Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
209 results · page 3 of 5
May 8, 2023Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members.CVE-2023-31133 · Other software · TryGhost · reported by GitHubHigh 7.5
Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack. Ghost(Pro) has already been patched. Maintainers can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version below v5.46.1. v5.46.1 contains a fix for this issue. As a workaround, add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopup::getPopups().CVE-2023-27032 · Other software · Idnovate · reported by MITRECritical 9.8
Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopup::getPopups().
- Product
- Popup Module (on Entering, Exit Popup, ADD Product) And Newsletter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Apr 11, 2023Screen Creator Advance 2 Ver.0.1.1.4 Build01A and earlier is vulnerable to improper restriction of operations within the bounds of a memory buffer (CWE-119) dueCVE-2023-25755 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Screen Creator Advance 2 Ver.0.1.1.4 Build01A and earlier is vulnerable to improper restriction of operations within the bounds of a memory buffer (CWE-119) due to improper check of its data size when processing a project file. If a user of Screen Creator Advance 2 opens a specially crafted project file, information may be disclosed and/or arbitrary code may be executed.
- Product
- Screen Creator Advance 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Apr 4, 2023An issue found in Wondershare Technology Co., Ltd DemoCreator v.6.0.0 allows a remote attacker to execute arbitrary commands via the democreator_setup_full7743.CVE-2023-27762 · Other software · Wondershare · reported by MITREHigh 7.8
An issue found in Wondershare Technology Co., Ltd DemoCreator v.6.0.0 allows a remote attacker to execute arbitrary commands via the democreator_setup_full7743.exe file.
- Product
- Democreator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023This vulnerability allows remote attackers to execute arbitrary code on affected installations of KOYO Screen Creator 0.1.1.1.CVE-2022-27648 · Other software · KOYO · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of KOYO Screen Creator 0.1.1.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SCA2 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14868.
- Product
- Screen Creator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkoyoele.co.jpzerodayinitiative.com
Feb 12, 2023Use-after free vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process even when an error was detCVE-2023-22360 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Use-after free vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process even when an error was detected. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Screen Creator Advance 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Feb 12, 2023Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing coCVE-2023-22353 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing control management information. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Screen Creator Advance 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Feb 12, 2023Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing paCVE-2023-22350 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing parts management information. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Screen Creator Advance 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Feb 12, 2023Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing scCVE-2023-22349 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing screen management information. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Screen Creator Advance 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Feb 12, 2023Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing fiCVE-2023-22347 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing file structure information. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Screen Creator Advance 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Feb 12, 2023Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing teCVE-2023-22346 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing template information. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Screen Creator Advance 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Feb 12, 2023Out-of-bound write vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process when out of specificatCVE-2023-22345 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bound write vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process when out of specification errors are detected. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Screen Creator Advance 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Jan 16, 2023Custom Post Types and Custom Fields creator: Does not sanitize and escape some of its settingsCVE-2022-4442 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Custom Post Types and Custom Fields creator
- Fixed in
- 2.3.3
- What to do
- Update Custom Post Types and Custom Fields creator to 2.3.3 or newer.
Jan 5, 2023IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email for the creator/modifier of platform level objects.CVE-2022-43573 · Other software · IBM · reported by psirt@us.ibm.comLow 3.1
IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email for the creator/modifier of platform level objects. IBM X-Force ID: 238678.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 21, 2022Roxio Creator LJB starts another program with an unquoted file path.CVE-2022-46662 · Other software · Corel Corporation · reported by vultures@jpcert.or.jpMedium 6.7
Roxio Creator LJB starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoted, if a malicious executable is placed on a certain path, the executable may be executed with the privilege of the Windows service. The affected product and versions are as follows: Roxio Creator LJB version number 12.2 build number 106B62B, version number 12.2 build number 106B63A, version number 12.2 build number 106B69A, version number 12.2 build number 106B71A, and version number 12.2 build number 106B74A)
- Product
- Roxio Creator LJB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2022A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privilegesCVE-2021-25657 · Other software · Avaya · reported by securityalerts@avaya.comHigh 7.8
A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privileges. This issue affects Admin Lite and USB Creator 11.1 Feature Pack 2 Service Pack 1 and earlier versions.
