Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
144 results · page 3 of 3
Dec 8, 2017Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software" Ver3.1 and earlier allows an attacker to gainCVE-2017-10893 · Other software · Japan Agency for Local Authority Information Systems · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software" Ver3.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The Public Certification Service for Individuals "The JPKI user's software"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2017Untrusted search path vulnerability in Teikihoukokusho Sakuseishien Tool v4.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified dirCVE-2017-2228 · Other software · Agency for Natural Resources and Energy of Ministry of Economy,Trade and Industry (METI) · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Teikihoukokusho Sakuseishien Tool v4.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Teikihoukokusho Sakuseishien Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2017Untrusted search path vulnerability in Installer for Shin Kinkyuji Houkoku Data Nyuryoku Program (program released on 2011 March 10) Distributed on the website CVE-2017-10823 · Other software · Agency for Natural Resources and Energy of Ministry of Economy,Trade and Industry (METI) · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Installer for Shin Kinkyuji Houkoku Data Nyuryoku Program (program released on 2011 March 10) Distributed on the website till 2017 May 17 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Installer for Shin Kinkyuji Houkoku Data Nyuryoku Program (program released on 2011 March 10)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2017Untrusted search path vulnerability in Installer for Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program (program released on 2013 September 30) distributed CVE-2017-10822 · Other software · Agency for Natural Resources and Energy of Ministry of Economy,Trade and Industry (METI) · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Installer for Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program (program released on 2013 September 30) distributed on the website until 2017 May 17 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Installer for Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program (program released on 2013 September 30)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2017Untrusted search path vulnerability in Installer for Shin Kikan Toukei Houkoku Data Nyuryokuyou Program (program released on 2013 September 30) Distributed on tCVE-2017-10821 · Other software · Agency for Natural Resources and Energy of Ministry of Economy,Trade and Industry (METI) · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Installer for Shin Kikan Toukei Houkoku Data Nyuryokuyou Program (program released on 2013 September 30) Distributed on the website until 2017 May 17 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Installer for Shin Kikan Toukei Houkoku Data Nyuryokuyou Program (program released on 2013 September 30)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2017Untrusted search path vulnerability in Setup file of advance preparation for e-Tax software (WEB version) (1.17.1) and earlier allows an attacker to gain privilCVE-2017-2226 · Other software · National Tax Agency · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Setup file of advance preparation for e-Tax software (WEB version) (1.17.1) and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Setup file of advance preparation for e-Tax software (WEB version)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Jul 7, 2017Untrusted search path vulnerability in Installer of CASL II simulator (self-extract format) allows an attacker to gain privileges via a Trojan horse DLL in an uCVE-2017-2220 · Other software · INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Installer of CASL II simulator (self-extract format) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Installer of CASL II simulator(self-extract format)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2017Untrusted search path vulnerability in Installer of "Setup file of advance preparation" (jizen_setup.exe) (The version which was available on the website prior CVE-2017-2215 · Other software · National Tax Agency · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Installer of "Setup file of advance preparation" (jizen_setup.exe) (The version which was available on the website prior to 2017 June 12) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Installer of "Setup file of advance preparation" (jizen_setup.exe)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2017Untrusted search path vulnerability in Installer of Electronic tendering and bid opening system available prior to June 12, 2017 allows an attacker to execute aCVE-2017-2208 · Other software · Acquisition, Technology & Logistics Agency · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Installer of Electronic tendering and bid opening system available prior to June 12, 2017 allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory.
- Product
- Installer of electronic tendering and bid opening system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2017Cross-site scripting vulnerability in Source code security studying tool iCodeChecker allows an attacker to inject arbitrary web script or HTML via unspecified CVE-2017-2194 · Other software · INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Source code security studying tool iCodeChecker allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Source code security studying tool iCodeChecker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2017Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors, a diCVE-2017-2182 · Other software · INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) · reported by vultures@jpcert.or.jpHigh 8.8
Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors, a different vulnerability than CVE-2017-2179 and CVE-2017-2181.
