Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,146 results · page 27 of 43
Sep 23, 2019ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an str_ireplace operation.CVE-2019-16722 · Other software · Zzzcms · reported by MITRECritical 9.8
ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an str_ireplace operation.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Sep 13, 2019DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Free Antivirus Trial 16.0.R18 and earlier allows local useCVE-2019-3646 · Other software · McAfee, LLC · reported by trellixpsirt@trellix.comMedium 6.9
DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Free Antivirus Trial 16.0.R18 and earlier allows local users to execute arbitrary code via execution from a compromised folder placed by an attacker with administrator rights.
- Product
- McAfee Total Protection - Free Antivirus Trial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservice.mcafee.comservice.mcafee.com
Sep 12, 2019On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeateCVE-2019-14237 · Other software · NXP · reported by MITRECritical 9.8
On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeated by observing CPU registers and the effect of code/instruction execution.
- Product
- Kinetis Kv1x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2019On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection mCVE-2019-14236 · Other software · ST · reported by MITRECritical 9.8
On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated by observing CPU registers and the effect of code/instruction execution.
- Product
- Stm32l0 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2019Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack.CVE-2019-9488 · Other software · Trend Micro · reported by security@trendmicro.comMedium 4.9
Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager (DSM).
- Product
- Trend Micro Deep Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comsuccess.trendmicro.com
Sep 11, 2019The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remote attackers to bypass its protection viaCVE-2019-14998 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.5
The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remote attackers to bypass its protection via "cookie tossing" a CSRF cookie from a subdomain of a Jira instance.
- Product
- Jira
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comtalosintelligence.com
Sep 6, 2019Sentrifugo 3.2 lacks CSRF protection.CVE-2019-16059 · Network & remote access · Sapplica · reported by MITREHigh 8.8
Sentrifugo 3.2 lacks CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code at index.php/dashboard/viewprofile via a crafted HTML page.
- Product
- Sentrifugo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsevenlayers.comsevenlayers.com
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.CVE-2019-15826 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.
- Product
- wps-hide-login
- Fixed in
- 1.5.3
- What to do
- Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD recordsecupress.mewordpress.org
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.CVE-2019-15825 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.
- Product
- wps-hide-login
- Fixed in
- 1.5.3
- What to do
- Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD recordsecupress.mewordpress.org
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.CVE-2019-15824 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.
- Product
- wps-hide-login
- Fixed in
- 1.5.3
- What to do
- Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD recordsecupress.mewordpress.org
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.CVE-2019-15823 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.
- Product
- wps-hide-login
- Fixed in
- 1.5.3
- What to do
- Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD recordsecupress.mewordpress.org
Aug 30, 2019The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.CVE-2019-15821 · WordPress plugins & themes · reported by MITREHigh 7.5
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
- Product
- bold-page-builder
- Fixed in
- 2.3.2
- What to do
- Update bold-page-builder to 2.3.2 or newer.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Aug 30, 2019The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.CVE-2019-15816 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.
- Product
- wp-private-content-plus
- Fixed in
- 2.0
- What to do
- Update wp-private-content-plus to 2.0 or newer.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Aug 29, 2019The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.CVE-2019-15776 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.
- Product
- simple-301-redirects-addon-bulk-uploader
- Fixed in
- 1.2.5
- What to do
- Update simple-301-redirects-addon-bulk-uploader to 1.2.5 or newer.
Full record and what to do →NVD recordthreatpost.comwordpress.org
Aug 28, 2019MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack.CVE-2019-15496 · Other software · Manageyourteam · reported by MITREHigh 8.8
MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page.
- Product
- MYT Project Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsevenlayers.comsevenlayers.com
Aug 23, 2019Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply removes one ../ substring.CVE-2019-15516 · Other software · Cuberite · reported by MITREHigh 7.5
Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply removes one ../ substring.
- Product
- Cuberite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2019The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.CVE-2016-10929 · WordPress plugins & themes · reported by MITREMedium 5.3
The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.
- Product
- advanced-ajax-page-loader
- Fixed in
- 2.7.7
- What to do
- Update advanced-ajax-page-loader to 2.7.7 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.CVE-2019-15330 · WordPress plugins & themes · reported by MITREHigh 7.5
The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.
