Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,712 results · page 26 of 35
Sep 13, 2021StopBadBots: Did not validate or escape the order and orderby GET parameter in some of its admin dashboard pagesCVE-2021-24727 · WordPress plugins & themes · reported by WPScanHigh 8.8
The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Authenticated SQL Injections
- Product
- StopBadBots
- Fixed in
- 6.60
- What to do
- Update StopBadBots to 6.60 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Sep 10, 2021Border Loading Bar: Reflected Cross-Site ScriptingCVE-2021-38338 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `f` and `t` parameter found in the ~/titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.
- Product
- Border Loading Bar
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Border Loading Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 7, 2021The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle an out-of-order LMP Setup procedure that is followed by CVE-2021-31611 · Other software · Zh-jieli · reported by MITREMedium 5.7
The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle an out-of-order LMP Setup procedure that is followed by a malformed LMP packet, allowing attackers in radio range to deadlock a device via a crafted LMP packet. The user needs to manually reboot the device to restore communication.
- Product
- Ac6901 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzh-jieli.comdl.packetstormsecurity.net
Sep 6, 2021SMS Alert Order Notifications: Is affected by a cross site scripting (XSS) vulnerability in the plugin's setting pageCVE-2021-24588 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting (XSS) vulnerability in the plugin's setting page.
- Product
- SMS Alert Order Notifications
- Fixed in
- 3.4.7
- What to do
- Update SMS Alert Order Notifications to 3.4.7 or newer.
Sep 1, 2021Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mCVE-2021-36012 · Websites & servers · Adobe · reported by AdobeMedium 6.5
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.
- Product
- Magento Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Aug 27, 2021long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domain may create to mapCVE-2021-28698 · Other software · Xen · reported by security@xen.orgMedium 5.5
long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domain may create to map grants offered by other domains. In the process of carrying out certain actions, Xen would iterate over all such entries, including ones which aren't in use anymore and some which may have been created but never used. If the number of entries for a given domain is large enough, this iterating of the entire table may tie up a CPU for too long, starving other domains or causing issues in the hypervisor itself. Note that a domain may map its own grants, i.e. there is no need for multiple domains to be involved here. A pair of "cooperating" guests may, however, cause the effects to be more severe.
- Product
- xen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.fedoraproject.org
Aug 25, 2021A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders[] parameter.CVE-2020-19821 · Other software · Wdoyo · reported by MITREHigh 8.8
A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders[] parameter.
- Product
- Doyocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2021In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt().CVE-2021-3711 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgCritical 9.8
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The locatio
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comcert-portal.siemens.com
Aug 20, 2021SQL Injection in Wuzhi CMS v4.1.0 allows remote attackers to obtain sensitive information via the 'flag' parameter in the component '/coreframe/app/order/admin/CVE-2020-18877 · Other software · Wuzhicms · reported by MITREHigh 7.5
SQL Injection in Wuzhi CMS v4.1.0 allows remote attackers to obtain sensitive information via the 'flag' parameter in the component '/coreframe/app/order/admin/index.php'.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2021Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.CVE-2021-39286 · Other software · Webrecorder · reported by MITREMedium 6.1
Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.
- Product
- Pywb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2021Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection.CVE-2021-29984 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection. This led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
Aug 16, 2021Video Posts Webcam Recorder: Has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videosCVE-2021-24512 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videos.
- Product
- Video Posts Webcam Recorder
- Fixed in
- 3.2.4
- What to do
- Update Video Posts Webcam Recorder to 3.2.4 or newer.
Aug 8, 2021fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows operators of remote NFSv4 servers to cause a denial CVE-2021-38199 · Computers, phones & browsers · Linux · reported by MITREMedium 6.5
fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows operators of remote NFSv4 servers to cause a denial of service (hanging of mounts) by arranging for those servers to be unreachable during trunking detection.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn.kernel.orggithub.com
Aug 2, 2021get_reports() function in the Secure Copy Content Protection and Content Locking: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24484 · WordPress plugins & themes · reported by WPScanHigh 7.2
The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_reports() function in the Secure Copy Content Protection and Content Locking
- Fixed in
- 2.6.7
- What to do
- Update get_reports() function in the Secure Copy Content Protection and Content Locking to 2.6.7 or newer.