- Product
- IP Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.avaya.com
May 30, 2022Bulk Page Creator: Does not protect its page creation functionalities with nonce checksCVE-2022-1611 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Bulk Page Creator WordPress plugin before 1.1.4 does not protect its page creation functionalities with nonce checks, which makes them vulnerable to CSRF.
- Product
- Bulk Page Creator
- Fixed in
- 1.1.4
- What to do
- Update Bulk Page Creator to 1.1.4 or newer.
May 18, 2022Screen Creator Advance2, HMI GC-A2 series, and Real time remote monitoring and control tool Screen Creator Advance2 versions prior to Ver.0.1.1.3 Build01, HMI GCVE-2022-29518 · Other software · KOYO ELECTRONICS INDUSTRIES CO., LTD. · reported by vultures@jpcert.or.jpHigh 7
Screen Creator Advance2, HMI GC-A2 series, and Real time remote monitoring and control tool Screen Creator Advance2 versions prior to Ver.0.1.1.3 Build01, HMI GC-A2 series(GC-A22W-CW, GC-A24W-C(W), GC-A26W-C(W), GC-A24, GC-A24-M, GC-A25, GC-A26, and GC-A26-J2), and Real time remote monitoring and control tool(Remote GC) allows a local attacker to bypass authentication due to the improper check for the Remote control setting's account names. This may allow attacker who can access the HMI from Real time remote monitoring and control tool may perform arbitrary operations on the HMI. As a result, the information stored in the HMI may be disclosed, deleted or altered, and/or the equipment may be illegally operated via the HMI.
- Product
- Screen Creator Advance2, HMI GC-A2 series, and Real time remote monitoring and control tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022HTMLCreator release_stable_2020-07-29 was discovered to contain a cross-site scripting (XSS) vulnerability via the function _generateFilename.CVE-2022-28919 · Other software · Dokuwiki · reported by MITREMedium 6.1
HTMLCreator release_stable_2020-07-29 was discovered to contain a cross-site scripting (XSS) vulnerability via the function _generateFilename.
- Product
- Dokuwiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Mar 28, 2022Bulk Creator: Does not sanitize and escape the post_type parameter before outputting it back in an admin pageCVE-2022-0647 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the post_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Bulk Creator
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Bulk Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability.CVE-2022-22262 · Network & remote access · ASUS · reported by twcert@cert.org.twHigh 7.7
ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability. Since this function does not validate the path before deletion, an unauthenticated local attacker can create an unexpected symbolic link to system file path, to delete arbitrary system files and disrupt system service.
- Product
- Armoury Crate & Aura Creator Installer (ROG Live Service)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Feb 21, 2022Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access CVE-2022-0708 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Feb 20, 2022Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go.CVE-2022-25372 · Other software · Pritunl · reported by MITREHigh 7.8
Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go.
- Product
- Pritunl-client-electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2022In Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database via SQLi, an attacker can log in and leverage an arbitrary file uCVE-2021-45411 · Other software · Printable Staff ID Card Creator System Project · reported by MITRECritical 9.8
In Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database via SQLi, an attacker can log in and leverage an arbitrary file upload vulnerability to obtain remote code execution.
- Product
- Printable Staff ID Card Creator System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsourcecodester.com
Nov 8, 2021Booking.com Banner Creator: Does not properly sanitize inputsCVE-2021-24646 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Booking.com Banner Creator WordPress plugin before 1.4.3 does not properly sanitize inputs when creating banners, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Booking.com Banner Creator
- Fixed in
- 1.4.3
- What to do
- Update Booking.com Banner Creator to 1.4.3 or newer.
Sep 15, 2021Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as their creator.CVE-2021-22148 · Other software · Elastic · reported by security@elastic.coHigh 8.8
Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as their creator. This could lead to a less privileged user gaining access to unauthorized engines.
