.1
HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the `<style>` tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the `<style>` tag so there is no risk if you have not explicitly allowed the `<style>` tag. The problem has been fixed in version 5.0.372.
Product
HtmlSanitizer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 24, 2020DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document.CVE-2020-35702 · Other software · Freedesktop · reported by MITREHigh 7.8
DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects
Product
Poppler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.freedesktop.org gitlab.freedesktop.org
Dec 22, 2020Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to injectCVE-2018-15633 · Other software · Odoo · reported by security@odoo.comMedium 6.1
Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted attachment filenames.
Product
Odoo Community
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 18, 2020An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download documents (PDF) by providing a valid documenCVE-2020-26173 · Other software · Tangro · reported by MITRELow 3.1
An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download documents (PDF) by providing a valid document ID and token. No further authentication is required.
Product
Business Workflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.to.com tangro.de
Dec 18, 2020In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated.CVE-2020-26171 · Other software · Tangro · reported by MITREMedium 4.3
In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By doing this, users can add attachments to workitems that do not belong to them.
Product
Business Workflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.to.com tangro.de
Dec 18, 2020SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request.CVE-2019-16955 · Other software · Solarwinds · reported by MITREMedium 5.4
SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request.
Product
Webhelpdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com esecforte.com
Dec 15, 2020In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass due to a missing permission check.CVE-2020-0480 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege allowing a caller to copy, move, or delete files accessible to DocumentsProvider with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-157320716
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Dec 15, 2020In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass.CVE-2020-0479 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass. This could lead to local escalation of privilege allowing a malicious app to access files available to the DocumentProvider without user permission, with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-157294893
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Dec 9, 2020BookStack is a platform for storing and organising information and documentation.CVE-2020-26260 · Other software · BookStackApp · reported by GitHubMedium 6.4
BookStack is a platform for storing and organising information and documentation. In BookStack before version 0.30.5, a user with permissions to edit a page could set certain image URL's to manipulate functionality in the exporting system, which would allow them to make server side requests and/or have access to a wider scope of files within the BookStack file storage locations. The issue was addressed in BookStack v0.30.5. As a workaround, page edit permissions could be limited to only those that are trusted until you can upgrade.
Product
BookStack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bookstackapp.com github.com
Nov 26, 2020petl before 1.68, in some configurations, allows resolution of entities in an XML document.CVE-2020-29128 · Other software · Petl Project · reported by MITRECritical 9.8
petl before 1.68, in some configurations, allows resolution of entities in an XML document.
Product
Petl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 24, 2020Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php.CVE-2020-28726 · Other software · Seeddms · reported by MITREMedium 6.1
Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php.
Product
Seeddms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sourceforge.net sourceforge.net
Nov 18, 2020SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document.CVE-2020-15300 · Other software · Salesagility · reported by MITREMedium 6.1
SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document.
Product
Suitecrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wizlynxgroup.com wizlynxgroup.com
Nov 18, 2020SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality.CVE-2020-14208 · Other software · Salesagility · reported by MITREMedium 5.4
SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.
Product
Suitecrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wizlynxgroup.com wizlynxgroup.com
Nov 17, 2020A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target usCVE-2020-13958 · Websites & servers · Apache · reported by security@apache.orgHigh 7.8
A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal protocol may be called from the document event handler and other hyperlinks require a control-click.
Product
Openoffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Nov 17, 2020Use of an undocumented user in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to view the video stream.CVE-2020-27558 · Other software · Basetech · reported by MITREMedium 6.5
Use of an undocumented user in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to view the video stream.
Product
Ge-131 Bt-1837836 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record infosec.rm-it.de infosec.rm-it.de
Nov 17, 2020In BASETech GE-131 BT-1837836 firmware 20180921, the web-server on the system is configured with the option “DocumentRoot /etc“.CVE-2020-27553 · Other software · Basetech · reported by MITREHigh 7.5
In BASETech GE-131 BT-1837836 firmware 20180921, the web-server on the system is configured with the option “DocumentRoot /etc“. This allows an attacker with network access to the web-server to download any files from the “/etc” folder without authentication. No path traversal sequences are needed to exploit this vulnerability.
Product
Ge-131 Bt-1837836 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record infosec.rm-it.de infosec.rm-it.de
Nov 6, 2020In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents.CVE-2020-26883 · Other software · Lightbend · reported by MITREHigh 7.5
In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents.
Product
Play Framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record playframework.com playframework.com
Nov 5, 2020SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the object_path CVE-2020-28115 · Other software · Web-audimex · reported by MITREHigh 8.8
SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the object_path parameter.