- Product
- Hands-on Vulnerability Learning Tool "AppGoat" for Web Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2017Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors, a diCVE-2017-2181 · Other software · INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) · reported by vultures@jpcert.or.jpHigh 8.8
Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors, a different vulnerability than CVE-2017-2179 and CVE-2017-2182.
- Product
- Hands-on Vulnerability Learning Tool "AppGoat" for Web Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2017Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors.CVE-2017-2180 · Other software · INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) · reported by vultures@jpcert.or.jpMedium 4.3
Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors.
- Product
- Hands-on Vulnerability Learning Tool "AppGoat" for Web Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2017Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allows remote code execution via unspecified vectors, a different vulnerabCVE-2017-2179 · Other software · INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) · reported by vultures@jpcert.or.jpHigh 8.8
Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allows remote code execution via unspecified vectors, a different vulnerability than CVE-2017-2181 and CVE-2017-2182.
- Product
- Hands-on Vulnerability Learning Tool "AppGoat" for Web Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2017Untrusted search path vulnerability in Installer of electronic tendering and bid opening system available prior to May 25, 2017 allows an attacker to gain priviCVE-2017-2178 · Other software · Acquisition, Technology & Logistics Agency · reported by vultures@jpcert.or.jpHigh 8.8
Untrusted search path vulnerability in Installer of electronic tendering and bid opening system available prior to May 25, 2017 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Installer of electronic tendering and bid opening system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2017Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver3.0.1 and earlieCVE-2016-4902 · Other software · Japan Agency for Local Authority Information Systems · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver3.0.1 and earlier, The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)" Ver3.0.1 and earlier and The Public Certification Service for Individuals "The JPKI user's software" Ver2.6 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comjvn.jp
May 22, 2017Untrusted search path vulnerability in Empirical Project Monitor - eXtended all versions allows remote attackers to gain privileges via a Trojan horse DLL in anCVE-2017-2175 · Other software · INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Empirical Project Monitor - eXtended all versions allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Empirical Project Monitor - eXtended
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2017Cross-site scripting vulnerability in Empirical Project Monitor - eXtended all versions allows remote attackers to inject arbitrary web script or HTML via unspeCVE-2017-2174 · Other software · INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Empirical Project Monitor - eXtended all versions allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Empirical Project Monitor - eXtended
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2017Cross-site scripting vulnerability in Empirical Project Monitor - eXtended all versions allows remote authenticated attackers to inject arbitrary web script or CVE-2017-2173 · Other software · INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Empirical Project Monitor - eXtended all versions allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Empirical Project Monitor - eXtended
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2017Untrusted search path vulnerability in The installer of e-Tax Software all versions allows remote attackers to gain privileges via a Trojan horse DLL in an unspCVE-2016-4901 · Other software · National Tax Agency · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in The installer of e-Tax Software all versions allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The installer of e-Tax Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvndb.jvn.jpe-tax.nta.go.jp
May 12, 2017Untrusted search path vulnerability in installers for The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver3CVE-2017-2157 · Other software · Japan Agency for Local Authority Information Systems · reported by vultures@jpcert.or.jpHigh 7.3
Untrusted search path vulnerability in installers for The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver3.1 and earlier, The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)", The Public Certification Service for Individuals "The JPKI user's software" Ver2.6 and earlier that were available until April 27, 2017 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Installer for The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2017Security guide for website operators allows remote attackers to execute arbitrary OS commands via specially crafted saved data.CVE-2017-2128 · Other software · INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) · reported by vultures@jpcert.or.jpHigh 8.8
Security guide for website operators allows remote attackers to execute arbitrary OS commands via specially crafted saved data.
- Product
- Security guide for website operators
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 28, 2017Cross-site request forgery (CSRF) vulnerability in Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackersCVE-2017-2102 · Other software · INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- Product
- Hands-on Vulnerability Learning Tool "AppGoat" for Web Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 28, 2017Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to bypass authentication to perform arbitrary operCVE-2017-2101 · Other software · INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) · reported by vultures@jpcert.or.jpHigh 7.3
Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to bypass authentication to perform arbitrary operations via unspecified vectors.