- Product
- webp-express
- Fixed in
- 0.14.11
- What to do
- Update webp-express to 0.14.11 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 18, 2019core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child.CVE-2019-15149 · Other software · Networkgenomics · reported by MITRECritical 9.8
core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. The Ansible extension is unaffected. NOTE: the vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors, i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led to reliance on this extra protection mechanism
- Product
- Mitogen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commitogen.networkgenomics.com
Aug 15, 2019In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not takenCVE-2019-13516 · Other software · Osisoft · reported by ics-cert@hq.dhs.govHigh 8.8
In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not taken effect.
- Product
- PI Web API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Aug 14, 2019An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.CVE-2019-1161 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations. To exploit the vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted command that could exploit the vulnerability and delete protected files on an affected system once MpSigStub.exe ran again. The update addresses the vulnerability and blocks the arbitrary deletion.
- Product
- Microsoft Forefront Endpoint Protection 2010
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Aug 14, 2019The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors CVE-2019-15053 · Websites & servers · Atlassian · reported by MITREMedium 6.8
The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element.
- Product
- Html Include And Replace Macro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commarketplace.atlassian.com
Aug 14, 2019The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.CVE-2017-18513 · WordPress plugins & themes · reported by MITREHigh 8.8
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.
- Product
- responsive-menu
- Fixed in
- 3.1.4
- What to do
- Update responsive-menu to 3.1.4 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 12, 2019The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the autCVE-2019-14951 · Other software · Telenav · reported by MITREHigh 7.5
The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the authentication process, which makes it easier for attackers to obtain multimedia-screen access via port 7050 on the cellular network, as demonstrated by a DrivingRestriction method call to uma/jsonrpc/mobile.
- Product
- Scout GPS Link
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsites.google.comsites.google.com
Aug 5, 2019cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224).CVE-2017-18462 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Jul 31, 2019Symantec Endpoint Protection, prior to 14.2 RU1 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition, prior to 12.1 RU6 MP10c (12.1.7491.7002CVE-2019-12750 · Other software · Symantec · reported by secure@symantec.comHigh 7.8
Symantec Endpoint Protection, prior to 14.2 RU1 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition, prior to 12.1 RU6 MP10c (12.1.7491.7002), may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
- Product
- Endpoint Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 30, 2019Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process.CVE-2019-5455 · Other software · Nextcloud · reported by support@hackerone.comMedium 6.8
Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process.
- Product
- com.nextcloud.client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Jul 30, 2019Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to CVE-2019-5453 · Other software · Nextcloud · reported by support@hackerone.comMedium 6.1
Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to the Nextcloud file provider.
- Product
- com.nextcloud.client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Jul 30, 2019Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although thCVE-2019-5452 · Other software · Nextcloud · reported by support@hackerone.comLow 2.4
Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although the lock protection was not solved.
- Product
- Nextcloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Jul 30, 2019Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing the app in a very shorCVE-2019-5451 · Other software · Nextcloud · reported by support@hackerone.comMedium 4.6
Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing the app in a very short time.
- Product
- Nextcloud Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Jul 25, 2019Authentication protection bypass vulnerability in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows physical local user to bypass the WCVE-2019-3621 · Other software · McAfee, LLC · reported by trellixpsirt@trellix.comMedium 6.8
Authentication protection bypass vulnerability in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows physical local user to bypass the Windows lock screen via DLPe processes being killed just prior to the screen being locked or when the screen is locked. The attacker requires physical access to the machine.
- Product
- Data Loss Prevention (DLPe) for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comkc.mcafee.com
Jul 25, 2019Protection is missing while accessing md sessions info via macro which can lead to use-after-free in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOCVE-2019-2298 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Protection is missing while accessing md sessions info via macro which can lead to use-after-free in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, QCS405, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SD 855, SDM660, SDX20, SDX24
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jul 25, 2019Buffer overflow occurs when emulated RPMB is used due to sector size assumptions in the TA rollback protection logic.CVE-2019-2235 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Buffer overflow occurs when emulated RPMB is used due to sector size assumptions in the TA rollback protection logic. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in MDM9206, MDM9607, MDM9650, MDM9655, MSM8996AU, QCS404, QCS605, Qualcomm 215, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jul 23, 2019When an inner window is reused, it does not consider the use of document.domain for cross-origin protections.CVE-2019-11711 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did not use document.domain to relax their origin security. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jul 18, 2019SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change.CVE-2019-13949 · Other software · Syguestbook A5 Project · reported by MITREHigh 8.8
SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change.