Aug 2, 2021get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24483 · WordPress plugins & themes · reported by WPScanHigh 7.2
The get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker
- Fixed in
- 3.2.1
- What to do
- Update get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker to 3.2.1 or newer.
Aug 2, 2021get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24463 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin before 2.5.0 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel
- Fixed in
- 2.5.0
- What to do
- Update get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel to 2.5.0 or newer.
Aug 2, 2021get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_rCVE-2021-24462 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery WordPress plugin before 4.4.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery
- Fixed in
- 4.4.4
- What to do
- Update get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery to 4.4.4 or newer.
Aug 2, 2021get_faqs() function in the FAQ Builder AYS: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24461 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_faqs() function in the FAQ Builder AYS
- Fixed in
- 1.3.6
- What to do
- Update get_faqs() function in the FAQ Builder AYS to 1.3.6 or newer.
Aug 2, 2021get_fb_likeboxes() function in the Popup Like box – Page: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24460 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_fb_likeboxes() function in the Popup Like box – Page
- Fixed in
- 3.5.3
- What to do
- Update get_fb_likeboxes() function in the Popup Like box – Page to 3.5.3 or newer.
Aug 2, 2021get_results() and get_items() functions in the Survey Maker: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24459 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_results() and get_items() functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_results() and get_items() functions in the Survey Maker
- Fixed in
- 1.5.6
- What to do
- Update get_results() and get_items() functions in the Survey Maker to 1.5.6 or newer.
Aug 2, 2021get_ays_popupboxes() and get_popup_categories() functions of the Popup box: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24458 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_ays_popupboxes() and get_popup_categories() functions of the Popup box
- Fixed in
- 2.3.4
- What to do
- Update get_ays_popupboxes() and get_popup_categories() functions of the Popup box to 2.3.4 or newer.
Aug 2, 2021Quiz Maker: Did not properly sanitise and escape the order and orderby parameters before using them in SQL statementsCVE-2021-24456 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard
- Product
- Quiz Maker
- Fixed in
- 6.2.0.9
- What to do
- Update Quiz Maker to 6.2.0.9 or newer.
Jul 26, 2021In NavigateCMS version 2.9.4 and below, function `block` is vulnerable to sql injection on parameter `block-order`, which results in arbitrary sql query executiCVE-2021-37478 · Other software · Naviwebs · reported by MITRECritical 9.8
In NavigateCMS version 2.9.4 and below, function `block` is vulnerable to sql injection on parameter `block-order`, which results in arbitrary sql query execution in the backend database.
- Product
- Navigatecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2021In NavigateCMS version 2.9.4 and below, function in `structure.php` is vulnerable to sql injection on parameter `children_order`, which results in arbitrary sqlCVE-2021-37477 · Other software · Naviwebs · reported by MITRECritical 9.8
In NavigateCMS version 2.9.4 and below, function in `structure.php` is vulnerable to sql injection on parameter `children_order`, which results in arbitrary sql query execution in the backend database.
- Product
- Navigatecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2021In NavigateCMS version 2.9.4 and below, function in `templates.php` is vulnerable to sql injection on parameter `template-properties-order`, which results in arCVE-2021-37475 · Other software · Naviwebs · reported by MITRECritical 9.8
In NavigateCMS version 2.9.4 and below, function in `templates.php` is vulnerable to sql injection on parameter `template-properties-order`, which results in arbitrary sql query execution in the backend database.
- Product
- Navigatecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2021In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter `products-order` through a post request, which resCVE-2021-37473 · Other software · Naviwebs · reported by MITRECritical 9.8
In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter `products-order` through a post request, which results in arbitrary sql query execution in the backend database.
- Product
- Navigatecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2021IBM i2 iBase 8.9.13 could allow a local authenticated attacker to execute arbitrary code on the system, caused by a DLL search order hijacking flaw.CVE-2020-4623 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM i2 iBase 8.9.13 could allow a local authenticated attacker to execute arbitrary code on the system, caused by a DLL search order hijacking flaw. By using a specially-crafted .DLL file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 184984.