- Product
- Hands-on Vulnerability Learning Tool "AppGoat" for Web Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 28, 2017Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.1 and earlier allows remote attackers to conduct DNS rebinding attacks via unspecified vCVE-2017-2100 · Other software · INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) · reported by vultures@jpcert.or.jpMedium 6.3
Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.1 and earlier allows remote attackers to conduct DNS rebinding attacks via unspecified vectors.
- Product
- Hands-on Vulnerability Learning Tool "AppGoat" for Web Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 28, 2017Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote code execution via unspecified vectors.CVE-2017-2099 · Other software · INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) · reported by vultures@jpcert.or.jpMedium 6.3
Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote code execution via unspecified vectors.
- Product
- Hands-on Vulnerability Learning Tool "AppGoat" for Web Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Sep 9, 2014The ADP AGENCY Immobiliare (aka com.wAdpagencyAndroid) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-CVE-2014-5843 · Other software · Adp4u · reported by cret@cert.orgMedium 5.4
The ADP AGENCY Immobiliare (aka com.wAdpagencyAndroid) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- ADP Agency Immobiliare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Apr 15, 2014The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5, and Artiva ArchiteCVE-2014-0348 · Other software · Ontariosystems · reported by cret@cert.orgLow 3.5
The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5, and Artiva Architect 3.2 MR5, when the domain-name option is enabled, allows remote attackers to login to arbitrary domain accounts by using the corresponding username on a Windows client machine.
- Product
- Artiva Architect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 23, 2011Escort Agency CMS (aka escort-agency-cms) allows remote attackers to obtain sensitive information via crafted array parameters in a request to a .php file, whicCVE-2011-3735 · Other software · Escortwebsitedesign · reported by MITREMedium 5
Escort Agency CMS (aka escort-agency-cms) allows remote attackers to obtain sensitive information via crafted array parameters in a request to a .php file, which reveals the installation path in an error message, as demonstrated by makethumb.php and certain other files.
- Product
- Escort-agency-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.google.comcode.google.com
May 11, 2010Multiple SQL injection vulnerabilities in escorts_search.php in I-Escorts Directory Script and Agency Script, when magic_quotes_gpc is disabled, allow remote atCVE-2009-4865 · Other software · I-escorts · reported by MITREMedium 6.8
Multiple SQL injection vulnerabilities in escorts_search.php in I-Escorts Directory Script and Agency Script, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) search_name and (2) languages parameters. NOTE: some of these details are obtained from third party information.
- Product
- I-escorts Agency Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org
May 11, 2010Multiple cross-site scripting (XSS) vulnerabilities in escorts_search.php in I-Escorts Directory Script and Agency Script allow remote attackers to inject arbitCVE-2009-4864 · Other software · I-escorts · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in escorts_search.php in I-Escorts Directory Script and Agency Script allow remote attackers to inject arbitrary web script or HTML via the (1) search_name and (2) languages parameters. NOTE: some of these details are obtained from third party information.
- Product
- I-escorts Agency Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgexchange.xforce.ibmcloud.com
Apr 9, 2010Directory traversal vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to read arbitrary files via a .CVE-2010-1345 · Other software · Cookex · reported by MITREMedium 5
Directory traversal vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
- Product
- COM Ckforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Apr 9, 2010SQL injection vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to execute arbitrary SQL commands viaCVE-2010-1344 · Other software · Cookex · reported by MITREHigh 7.5
SQL injection vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the fid parameter in a detail action to index.php.
- Product
- COM Ckforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Mar 18, 2010SQL injection vulnerability in photos.php in Model Agency Manager PRO (formerly Modeling Agency Content Management Script) allows remote attackers to execute arCVE-2009-4731 · Other software · Boldfx · reported by MITREHigh 7.5
SQL injection vulnerability in photos.php in Model Agency Manager PRO (formerly Modeling Agency Content Management Script) allows remote attackers to execute arbitrary SQL commands via the album parameter.
- Product
- Model Agency Manager Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Sep 24, 2009Multiple cross-site scripting (XSS) vulnerabilities in Match Agency BiZ 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) important CVE-2009-3359 · Other software · Datetopia · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Match Agency BiZ 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) important parameter to edit_profile.php and (2) pid parameter to report.php.
