Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

1,914 results · page 29 of 39

Jul 30, 2019Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474).CVE-2019-14412 · Websites & servers · Cpanel · reported by MITRELow 3.3
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).CVE-2019-14411 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).CVE-2019-14410 · Websites & servers · Cpanel · reported by MITRELow 3.3
Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).CVE-2019-14409 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460).CVE-2019-14408 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415).CVE-2019-14407 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).CVE-2019-14406 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487).CVE-2019-14405 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484).CVE-2019-14404 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).CVE-2019-14403 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481).CVE-2019-14402 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480).CVE-2019-14401 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479).CVE-2019-14400 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477).CVE-2019-14399 · Websites & servers · Cpanel · reported by MITREHigh 7.1
The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498).CVE-2019-14398 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).CVE-2019-14397 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495).CVE-2019-14396 · Websites & servers · Cpanel · reported by MITRELow 3.3
API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).CVE-2019-14395 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489).CVE-2019-14394 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486).CVE-2019-14393 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467).CVE-2018-20870 · Websites & servers · Cpanel · reported by MITREMedium 5.5
The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465).CVE-2018-20869 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).CVE-2018-20868 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).CVE-2018-20866 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).CVE-2018-20865 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).CVE-2018-20864 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452).CVE-2018-20863 · Websites & servers · Cpanel · reported by MITRECritical 9.8
cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366).CVE-2018-20862 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501).CVE-2019-14392 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462).CVE-2018-20867 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).CVE-2019-14391 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).CVE-2019-14390 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510).CVE-2019-14389 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507).CVE-2019-14388 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).CVE-2019-14387 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).CVE-2019-14386 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 29, 2019Pterodactyl before 0.7.14 with 2FA allows credential sniffing.CVE-2019-1020002 · Other software · Pterodactyl · reported by josh@bress.netHigh 7.5
Pterodactyl before 0.7.14 with 2FA allows credential sniffing.
Product
Pterodactyl Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 26, 2019Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a new user at admin/includes/adminprocess.CVE-2019-14228 · Other software · Angry-frog · reported by MITREMedium 6.1
Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a new user at admin/includes/adminprocess.php. If there is an error when registering the user, the unsanitized username will reflect via the error page. Due to the lack of CSRF protection on the admin/includes/adminprocess.php endpoint, an attacker is able to chain the XSS with CSRF in order to cause remote exploitation.
Product
Xavier
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codecanyon.net m-q-t.github.io
Jul 26, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm_current_dir) allows attackers to steal a cookie or CVE-2019-13387 · Other software · Control-webpanel · reported by MITREMedium 6.1
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm_current_dir) allows attackers to steal a cookie or session, or redirect to a phishing website.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com centos-webpanel.com
Jul 26, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a shell command, i.e., obCVE-2019-13386 · Other software · Centos-webpanel · reported by MITREHigh 8.8
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a shell command, i.e., obtain a reverse shell with user privilege.
Product
Centos Web Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com centos-webpanel.com
Jul 26, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enumerate users and checCVE-2019-13385 · Other software · Control-webpanel · reported by MITREMedium 4.3
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enumerate users and check for active users of the application by reading /tmp/login.log.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com centos-webpanel.com
Jul 16, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, CVE-2019-13359 · Other software · Control-webpanel · reported by MITREHigh 7.5
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jul 16, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowCVE-2019-13605 · Other software · Control-webpanel · reported by MITREHigh 8.8
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid username. The attacker must defeat an encoding that is not equivalent to base64, and thus this is different from CVE-2019-13360.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jul 16, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP responsCVE-2019-13383 · Other software · Control-webpanel · reported by MITREMedium 5.3
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP response.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jul 16, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid CVE-2019-13360 · Other software · Control-webpanel · reported by MITRECritical 9.8
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid username.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jul 11, 2019In Rockwell Automation PanelView 5510 (all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or later), a remote, unauCVE-2019-10970 · Other software · Rockwellautomation · reported by ics-cert@hq.dhs.govCritical 9.8
In Rockwell Automation PanelView 5510 (all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or later), a remote, unauthenticated threat actor with access to an affected PanelView 5510 Graphic Display, upon successful exploit, may boot-up the terminal and gain root-level access to the device’s file system.
Product
Panelview 5510 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com us-cert.gov
Jul 11, 2019Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to injectCVE-2019-13029 · Other software · Vanderbilt · reported by MITREMedium 4.8
Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary malicious HTML or JavaScript code into a user's web browser.
Product
Redcap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jul 10, 2019CSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an attacker to submit POST requests to any forms in the web applicatioCVE-2019-13071 · Other software · Cyberpowersystems · reported by MITREHigh 8.8
CSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an attacker to submit POST requests to any forms in the web application. This can be exploited by tricking an authenticated user into visiting an attacker controlled web page.
Product
Powerpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jul 9, 2019A stored XSS vulnerability in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows a privileged attacker to embed malicious JavaScrCVE-2019-13070 · Other software · Cyberpowersystems · reported by MITREMedium 5.4
A stored XSS vulnerability in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows a privileged attacker to embed malicious JavaScript in the SNMP trap receivers form. Upon visiting the /agent/action_recipient Event Action/Recipient page, the embedded code will be executed in the browser of the victim.
Product
Powerpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cyberpowersystems.com exploit-db.com
Jul 2, 2019An issue was discovered in CyberPanel through 1.8.4.CVE-2019-13056 · Other software · Cyberpanel · reported by MITREHigh 8.8
An issue was discovered in CyberPanel through 1.8.4. On the user edit page, an attacker can edit the administrator's e-mail and password because of the lack of CSRF protection.
Product
Cyberpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com cyberpanel.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.