- Product
- i2 iBase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 16, 2021A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8.CVE-2021-36769 · Other software · Telegram · reported by MITREMedium 5.3
A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attacker can cause the server to receive messages in a different order than they were sent a client.
- Product
- Telegram
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmtpsym.github.iomtpsym.github.io
Jul 2, 2021Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.CVE-2021-35042 · Other software · Djangoproject · reported by MITRECritical 9.8
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgroups.google.com
Jun 15, 2021LaikeTui 3.5.0 allows remote authenticated users to delete arbitrary files, as demonstrated by deleting install.lock in order to reinstall the product in an attCVE-2021-34129 · Other software · Laiketui · reported by MITREHigh 8.1
LaikeTui 3.5.0 allows remote authenticated users to delete arbitrary files, as demonstrated by deleting install.lock in order to reinstall the product in an attacker-controlled manner. This deletion is possible via directory traversal in the uploadImg, oldpic, or imgurl parameter.
- Product
- Laiketui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2021Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vCVE-2020-13688 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.1
Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.
- Product
- Drupal Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2021In LabCup before <v2_next_18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, aftCVE-2021-33031 · Other software · Labcup · reported by MITRELow 3.1
In LabCup before <v2_next_18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, after successful exploitation, gain access to a victim's account. A user without the user-management privilege can change another user's email address if the attacker knows details of the victim such as the exact roles and group roles, ID, and remote authentication ID settings. These must be sent in a modified save API request. It was fixed in 6.3.0.03.
- Product
- Labcup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2021In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network accessCVE-2021-33190 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limit. At the same time, the default account and password are fixed.Ultimately these factors lead to the issue of security risks. This issue is fixed in APISIX Dashboard 2.6.1
- Product
- Apache APISIX Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Jun 4, 2021A vulnerability in the installer software of Cisco ThousandEyes Recorder could allow an unauthenticated, local attacker to access sensitive information that is CVE-2021-1537 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.2
A vulnerability in the installer software of Cisco ThousandEyes Recorder could allow an unauthenticated, local attacker to access sensitive information that is contained in the ThousandEyes Recorder installer software. This vulnerability exists because sensitive information is included in the application installer. An attacker could exploit this vulnerability by downloading the installer and extracting its contents. A successful exploit could allow the attacker to access sensitive information that is included in the application installer.
- Product
- Cisco ThousandEyes Recorder Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 27, 2021A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_fieldorder.c, which might lead to memory corruption and other CVE-2020-22022 · Other software · Ffmpeg · reported by MITREHigh 8.8
A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_fieldorder.c, which might lead to memory corruption and other potential consequences.
- Product
- Ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgtrac.ffmpeg.org
May 13, 2021Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.CVE-2021-32615 · Other software · Piwigo · reported by MITRECritical 9.8
Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2021A command injection vulnerability in Avaya Session Border Controller for Enterprise could allow an authenticated, remote attacker to send specially crafted messCVE-2020-7034 · Other software · Avaya · reported by securityalerts@avaya.comHigh 7.2
A command injection vulnerability in Avaya Session Border Controller for Enterprise could allow an authenticated, remote attacker to send specially crafted messages and execute arbitrary commands with the affected system privileges. Affected versions of Avaya Session Border Controller for Enterprise include 7.x, 8.0 through 8.1.1.x
- Product
- Session Border Controller for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloads.avaya.comdownloads.avaya.com
Apr 14, 2021In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Service Repository JAVA MCVE-2021-27604 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Service Repository JAVA Mappings), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, SAP recommends to refer this note.
- Product
- SAP Process Integration (Enterprise Service Repository JAVA Mappings)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Apr 12, 2021In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcodCVE-2021-24226 · WordPress plugins & themes · reported by WPScanHigh 7.5
In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcode is dumping serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, no login or administrator role is required.
- Product
- AccessAlly
- Fixed in
- 3.5.7
- What to do
- Update AccessAlly to 3.5.7 or newer.
