Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,675 results · page 26 of 34
Apr 20, 2019Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.CVE-2019-11375 · Other software · Meisivod · reported by MITREMedium 6.5
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.
- Product
- Msvod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comiwantacve.cn
Apr 10, 2019In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after they have been removed fCVE-2019-6287 · Other software · Suse · reported by MITREHigh 8.1
In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after they have been removed from it.
- Product
- Rancher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.rancher.comrancher.com
Apr 7, 2019Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java.CVE-2019-10907 · Other software · Airsonic Project · reported by MITRECritical 9.8
Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to capture cookies might be able to trivially bruteforce offline the passwords of associated users.
- Product
- Airsonic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2019A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsCVE-2019-10673 · WordPress plugins & themes · reported by MITREHigh 8.8
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the administrator profile, and then the attacker is able to reset the administrator password using the WordPress "password forget" form.
- Product
- A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member
- Fixed in
- 2.0.40
- What to do
- Update A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member to 2.0.40 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Mar 27, 2019phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter.CVE-2017-18364 · Other software · Frank-karau · reported by MITREHigh 7.4
phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter.
- Product
- Phpfk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 24, 2019In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because theCVE-2019-10014 · Other software · Dedecms · reported by MITREMedium 6.5
In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netblog.csdn.net
Mar 21, 2019LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting content via mod/deleCVE-2018-17996 · Other software · Layerbb · reported by MITREMedium 6.5
LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting content via mod/delete.php/.
- Product
- Layerbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 7, 2019WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI.CVE-2018-17425 · Other software · Wuzhicms · reported by MITREMedium 5.4
WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2019Mozilla developers and community members reported memory safety bugs present in Firefox 63.CVE-2018-12406 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Mozilla developers and community members reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 64.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.combugzilla.mozilla.org
Feb 28, 2019Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3.CVE-2018-12405 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Feb 28, 2019Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2.CVE-2018-12390 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Feb 28, 2019Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2.CVE-2018-12389 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.3 and Thunderbird < 60.3.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Feb 28, 2019Mozilla developers and community members reported memory safety bugs present in Firefox 62.CVE-2018-12388 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Mozilla developers and community members reported memory safety bugs present in Firefox 62. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 63.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Feb 18, 2019In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-afterCVE-2019-8912 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgpatchwork.ozlabs.org
Feb 17, 2019SeaCMS 7.2 mishandles member.php?mod=repsw4 requests.CVE-2019-8418 · Other software · Seacms · reported by MITREHigh 8.8
SeaCMS 7.2 mishandles member.php?mod=repsw4 requests.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2019BEESCMS 4.0 has a CSRF vulnerability to add arbitrary VIP accounts via the admin/admin_member.php?action=add&nav=add_web_user&admin_p_nav=user URI.CVE-2019-8347 · Other software · Beescms · reported by MITREHigh 8.8
BEESCMS 4.0 has a CSRF vulnerability to add arbitrary VIP accounts via the admin/admin_member.php?action=add&nav=add_web_user&admin_p_nav=user URI.
- Product
- Beescms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2019Mozilla developers and community members reported memory safety bugs present in Firefox 64.CVE-2018-18502 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 64. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 65.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comusn.ubuntu.com
Feb 5, 2019Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4.CVE-2018-18501 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgsecurityfocus.com
Jan 22, 2019An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeSCVE-2019-1003003 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 7.2
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Jan 8, 2019qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web siCVE-2019-5725 · Other software · Qibosoft · reported by MITREHigh 7.5
qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file.
- Product
- Qibosoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2019EARCLINK ESPCMS-P8 has SQL injection in the install_pack/index.php?ac=Member&at=verifyAccount verify_key parameter.CVE-2019-5488 · Other software · Earclink · reported by MITREHigh 7.5
EARCLINK ESPCMS-P8 has SQL injection in the install_pack/index.php?ac=Member&at=verifyAccount verify_key parameter. install_pack/espcms_public/espcms_db.php may allow retrieving sensitive information from the ESPCMS database.
- Product
- Espcms-p8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Dec 30, 2018Lei Feng TV CMS (aka LFCMS) 3.8.6 allows admin.php?s=/Member/add.html CSRF.CVE-2018-20603 · Other software · Lfdycms · reported by MITREHigh 8.8
Lei Feng TV CMS (aka LFCMS) 3.8.6 allows admin.php?s=/Member/add.html CSRF.
- Product
- LEI Feng TV CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2018Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to delete the common_member_wechatmp data structure via an ac=unbindmp request to pluCVE-2018-20424 · Other software · Comsenz · reported by MITREMedium 5.9
Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to delete the common_member_wechatmp data structure via an ac=unbindmp request to plugin.php.
- Product
- Discuzx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2018Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass authentication by leveraging a non-empty #wechat#common_member_wechatmp to CVE-2018-20422 · Other software · Comsenz · reported by MITREHigh 8.1
Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass authentication by leveraging a non-empty #wechat#common_member_wechatmp to gain login access to an account via a plugin.php ac=wxregister request (the attacker does not have control over which account will be accessed).
- Product
- Discuzx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2018Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected intCVE-2018-20300 · Other software · Phome · reported by MITRECritical 9.8
Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected into a memberform.$fid.php file.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordp0desta.comp0desta.com
Dec 10, 2018PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI.CVE-2018-20012 · Websites & servers · Phpcmf · reported by MITREMedium 4.8
PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI.
