Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
658 results · page 3 of 14
Jul 1, 2022TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_0041880c.CVE-2022-32046 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_0041880c.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00413be4.CVE-2022-32045 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00413be4.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the password parameter in the function FUN_00413f80.CVE-2022-32044 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the password parameter in the function FUN_00413f80.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022MERCURY MIPC451-4 1.0.22 Build 220105 Rel.55642n was discovered to contain a remote code execution (RCE) vulnerability which is exploitable via a crafted POST rCVE-2022-31849 · Other software · Mercurycom · reported by MITREHigh 8.8
MERCURY MIPC451-4 1.0.22 Build 220105 Rel.55642n was discovered to contain a remote code execution (RCE) vulnerability which is exploitable via a crafted POST request.
- Product
- Mipc451-4 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading to stack-based buffeCVE-2022-25949 · Other software · KINGSOFT JAPAN, INC. · reported by vultures@jpcert.or.jpHigh 7.8
The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading to stack-based buffer overflow.
- Product
- KINGSOFT Internet Security 9 Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsupport.kingsoft.jp
Mar 15, 2022Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCfgCVE-2022-27005 · Other software · totolink · reported by MITRECritical 9.8
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- x5000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6iCVE-2022-27004 · Other software · totolink · reported by MITRECritical 9.8
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6in4 function via the remote6in4 parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- x5000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6rCVE-2022-27003 · Other software · totolink · reported by MITRECritical 9.8
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6rd function via the relay6rd parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- x5000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022TOTOLink A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection vulnerability in the "Main" function.CVE-2022-25083 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLink A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
- Product
- A860r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022TOTOLink A810R V4.1.2cu.5182_B20201026 was discovered to contain a command injection vulnerability in the "Main" function.CVE-2022-25079 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLink A810R V4.1.2cu.5182_B20201026 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
- Product
- A810r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2021VMware Workspace one UEM console (2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior to 20.10.0.16,2008 prior to 20.8.0.28, 2CVE-2021-21990 · Other software · VMware · reported by security@vmware.comMedium 6.1
VMware Workspace one UEM console (2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior to 20.10.0.16,2008 prior to 20.8.0.28, 2007 prior to 20.7.0.14,2006 prior to 20.6.0.19, 2005 prior to 20.5.0.46, 2004 prior to 20.4.0.21, 2003 prior to 20.3.0.23, 2001 prior to 20.1.0.32, 1912 prior to 19.12.0.24) contain a cross-site scripting vulnerability. VMware Workspace ONE UEM console does not validate incoming requests during device enrollment after leading to rendering of unsanitized input on the user device in response.
- Product
- Workspace ONE Unified Endpoint Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.devmware.com
Mar 11, 2021Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2021-27076 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
- Product
- Microsoft Business Productivity Servers 2010 Service Pack 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Microsoft SharePoint Server Tampering VulnerabilityCVE-2021-1718 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8
Microsoft SharePoint Server Tampering Vulnerability
- Product
- Microsoft SharePoint Foundation 2010 Service Pack 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Dec 9, 2020Microsoft Excel Remote Code Execution VulnerabilityCVE-2020-17127 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Excel 2010 Service Pack 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Dec 9, 2020Microsoft Excel Remote Code Execution VulnerabilityCVE-2020-17122 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2010 Service Pack 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 11, 2020Microsoft Excel Remote Code Execution VulnerabilityCVE-2020-17066 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Excel 2010 Service Pack 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Nov 11, 2020Microsoft Excel Remote Code Execution VulnerabilityCVE-2020-17019 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2010 Service Pack 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Nov 8, 2020tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slave_mac parameter.CVE-2020-28347 · Network & remote access · Tp-link · reported by MITRECritical 9.8
tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slave_mac parameter. NOTE: this issue exists because of an incomplete fix for CVE-2020-10882 in which shell quotes are mishandled.
- Product
- Ac1750 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2020An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022.CVE-2020-27678 · Other software · Illumos · reported by MITRECritical 9.8
An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There is a buffer overflow in parse_user_name in lib/libpam/pam_framework.c.
