Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,675 results · page 25 of 34

Feb 12, 2020The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, CVE-2019-19196 · Other software · Telink-semi · reported by MITREMedium 6.5
The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, TLSR823x through 1.3.0, and TLSR826x through 3.3 devices accepts a pairing request with a key size greater than 16 bytes, allowing an attacker in radio range to cause a buffer overflow and denial of service (crash) via crafted packets.
Product
Tlsr8258 BLE SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record telink-semi.com asset-group.github.io
Feb 12, 2020The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, CVE-2019-19194 · Other software · Telink-semi · reported by MITREHigh 8.8
The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, TLSR823x through 1.3.0, and TLSR826x through 3.3 devices installs a zero long term key (LTK) if an out-of-order link-layer encryption request is received during Secure Connections pairing. An attacker in radio range can have arbitrary read/write access to protected GATT service data, cause a device crash, or possibly control a device's function by establishing an encrypted session with the zero LTK.
Product
Tlsr8258 BLE SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record telink-semi.com asset-group.github.io
Feb 10, 2020vBSeo before 3.6.0PL2 allows XSS via the member.php u parameter.CVE-2012-6666 · Other software · Vbseo · reported by MITREMedium 6.1
vBSeo before 3.6.0PL2 allows XSS via the member.php u parameter.
Product
Vbseo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Jan 30, 2020In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if tCVE-2020-5206 · Other software · opencast · reported by GitHubHigh 8.7
In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1
Product
opencast
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 30, 2020Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key.CVE-2020-5222 · Other software · opencast · reported by GitHubMedium 6.8
Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. This problem is fixed in Opencast 7.6 and Opencast 8.1
Product
opencast
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 24, 2020Multiple directory traversal vulnerabilities in the (1) staff interface help editor (edithelp.pl) or (2) member-picupload.pl in Koha before 3.8.23, 3.10.x beforCVE-2014-1923 · Other software · Koha · reported by MITREHigh 7.5
Multiple directory traversal vulnerabilities in the (1) staff interface help editor (edithelp.pl) or (2) member-picupload.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allow remote attackers to write to arbitrary files via unspecified vectors.
Product
Koha
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.koha-community.org bugs.koha-community.org
Jan 14, 2020phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.CVE-2020-5502 · Websites & servers · Phpbb · reported by MITREMedium 6.5
phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.
Product
Phpbb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.phpbb.com phpbb.com
Jan 13, 2020Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remotCVE-2020-6859 · WordPress plugins & themes · reported by MITREMedium 5.3
Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified user_id parameter. This is related to ajax_image_upload and ajax_resize_image.
Product
Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 8, 2020Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1.CVE-2019-11764 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org security.gentoo.org
Jan 8, 2020Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed.CVE-2019-11758 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.2, and Firefox ESR < 68.2.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org usn.ubuntu.com
Jan 6, 2020Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web scrCVE-2015-4039 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified (1) profile fields or (2) new post content. NOTE: CVE-2015-4038 can be used to bypass the administrator confirmation step for vector 2.
Product
WP Membership
Affected
1.2.3 to 1.2.3
What to do
Affects 1.2.3 to 1.2.3. Update WP Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Dec 4, 2019OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the CVE-2019-19522 · Other software · Openbsd · reported by MITREHigh 7.8
OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the auth group. This occurs because root's file can be written to /etc/skey or /var/db/yubikey, and need not be owned by root.
Product
Openbsd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Nov 18, 2019Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.CVE-2019-12422 · Websites & servers · Apache · reported by security@apache.orgHigh 7.5
Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
Product
Shiro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Nov 13, 2019index.php/team_members/add_team_member in RISE Ultimate Project Manager 2.3 has CSRF for adding authorized users.CVE-2019-18884 · Other software · Fairsketch · reported by MITREHigh 8.8
index.php/team_members/add_team_member in RISE Ultimate Project Manager 2.3 has CSRF for adding authorized users.
Product
Rise - Ultimate Project Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com codecanyon.net
Oct 28, 2019Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.CVE-2017-5731 · Other software · Tianocore · reported by secure@intel.comHigh 7.8
Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.