- Product
- Match Agency BIZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2009Multiple SQL injection vulnerabilities in Model Agency Manager PRO (formerly Modeling Agency Content Management Script) allow remote attackers to execute arbitrCVE-2009-3175 · Other software · Boldfx · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Model Agency Manager PRO (formerly Modeling Agency Content Management Script) allow remote attackers to execute arbitrary SQL commands via the user_id parameter to (1) view.php, (2) photos.php, and (3) motm.php; and the (4) id parameter to forum_message.php.
- Product
- Model Agency Manager Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jan 3, 2008Directory traversal vulnerability in download2.php in AGENCY4NET WEBFTP 1 allows remote attackers to read and delete arbitrary files via a ..CVE-2008-0091 · Other software · Agency4net · reported by MITREMedium 6.4
Directory traversal vulnerability in download2.php in AGENCY4NET WEBFTP 1 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the file parameter.
- Product
- Webftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comattrition.org
Nov 21, 2006Cross-site scripting (XSS) vulnerability in list.php in BLOG:CMS 4.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the FADDR CVE-2006-6035 · Other software · F-art Agency · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in list.php in BLOG:CMS 4.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the FADDR parameter.
- Product
- Blog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2006Multiple SQL injection vulnerabilities in F-ART BLOG:CMS 4.1 allow remote attackers to execute arbitrary SQL commands via the (1) xagent, (2) xpath, (3) xrefereCVE-2006-4748 · Other software · F-art Agency · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in F-ART BLOG:CMS 4.1 allow remote attackers to execute arbitrary SQL commands via the (1) xagent, (2) xpath, (3) xreferer, and (4) xdns parameters in (a) admin/plugins/NP_Log.php, and the (5) pitem parameter in (b) admin/plugins/NP_Poll.php; and allow remote authenticated users to execute arbitrary SQL commands via the (6) pageRef parameter in (c) admin/plugins/NP_Referrer.php.
- Product
- Blog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogcms.comsecunia.com
Jul 6, 2006SQL injection vulnerability in index.php in the NP_SEO plugin in BLOG:CMS before 4.1.0 allows remote attackers to execute arbitrary SQL commands via the id paraCVE-2006-3364 · Other software · F-art Agency · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in the NP_SEO plugin in BLOG:CMS before 4.1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- Blog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogcms.comretrogod.altervista.org
Mar 6, 2006Cross-site scripting (XSS) vulnerability in agencyprofile.asp in Parodia 6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the CVE-2006-1004 · Other software · Cactusoft · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in agencyprofile.asp in Parodia 6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the AG_ID parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
- Product
- Parodia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2006agencyprofile.asp in Parodia 6.2 and earlier might allow remote attackers to obtain sensitive information by triggering an SQL error via an invalid AG_ID parameCVE-2006-1005 · Other software · Cactusoft · reported by MITREMedium 6.4
agencyprofile.asp in Parodia 6.2 and earlier might allow remote attackers to obtain sensitive information by triggering an SQL error via an invalid AG_ID parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
- Product
- Parodia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Dec 31, 2005PunBB 1.2.9, used alone or with F-ART BLOG:CMS, may trust a client's IP address as specified in the X-Forwarded-For HTTP header rather than the TCP/IP stack, whCVE-2005-4687 · Other software · F-art Agency · reported by MITREMedium 5
PunBB 1.2.9, used alone or with F-ART BLOG:CMS, may trust a client's IP address as specified in the X-Forwarded-For HTTP header rather than the TCP/IP stack, which allows remote attackers to misrepresent their IP address by sending a modified header.
- Product
- Blog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Dec 31, 2004Multiple unknown vulnerabilities in Online Recruitment Agency 1.0 have unknown impact and attack vectors.CVE-2004-2156 · Other software · Recruitment Agency Software · reported by MITREHigh 10
Multiple unknown vulnerabilities in Online Recruitment Agency 1.0 have unknown impact and attack vectors.
- Product
- Online Recruitment Agency
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.