- Product
- Syguestbook A5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfragrant10.github.iogithub.com
Jul 17, 2019CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.CVE-2019-10353 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Jul 14, 2019In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CCVE-2019-13594 · Other software · Mirumee · reported by MITREHigh 8.8
In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server.
- Product
- Saleor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2019There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones.CVE-2019-5220 · Other software · Huawei · reported by psirt@huawei.comMedium 4.6
There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones. The system does not sufficiently verify the permission, an attacker could do a certain operation on certain step of setup wizard. Successful exploit could allow the attacker bypass the FRP protection. Affected products: Mate 20 X, versions earlier than Ever-AL00B 9.0.0.200(C00E200R2P1); Mate 20, versions earlier than Hima-AL00B/Hima-TL00B 9.0.0.200(C00E200R2P1); Honor Magic 2, versions earlier than Tony-AL00B/Tony-TL00B 9.0.0.182(C00E180R2P2).
- Product
- Mate 20 X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2019In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly and it was possible tCVE-2019-12923 · Other software · Mailenable · reported by MITREMedium 6.5
In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. This could allow an attacker to manipulate a user into unwittingly performing actions within the application (such as sending email, adding contacts, or changing settings) on behalf of the attacker.
- Product
- Mailenable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmailenable.comnccgroup.trust
Jul 5, 2019A vulnerability in Cisco Advanced Malware Protection (AMP) for Endpoints for Windows could allow an authenticated, local attacker with administrator privileges CVE-2019-1932 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.7
A vulnerability in Cisco Advanced Malware Protection (AMP) for Endpoints for Windows could allow an authenticated, local attacker with administrator privileges to execute arbitrary code. The vulnerability is due to insufficient validation of dynamically loaded modules. An attacker could exploit this vulnerability by placing a file in a specific location in the Windows filesystem. A successful exploit could allow the attacker to execute the code with the privileges of the AMP service.
- Product
- Cisco AMP for Endpoints
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Jun 27, 2019Application protection bypass vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows unauthenticated user to imperCVE-2019-3629 · Other software · McAfee, LLC · reported by trellixpsirt@trellix.comMedium 6.5
Application protection bypass vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows unauthenticated user to impersonate system users via specially crafted parameters.
- Product
- McAfee Enterprise Security Manager (ESM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkc.mcafee.comkc.mcafee.com
Jun 19, 2019In resetPasswordInternal of DevicePolicyManagerService.java, there is a possible bypass of password reset protection due to an unusual root cause.CVE-2019-2018 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.8
In resetPasswordInternal of DevicePolicyManagerService.java, there is a possible bypass of password reset protection due to an unusual root cause. Remote user interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9Android ID: A-110172241
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 13, 2019Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via localCVE-2019-11092 · Other software · Intel · reported by secure@intel.comMedium 4.4
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Open Cloud Integrity Tehnology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2019Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via localCVE-2019-0183 · Other software · Intel · reported by secure@intel.comLow 3.3
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Open Cloud Integrity Tehnology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2019Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via localCVE-2019-0182 · Other software · Intel · reported by secure@intel.comLow 3.3
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Open Cloud Integrity Tehnology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2019Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via localCVE-2019-0181 · Other software · Intel · reported by secure@intel.comMedium 6.7
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Open Cloud Integrity Tehnology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2019Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via localCVE-2019-0180 · Other software · Intel · reported by secure@intel.comMedium 4.4
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Open Cloud Integrity Tehnology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2019Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via localCVE-2019-0179 · Other software · Intel · reported by secure@intel.comMedium 4.4
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Open Cloud Integrity Tehnology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2019Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via localCVE-2019-0178 · Other software · Intel · reported by secure@intel.comLow 3.6
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Open Cloud Integrity Tehnology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2019Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via localCVE-2019-0177 · Other software · Intel · reported by secure@intel.comMedium 4.4
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Open Cloud Integrity Tehnology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.