Apr 5, 2021This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data.CVE-2021-24169 · WordPress plugins & themes · reported by WPScanMedium 6.1
This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS.
- Fixed in
- 3.1.8
- What to do
- Update the plugin to 3.1.8 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 1, 2021An issue was discovered in the reorder crate through 2021-02-24 for Rust.CVE-2021-29942 · Other software · Reorder Project · reported by MITREHigh 7.3
An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index can return uninitialized values if an iterator returns a len() that is too large.
- Product
- Reorder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Apr 1, 2021An issue was discovered in the reorder crate through 2021-02-24 for Rust.CVE-2021-29941 · Other software · Reorder Project · reported by MITREHigh 7.3
An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index has an out-of-bounds write if an iterator returns a len() that is too small.
- Product
- Reorder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Mar 31, 2021Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727.CVE-2021-27349 · WordPress plugins & themes · reported by MITREMedium 6.1
Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727.
- Fixed in
- 3.1.8
- What to do
- Update the plugin to 3.1.8 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Mar 30, 2021Buffer overflow vulnerability in sniff_channel_order function in aacdec_template.c in ffmpeg 3.1.2, allows attackers to execute arbitrary code (local).CVE-2020-24995 · Other software · Ffmpeg · reported by MITREHigh 7.8
Buffer overflow vulnerability in sniff_channel_order function in aacdec_template.c in ffmpeg 3.1.2, allows attackers to execute arbitrary code (local).
- Product
- Ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.videolan.orgtrac.ffmpeg.org
Mar 18, 2021The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve all databaseCVE-2021-28419 · Other software · Seopanel · reported by MITREHigh 7.2
The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve all databases.
- Product
- SEO Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 16, 2021Online Ordering System 1.0 is vulnerable to unauthenticated SQL injection through /onlineordering/GPST/admin/design.php, which may lead to database information CVE-2021-28295 · Other software · Online Ordering System Project · reported by MITREHigh 7.5
Online Ordering System 1.0 is vulnerable to unauthenticated SQL injection through /onlineordering/GPST/admin/design.php, which may lead to database information disclosure.
- Product
- Online Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Mar 16, 2021Online Ordering System 1.0 is vulnerable to arbitrary file upload through /onlineordering/GPST/store/initiateorder.php, which may lead to remote code execution CVE-2021-28294 · Other software · Online Ordering System Project · reported by MITRECritical 9.8
Online Ordering System 1.0 is vulnerable to arbitrary file upload through /onlineordering/GPST/store/initiateorder.php, which may lead to remote code execution (RCE).
- Product
- Online Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Mar 11, 2021Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c.CVE-2020-36278 · Other software · Leptonica · reported by MITREHigh 7.5
Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c.
- Product
- Leptonica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orggithub.com
Mar 5, 2021jpeg-xl v0.3.2 is affected by a heap buffer overflow in /lib/jxl/coeff_order.cc ReadPermutation.CVE-2021-28026 · Other software · Jpeg · reported by MITREHigh 7.8
jpeg-xl v0.3.2 is affected by a heap buffer overflow in /lib/jxl/coeff_order.cc ReadPermutation. When decoding a malicous jxl file using djxl, an attacker can trigger arbitrary code execution or a denial of service.
- Product
- Jpeg-xl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2021A vulnerability with the Border Gateway Protocol (BGP) for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow CVE-2021-1230 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability with the Border Gateway Protocol (BGP) for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an unauthenticated, remote attacker to cause a routing process to crash, which could lead to a denial of service (DoS) condition. This vulnerability is due to an issue with the installation of routes upon receipt of a BGP update. An attacker could exploit this vulnerability by sending a crafted BGP update to an affected device. A successful exploit could allow the attacker to cause the routing process to crash, which could cause the device to reload. This vulnerability applies to both Internal BGP (IBGP) and External BGP (EBGP). Note: The Cisco implementation of BGP accepts incoming BGP traffic from explicitly configured peers only. To exploit this vulnerability, an attacker would need to send a specific BGP update message over an established TCP connection that appears to come from a trusted BGP peer.
- Product
- Cisco NX-OS System Software in ACI Mode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.