- Product
- Illumos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2020This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008.CVE-2020-7750 · Other software · MIT · reported by report@snyk.ioCritical 9.6
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
- Product
- Scratch-svg-renderer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2020A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.CVE-2020-1504 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Excel. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force
- Product
- Microsoft Excel 2010 Service Pack 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Aug 17, 2020A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.CVE-2020-1495 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Excel. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force
- Product
- Microsoft SharePoint Server 2010 Service Pack 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 14, 2020SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacCVE-2020-6219 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacker with basic authorization to perform deserialization attack in the application, leading to service interruptions and denial of service and unauthorized execution of arbitrary commands, leading to Deserialization of Untrusted Data.
- Product
- SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Mar 19, 2020In ONAP OOM through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full accesCVE-2019-12127 · Other software · Onap · reported by MITRECritical 9.8
In ONAP OOM through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager (OOM) setups are affected.
- Product
- Open Network Automation Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.onap.orgjira.onap.org
Mar 19, 2020In ONAP DCAE through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full acceCVE-2019-12126 · Other software · Onap · reported by MITRECritical 9.8
In ONAP DCAE through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager (OOM) setups are affected.
- Product
- Open Network Automation Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.onap.orgjira.onap.org
Mar 19, 2020In ONAP Logging through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full aCVE-2019-12125 · Other software · Onap · reported by MITRECritical 9.8
In ONAP Logging through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager (OOM) setups are affected.
- Product
- Open Network Automation Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.onap.orgjira.onap.org
Mar 19, 2020In ONAP CLI through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full accesCVE-2019-12130 · Other software · Onap · reported by MITRECritical 9.8
In ONAP CLI through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager (OOM) setups are affected.
- Product
- Open Network Automation Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.onap.orgjira.onap.org
Mar 19, 2020In ONAP MSB through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full accesCVE-2019-12129 · Other software · Onap · reported by MITRECritical 9.8
In ONAP MSB through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager (OOM) setups are affected.
- Product
- Open Network Automation Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.onap.orgjira.onap.org
Mar 19, 2020In ONAP SO through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full accessCVE-2019-12128 · Other software · Onap · reported by MITRECritical 9.8
In ONAP SO through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager (OOM) setups are affected.
- Product
- Open Network Automation Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.onap.orgjira.onap.org
Feb 7, 2020statusnet through 2010 allows attackers to spoof syslog messages via newline injection attacks.CVE-2010-4658 · Other software · statusnet · reported by Red HatMedium 5.3
statusnet through 2010 allows attackers to spoof syslog messages via newline injection attacks.
- Product
- statusnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-tracker.debian.orgopenwall.com
Jan 8, 2020Imperva SecureSphere Web Application Firewall (WAF) before 12-august-2010 allows SQL injection filter bypass.CVE-2011-5266 · Other software · Imperva · reported by MITRECritical 9.8
Imperva SecureSphere Web Application Firewall (WAF) before 12-august-2010 allows SQL injection filter bypass.
- Product
- Securesphere Web Application Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jan 7, 2020AultWare pwStore 2010.8.30.0 has XSSCVE-2013-5658 · Other software · Aultware · reported by MITREMedium 6.1
AultWare pwStore 2010.8.30.0 has XSS
- Product
- Pwstore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrealpentesting.blogspot.com.esseclists.org
Jan 7, 2020AultWare pwStore 2010.8.30.0 has DoS via an empty HTTP requestCVE-2013-5657 · Other software · Aultware · reported by MITREHigh 7.5
AultWare pwStore 2010.8.30.0 has DoS via an empty HTTP request
- Product
- Pwstore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrealpentesting.blogspot.com.esseclists.org
Nov 20, 2019Cross-site scripting (XSS) vulnerability in statusnet through 2010 in error message contents.CVE-2010-4659 · Other software · statusnet · reported by Red HatMedium 6.1
Cross-site scripting (XSS) vulnerability in statusnet through 2010 in error message contents.
- Product
- statusnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comsecurity-tracker.debian.org
Nov 20, 2019Unspecified vulnerability in statusnet through 2010 due to the way addslashes are used in SQL string escapes..CVE-2010-4660 · Other software · statusnet · reported by Red HatCritical 9.8
Unspecified vulnerability in statusnet through 2010 due to the way addslashes are used in SQL string escapes..