Product
Audimexee
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2020The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains undocumented default admin credentials for the web management interface.CVE-2020-27689 · Other software · Imomobile · reported by MITRECritical 9.8
The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains undocumented default admin credentials for the web management interface. A remote attacker could exploit this vulnerability to login and execute commands on the device, as well as upgrade the firmware image to a malicious version.
Product
Verve Connect Vh510 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record 6point6.co.uk 6point6.co.uk
Oct 23, 2020Verifone VerixV Pinpad Payment Terminals with QT000530 have an undocumented physical access mode (aka VerixV shell.out).CVE-2019-14716 · Other software · Verifone · reported by MITREMedium 6.6
Verifone VerixV Pinpad Payment Terminals with QT000530 have an undocumented physical access mode (aka VerixV shell.out).
Product
Verix OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ptsecurity.com ptsecurity.com
Oct 23, 2020Verifone Pinpad Payment Terminals allow undocumented physical access to the system via an SBI bootloader memory write operation.CVE-2019-14715 · Other software · Verifone · reported by MITREMedium 6.8
Verifone Pinpad Payment Terminals allow undocumented physical access to the system via an SBI bootloader memory write operation.
Product
P400 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ptsecurity.com ptsecurity.com
Oct 22, 2020Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used.CVE-2020-7020 · Other software · Elastic · reported by security@elastic.coLow 3.1
Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.
Product
Elasticsearch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.elastic.co security.netapp.com
Oct 21, 2020BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache SandboCVE-2020-27605 · Other software · Bigbluebutton · reported by MITRECritical 9.8
BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."
Product
Bigbluebutton
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record golem.de golem.de
Oct 21, 2020BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files.CVE-2020-27603 · Other software · Bigbluebutton · reported by MITREHigh 7.5
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files.
Product
Bigbluebutton
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record golem.de golem.de
Oct 21, 2020BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URLCVE-2020-25820 · Other software · Bigbluebutton · reported by MITREMedium 6.5
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field.
Product
Bigbluebutton
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Oct 20, 2020SAP NetWeaver (Compare Systems) versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents.CVE-2020-6366 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
SAP NetWeaver (Compare Systems) versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with administrative privileges can retrieve arbitrary files including files on OS level from the server and/or can execute a denial-of-service.
Product
SAP NetWeaver (Compare Systems)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Oct 16, 2020The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not CVE-2020-14144 · Other software · Gitea · reported by MITREHigh 7.2
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states "This is a functionality of the software that is limited to a very limited subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides.
Product
Gitea
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com docs.github.com
Oct 6, 2020An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resultedCVE-2020-1903 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.5
An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulted in an out-of-memory denial of service. This issue would have required the receiver to explicitly open the attachment if it was received from a number not in the receiver's WhatsApp contacts.
Product
WhatsApp for iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Sep 17, 2020In DocumentsUI, there is a possible permission bypass due to a confused deputy.CVE-2020-0345 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In DocumentsUI, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-144286721
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Sep 17, 2020yWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document.CVE-2020-25215 · Other software · Yworks · reported by MITRECritical 9.8
yWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document.
Product
YED
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record yworks.com zigrin.com
Sep 16, 2020Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create permiCVE-2020-2254 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create permission to read arbitrary files on the Jenkins controller file system.
Product
Jenkins Blue Ocean Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Sep 13, 2020GdiDrawHoriLineIAlt in Kingsoft WPS Office before 11.2.0.9403 allows remote heap corruption via a crafted PLTE chunk in PNG data within a Word document.CVE-2020-25291 · Other software · Kingsoft · reported by MITREHigh 7.8
GdiDrawHoriLineIAlt in Kingsoft WPS Office before 11.2.0.9403 allows remote heap corruption via a crafted PLTE chunk in PNG data within a Word document. This is related to QBrush::setMatrix in gui/painting/qbrush.cpp in Qt 4.x.
Product
WPS Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zeifan.my zeifan.my
Sep 9, 2020SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) allows an attacker with edit document rights to upload any file (includingCVE-2020-6288 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.3
SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) allows an attacker with edit document rights to upload any file (including script files) without proper file format validation leading to Unrestricted upload of file with dangerous type vulnerability. The attacker can modify some formulas and display erroneous content. The server is not affected only the current user browser session, that can easily be closed.
Product
SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Sep 1, 2020The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device oCVE-2020-16204 · Other software · Redlion · reported by ics-cert@hq.dhs.govCritical 9.8
The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device on the N-Tron 702-W / 702M12-W (all versions).
Product
N-tron 702-w Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.