Product
Edk2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.tianocore.org bugzilla.tianocore.org
Oct 9, 2019OTCMS v3.85 has CSRF in the admin/member_deal.php Admin Panel page, leading to creation of a new management group account, as demonstrated by superadmin.CVE-2019-17369 · Other software · Otcms · reported by MITREMedium 6.5
OTCMS v3.85 has CSRF in the admin/member_deal.php Admin Panel page, leading to creation of a new management group account, as demonstrated by superadmin.
Product
Otcms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 9, 2019S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.CVE-2019-17368 · Other software · S-cms · reported by MITREMedium 6.1
S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.
Product
S-cms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 6, 2019Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue.CVE-2019-17225 · Other software · Intelliants · reported by MITREMedium 5.4
Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue.
Product
Subrion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Oct 1, 2019Vulnerability in Online Store v1.0, The registration form requirements for the member email format can be bypassed by posting directly to sent_register.php alloCVE-2019-8290 · Other software · abcprintf · reported by larry0@me.comMedium 6.1
Vulnerability in Online Store v1.0, The registration form requirements for the member email format can be bypassed by posting directly to sent_register.php allowing special characters to be included and an XSS payload to be injected.
Product
Online Store
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com vapidlabs.com
Oct 1, 2019Vulnerability in Online Store v1.0, stored XSS in admin/user_view.php adidas_member_email variableCVE-2019-8289 · Other software · abcprintf · reported by larry0@me.comMedium 5.4
Vulnerability in Online Store v1.0, stored XSS in admin/user_view.php adidas_member_email variable
Product
Online Store
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com vapidlabs.com
Oct 1, 2019Vulnerability in Online Store v1.0, Stored XSS in user_view.php where adidas_member_user variable is not sanitized.CVE-2019-8288 · Other software · abcprintf · reported by larry0@me.comMedium 5.4
Vulnerability in Online Store v1.0, Stored XSS in user_view.php where adidas_member_user variable is not sanitized.
Product
Online Store
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com vapidlabs.com
Sep 30, 2019NETGEAR SRX5308 4.3.5-3 devices allow SQL Injection, as exploited in the wild in September 2019 to add a new user account.CVE-2019-17049 · Network & remote access · Netgear · reported by MITREHigh 7.5
NETGEAR SRX5308 4.3.5-3 devices allow SQL Injection, as exploited in the wild in September 2019 to add a new user account.
Product
Srx5308 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.netgear.com community.netgear.com
Sep 27, 2019Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8.CVE-2019-11740 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Sep 27, 2019Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68.CVE-2019-11735 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Sep 27, 2019Mozilla developers and community members reported memory safety bugs present in Firefox 68.CVE-2019-11734 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Sep 16, 2019The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.CVE-2016-10971 · WordPress plugins & themes · reported by MITRECritical 9.8
The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.
Product
MemberSonic Lite
Fixed in
1.302
What to do
Update MemberSonic Lite to 1.302 or newer.
Full record and what to do →NVD record pritect.net pritect.net
Aug 28, 2019Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9372 · WordPress plugins & themes · reported by MITREMedium 6.1
Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Product
Membership Add-on for iThemes Exchange
Fixed in
1.3.0
What to do
Update Membership Add-on for iThemes Exchange to 1.3.0 or newer.
Full record and what to do →NVD record blog.sucuri.net ithemes.com
Aug 27, 2019The wp-members plugin before 3.2.8 for WordPress has CSRF.CVE-2019-15660 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-members plugin before 3.2.8 for WordPress has CSRF.
Product
wp-members
Fixed in
3.2.8
What to do
Update wp-members to 3.2.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.CVE-2016-10884 · WordPress plugins & themes · reported by MITREHigh 8.8
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
Product
simple-membership
Fixed in
3.3.3
What to do
Update simple-membership to 3.3.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.CVE-2019-14947 · WordPress plugins & themes · reported by MITREMedium 5.4
The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.
Product
ultimate-member
Fixed in
2.0.52
What to do
Update ultimate-member to 2.0.52 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.CVE-2019-14946 · WordPress plugins & themes · reported by MITREMedium 5.4
The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.
Product
ultimate-member
Fixed in
2.0.52
What to do
Update ultimate-member to 2.0.52 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The ultimate-member plugin before 2.0.54 for WordPress has XSS.CVE-2019-14945 · WordPress plugins & themes · reported by MITREMedium 5.4
The ultimate-member plugin before 2.0.54 for WordPress has XSS.