- Product
- Phpcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2018server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team.CVE-2018-19621 · Other software · Showdoc · reported by MITREMedium 6.5
server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team.
- Product
- Showdoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2018In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECVE-2018-19350 · Other software · Seacms · reported by MITREMedium 5.4
In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2018S-CMS PHP 1.0 has SQL injection in member/member_news.php via the type parameter (aka the $N_type field).CVE-2018-18887 · Other software · S-cms · reported by MITRECritical 9.8
S-CMS PHP 1.0 has SQL injection in member/member_news.php via the type parameter (aka the $N_type field).
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Oct 29, 2018Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter.CVE-2018-18782 · Other software · Dedecms · reported by MITREMedium 6.1
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2018DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter.CVE-2018-18781 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2018Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter.CVE-2018-18579 · Other software · Dedecms · reported by MITREMedium 6.1
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2018s-cms 3.0 allows SQL Injection via the member/post.php 0_id parameter or the POST data to member/member_login.php.CVE-2018-18427 · Other software · S-cms · reported by MITRECritical 9.8
s-cms 3.0 allows SQL Injection via the member/post.php 0_id parameter or the POST data to member/member_login.php.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2018qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account.CVE-2018-18201 · Other software · Qibosoft · reported by MITREHigh 8.8
qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account.
- Product
- Qibosoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2018Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0CVE-2018-17866 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field.
- Fixed in
- 2.0.28
- What to do
- Update the plugin to 2.0.28 or newer.
Full record and what to do →NVD recordserhack.mewordpress.org
Oct 9, 2018Cross-site request forgery (CSRF) vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's CVE-2018-18191 · Other software · Finecms · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Sep 24, 2018This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members Fixed in version 2.4.25.CVE-2018-11614 · Computers, phones & browsers · Samsung · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members Fixed in version 2.4.25. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Intents. The issue lies in the ability to send an Intent that would not otherwise be reachable. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the application. Was ZDI-CAN-5361.
- Product
- Samsung Members
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Sep 17, 2018PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,CVE-2018-17130 · Websites & servers · Phpmywind · reported by MITREMedium 5.4
PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2018Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/useCVE-2018-16448 · Other software · Chshcms · reported by MITREHigh 8.8
Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save.
- Product
- Cscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2018phpkaiyuancms PhpOpenSourceCMS (POSCMS) V3.2.0 allows an unauthenticated user to execute arbitrary SQL commands via the diy/module/member/controllers/Api.php ajCVE-2018-16278 · Websites & servers · Phpkaiyuancms · reported by MITRECritical 9.8
phpkaiyuancms PhpOpenSourceCMS (POSCMS) V3.2.0 allows an unauthenticated user to execute arbitrary SQL commands via the diy/module/member/controllers/Api.php ajax_save_draft function with the dir parameter.
- Product
- Phpopensourcecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2018Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing oCVE-2018-15727 · Other software · Grafana · reported by MITRECritical 9.8
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Aug 23, 2018A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that CVE-2018-1999045 · Websites & servers · Jenkins · reported by MITREMedium 5.4
A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers with a valid cookie to remain logged in even if that feature is disabled.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2018A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote member to upload a .CVE-2018-14570 · Other software · Niushop · reported by MITREHigh 8.8
A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote member to upload a .php file to the web server via a profile avatar field, by using an image Content-Type (e.g., image/jpeg) with a modified filename and file content. This results in arbitrary code execution by requesting that .php file.
- Product
- B2b2c Multi-business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2018The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to stored cross-site scripting.CVE-2016-9493 · Websites & servers · PHP FormMail · reported by cret@cert.orgMedium 6.1
The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to stored cross-site scripting. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This list does not include all variations of PHP files, which may lead to execution of the contained PHP code if the attacker can guess the uploaded filename. The form by default appends a short random string to the end of the filename.
- Product
- Generator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comkb.cert.org
Jul 13, 2018The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to unrestricted upload of dangerous file types.CVE-2016-9492 · Websites & servers · PHP FormMail · reported by cret@cert.orgCritical 9.8
The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to unrestricted upload of dangerous file types. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This list does not include all variations of PHP files, which may lead to execution of the contained PHP code if the attacker can guess the uploaded filename. The form by default appends a short random string to the end of the filename.
- Product
- Generator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comkb.cert.org
Jul 12, 2018In waimai Super Cms 20150505, there is a CSRF vulnerability that can add an admin account via admin.php?m=Member&a=adminadd.CVE-2018-14014 · Other software · Super CMS Project · reported by MITREHigh 8.8
In waimai Super Cms 20150505, there is a CSRF vulnerability that can add an admin account via admin.php?m=Member&a=adminadd.
- Product
- Super CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2018The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen.CVE-2018-13136 · WordPress plugins & themes · reported by MITREMedium 6.1
The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen.
- Product
- Ultimate Member (aka ultimatemember)
- Fixed in
- 2.0.18
- What to do
- Update Ultimate Member (aka ultimatemember) to 2.0.18 or newer.
Jun 28, 2018remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM).CVE-2018-12934 · Other software · GNU · reported by MITREHigh 7.5
remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netgcc.gnu.org
Jun 22, 2018Reflected Cross-Site Scripting (XSS) exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywords= URI.CVE-2018-12656 · Other software · Slims Akasia Project · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywords= URI.
- Product
- Slims Akasia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2018The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and CVE-2018-11554 · Other software · Yzmcms · reported by MITRECritical 9.8
The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force approach.
- Product
- Yzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.