- Product
- statusnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-tracker.debian.orgopenwall.com
Oct 30, 2019A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web script or HTML via a comment.CVE-2010-1673 · Other software · Ikiwiki · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web script or HTML via a comment.
- Product
- Ikiwiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordikiwiki.infosecurity-tracker.debian.org
Oct 23, 2019Adobe Acrobat and Reader versions 2019.010.20100 and earlier; 2019.010.20099 and earlier versions; 2017.011.30140 and earlier version; 2017.011.30138 and earlieCVE-2019-8238 · Email & office · Adobe · reported by AdobeHigh 7.5
Adobe Acrobat and Reader versions 2019.010.20100 and earlier; 2019.010.20099 and earlier versions; 2017.011.30140 and earlier version; 2017.011.30138 and earlier version; 2015.006.30495 and earlier versions; 2015.006.30493 and earlier versions have a Path Traversal vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
- Product
- Acrobat DC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Oct 10, 2019A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions < SP3 Update 1).CVE-2019-13921 · Other software · Siemens AG · reported by productcert@siemens.comHigh 7.5
A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions < SP3 Update 1). Affected versions of the software contain a vulnerability that could allow an unauthenticated attacker to trigger a denial-of-service condition. The vulnerability can be triggered if a large HTTP request is sent to the executing service. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the service provided by the software.
- Product
- SIMATIC WinAC RTX (F) 2010
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Sep 30, 2019Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter.CVE-2019-15810 · Other software · Netdisco · reported by MITREMedium 6.1
Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter.
- Product
- Netdisco
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2019An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.CVE-2019-1161 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations. To exploit the vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted command that could exploit the vulnerability and delete protected files on an affected system once MpSigStub.exe ran again. The update addresses the vulnerability and blocks the arbitrary deletion.
- Product
- Microsoft Forefront Endpoint Protection 2010
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jul 24, 2019Philips Holter 2010 Plus, all versions.CVE-2019-10968 · Other software · Philips · reported by ics-cert@hq.dhs.govMedium 4.4
Philips Holter 2010 Plus, all versions. A vulnerability has been identified that may allow system options that were not purchased to be enabled.
- Product
- Philips Holter 2010 Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Jun 12, 2019A denial of service vulnerability exists in Skype for Business.CVE-2019-1029 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
A denial of service vulnerability exists in Skype for Business. An attacker who successfully exploited the vulnerability could cause Skype for Business to stop responding. Note that the denial of service would not allow an attacker to execute code or to elevate the attacker's user rights. To exploit the vulnerability, an attacker needs to obtain a dial-in link for a vulnerable server and then initiates a series of calls within a short amount of time. The update addresses the vulnerability by correcting the way that Skype for Business server handles objects in memory.
- Product
- Microsoft Lync Server 2010
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 22, 2019Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495CVE-2019-7841 · Email & office · Adobe · reported by AdobeHigh 7.5
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Product
- Adobe Acrobat and Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comhelpx.adobe.com
May 22, 2019Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495CVE-2019-7836 · Email & office · Adobe · reported by AdobeHigh 7.5
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Product
- Adobe Acrobat and Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comhelpx.adobe.com
May 22, 2019Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier version, 2017.011.30138 and earlier, 2015.0CVE-2019-7835 · Email & office · Adobe · reported by AdobeCritical 9.8
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier version, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Product
- Adobe Acrobat and Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comhelpx.adobe.com
May 22, 2019Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495CVE-2019-7834 · Email & office · Adobe · reported by AdobeCritical 9.8
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Product
- Adobe Acrobat and Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comhelpx.adobe.com
May 22, 2019Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495CVE-2019-7833 · Email & office · Adobe · reported by AdobeCritical 9.8
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Product
- Adobe Acrobat and Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comhelpx.adobe.com
May 22, 2019Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495CVE-2019-7831 · Email & office · Adobe · reported by AdobeHigh 8.8
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Product
- Adobe Acrobat and Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comhelpx.adobe.com
May 22, 2019Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495CVE-2019-7830 · Email & office · Adobe · reported by AdobeHigh 8.8
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Product
- Adobe Acrobat and Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comhelpx.adobe.com
May 22, 2019Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495CVE-2019-7829 · Email & office · Adobe · reported by AdobeHigh 8.8
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
- Product
- Adobe Acrobat and Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comhelpx.adobe.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.