- Product
- Elastic Enterprise Search
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.coelastic.co
Aug 30, 2021A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various areas such as data-link-creatorCVE-2021-27558 · Other software · Easycorp · reported by MITREMedium 6.1
A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various areas such as data-link-creator.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivasec.comprivasec.com
Dec 8, 2020Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot.CVE-2020-26249 · Other software · Cog-Creators · reported by GitHubHigh 7.7
Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This high severity exploit has been fixed on version 0.1.7a. There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue.
- Product
- Red-Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2020The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file.CVE-2020-28649 · WordPress plugins & themes · reported by MITREHigh 8.8
The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file.
- Product
- orbisius-child-theme-creator
- Fixed in
- 1.5.2
- What to do
- Update orbisius-child-theme-creator to 1.5.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 28, 2020Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module.CVE-2020-15278 · Other software · Cog-Creators · reported by GitHubHigh 7.7
Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module. This exploit allows Discord users with a high privilege level within the guild to bypass hierarchy checks when the application is in a specific condition that is beyond that user's control. By abusing this exploit, it is possible to perform destructive actions within the guild the user has high privileges in. This exploit has been fixed in version 3.4.1. As a workaround, unloading the Mod module with unload mod or, disabling the massban command with command disable global massban can render this exploit not accessible. We still highly recommend updating to 3.4.1 to completely patch this issue.
- Product
- Red-DiscordBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2020Red Discord Bot before versions 3.3.12 and 3.4 has a Remote Code Execution vulnerability in the Streams module.CVE-2020-15147 · Other software · Cog-Creators · reported by GitHubHigh 8.5
Red Discord Bot before versions 3.3.12 and 3.4 has a Remote Code Execution vulnerability in the Streams module. This exploit allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. As a workaround, unloading the Trivia module with `unload streams` can render this exploit not accessible. It is highly recommended updating to 3.3.12 or 3.4 to completely patch this issue.
- Product
- Red-DiscordBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2020In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usCVE-2020-15140 · Other software · Cog-Creators · reported by GitHubHigh 8.2
In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This critical exploit has been fixed on version 3.3.11.
- Product
- Red-DiscordBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2020The Bluetooth Low Energy implementation in Cypress PSoC Creator BLE 4.2 component versions before 3.64 generates a random number (Pairing Random) with significaCVE-2020-11957 · Other software · Cypress · reported by MITREHigh 7.5
The Bluetooth Low Energy implementation in Cypress PSoC Creator BLE 4.2 component versions before 3.64 generates a random number (Pairing Random) with significantly less entropy than the specified 128 bits during BLE pairing. This is the case for both authenticated and unauthenticated pairing with both LE Secure Connections as well as LE Legacy Pairing. A predictable or brute-forceable random number allows an attacker (in radio range) to perform a MITM attack during BLE pairing.
- Product
- Psoc 4.2 BLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcypress.comcypress.com
Feb 11, 2020NetApp Snap Creator Framework before 4.3P1 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors.CVE-2016-5710 · Other software · Netapp · reported by MITREMedium 4.6
NetApp Snap Creator Framework before 4.3P1 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors.
- Product
- Snap Creator Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netapp.comkb.netapp.com
Nov 12, 2019includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF.CVE-2019-17237 · WordPress plugins & themes · reported by MITREHigh 8.8
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF.
- Product
- includes/class-coming-soon-creator.php in the igniteup
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update includes/class-coming-soon-creator.php in the igniteup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Nov 12, 2019includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS.CVE-2019-17236 · WordPress plugins & themes · reported by MITREMedium 6.1
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS.
- Product
- includes/class-coming-soon-creator.php in the igniteup
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update includes/class-coming-soon-creator.php in the igniteup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Nov 12, 2019includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure.CVE-2019-17235 · WordPress plugins & themes · reported by MITREMedium 5.3
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure.
- Product
- includes/class-coming-soon-creator.php in the igniteup
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update includes/class-coming-soon-creator.php in the igniteup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Nov 12, 2019includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.CVE-2019-17234 · WordPress plugins & themes · reported by MITREHigh 7.5
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.