Product
ultimate-member
Fixed in
2.0.54
What to do
Update ultimate-member to 2.0.54 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The ultimate-member plugin before 2.0.4 for WordPress has XSS.CVE-2018-20965 · WordPress plugins & themes · reported by MITREMedium 6.1
The ultimate-member plugin before 2.0.4 for WordPress has XSS.
Product
ultimate-member
Fixed in
2.0.4
What to do
Update ultimate-member to 2.0.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The simple-membership plugin before 3.5.7 for WordPress has XSS.CVE-2017-18499 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-membership plugin before 3.5.7 for WordPress has XSS.
Product
simple-membership
Fixed in
3.5.7
What to do
Update simple-membership to 3.5.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.CVE-2016-10872 · WordPress plugins & themes · reported by MITREMedium 6.1
The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.
Product
ultimate-member
Fixed in
1.3.40
What to do
Update ultimate-member to 1.3.40 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.CVE-2015-9304 · WordPress plugins & themes · reported by MITREMedium 6.1
The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
Product
ultimate-member
Fixed in
1.3.18
What to do
Update ultimate-member to 1.3.18 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 6, 2019cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186).CVE-2016-10786 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 28, 2019The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.CVE-2019-14328 · WordPress plugins & themes · reported by MITREHigh 8.8
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.
Product
Simple Membership
Fixed in
3.8.5
What to do
Update Simple Membership to 3.8.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Jul 23, 2019Mozilla developers and community members reported memory safety bugs present in Firefox 66.CVE-2019-9814 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 67.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jul 23, 2019Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6.CVE-2019-9800 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jul 23, 2019Mozilla developers and community members reported memory safety bugs present in Firefox 67.CVE-2019-11710 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 67. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 68.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Jul 23, 2019Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7.CVE-2019-11709 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Product
Firefox ESR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Jun 30, 2019core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrf_cCVE-2019-13086 · Other software · Cszcms · reported by MITRECritical 9.8
core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrf_csz parameter.
Product
CSZ CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 24, 2019An issue was discovered in the Ultimate Member plugin 2.39 for WordPress.CVE-2019-10271 · WordPress plugins & themes · reported by MITREMedium 4.3
An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged users. To perform such a modification, one first needs to (for example) intercept an upload-picture request and modify the user_id parameter.
Product
Ultimate Member
Fixed in
2.0.40
What to do
Update Ultimate Member to 2.0.40 or newer.
Full record and what to do →NVD record cxsecurity.com cxsecurity.com
Jun 21, 2019An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress.CVE-2019-10270 · WordPress plugins & themes · reported by MITREHigh 8.8
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation between the reset password key sent by mail and the user_id parameter) to reset the password of another user. One only needs to know the user_id, which is publicly available. One just has to intercept the password modification request and modify user_id. It is possible to modify the passwords for any users or admin WordPress Ultimate Members. This could lead to account compromise and privilege escalation.
Product
Ultimate Member
Fixed in
2.0.40
What to do
Update Ultimate Member to 2.0.40 or newer.
Full record and what to do →NVD record cxsecurity.com cxsecurity.com
Jun 18, 2019Alpine Linux abuild through 3.4.0 allows an unprivileged member of the abuild group to add an untrusted package via a --keys-dir option that causes acceptance oCVE-2019-12875 · Other software · Alpinelinux · reported by MITREMedium 6.5
Alpine Linux abuild through 3.4.0 allows an unprivileged member of the abuild group to add an untrusted package via a --keys-dir option that causes acceptance of an untrusted signing key.
Product
Abuild
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.foxkit.us github.com
May 27, 2019EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php.CVE-2019-12362 · Other software · Phome · reported by MITREMedium 6.1
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php.
Product
Empirecms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 27, 2019EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template.CVE-2019-12361 · Other software · Phome · reported by MITREMedium 6.1
EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page.
Product
Empirecms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 26, 2019Mozilla developers and community members reported memory safety bugs present in Firefox 65.CVE-2019-9789 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 65. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 66.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Apr 26, 2019Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5.CVE-2019-9788 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.