- Product
- includes/class-coming-soon-creator.php in the igniteup
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update includes/class-coming-soon-creator.php in the igniteup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Oct 7, 2019The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbCVE-2015-9456 · WordPress plugins & themes · reported by MITREMedium 6.5
The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file theme_1, theme_1_file, or theme_1_file_contents parameter.
- Product
- orbisius-child-theme-creator
- Fixed in
- 1.2.8
- What to do
- Update orbisius-child-theme-creator to 1.2.8 or newer.
Sep 3, 2019A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling CVE-2019-14811 · Other software · Artifex Software · reported by Red HatHigh 7.8
A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
- Product
- ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jul 9, 2019In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadCVE-2019-13338 · Other software · Weseek · reported by MITREHigh 7.5
In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadata. In other words, the password hash can be retrieved even though it is not a publicly available field.
- Product
- Growi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 22, 2019Versions of Unity8 before 8.11+16.04.20160122-0ubuntu1 file plugins/Dash/CardCreator.js will execute any code found in place of a fallback image supplied by a sCVE-2016-1573 · Other software · Ubuntu · reported by security@ubuntu.comHigh 7.8
Versions of Unity8 before 8.11+16.04.20160122-0ubuntu1 file plugins/Dash/CardCreator.js will execute any code found in place of a fallback image supplied by a scope.
- Product
- Unity8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbazaar.launchpad.netbazaar.launchpad.net
Mar 14, 2019Improper permissions for Intel(R) USB 3.0 Creator Utility all versions may allow an authenticated user to potentially enable escalation of privilege via local aCVE-2019-0129 · Other software · Intel Corporation · reported by secure@intel.comHigh 7.8
Improper permissions for Intel(R) USB 3.0 Creator Utility all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Intel(R) USB 3.0 Creator Utility
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Untrusted search path vulnerability in The installer of Windows 10 Fall Creators Update Modify module for Security Measures tool allows an attacker to gain privCVE-2018-16177 · Other software · NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in The installer of Windows 10 Fall Creators Update Modify module for Security Measures tool allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The installer of Windows10 Fall Creators Update Modify module for Security Measures tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2018text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random (ratherCVE-2018-18531 · Other software · Kaptcha Project · reported by MITRECritical 9.8
text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random (rather than SecureRandom) function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force approach.
- Product
- Kaptcha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackersCVE-2018-1000600 · Websites & servers · Jenkins · reported by MITREHigh 8.8
A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- Product
- Github
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2018An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress.CVE-2018-11580 · WordPress plugins & themes · reported by MITREMedium 5.4
An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creation with custom content. There is no nonce or user capability check, so anyone can launch a DoS attack against a site and create hundreds of thousands of posts with custom content.
- Product
- MULTIDOTS Mass Pages/Posts Creator
- Affected
- 1.2.2 to 1.2.2
- What to do
- Affects 1.2.2 to 1.2.2. Update MULTIDOTS Mass Pages/Posts Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlabs.threatpress.comwordpress.org
Feb 17, 2018SQL Injection exists in the JTicketing 2.0.16 component for Joomla! via a view=events action with a filter_creator or filter_events_cat parameter.CVE-2018-6585 · Other software · Techjoomla · reported by MITRECritical 9.8
SQL Injection exists in the JTicketing 2.0.16 component for Joomla! via a view=events action with a filter_creator or filter_events_cat parameter.
- Product
- Jticketing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Dec 28, 2017Multiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated users to inject arbitCVE-2017-15892 · Network & remote access · Synology · reported by security@synology.comMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated users to inject arbitrary web script or HTML via (1) COMMAND, (2) COMMANDS INSTRUCTION, or (3) DESCRIPTION parameter.
- Product
- Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Dec 20, 2017In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c.CVE-2017-17787 · Other software · Gimp · reported by MITREHigh 7.8
In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c.
- Product
- Gimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.gnome.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.