Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
259 results · page 3 of 6
Jul 5, 2023Improper input validation vulnerability in RegisteredMSISDN prior to SMR Jul-2023 Release 1 allows local attackers to launch privileged activities.CVE-2023-30664 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 8.5
Improper input validation vulnerability in RegisteredMSISDN prior to SMR Jul-2023 Release 1 allows local attackers to launch privileged activities.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 6, 2023An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php file.CVE-2021-33223 · Other software · Seeddms · reported by MITREHigh 8.8
An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php file.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsunil-singh.notion.sitenotion.so
Apr 19, 2023In PVRSRVBridgeRGXTDMSubmitTransfer of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-boundsCVE-2021-0879 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In PVRSRVBridgeRGXTDMSubmitTransfer of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-270397970
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Feb 7, 2023An XSS vulnerability was discovered in the Mayan EDMS DMS.CVE-2022-47419 · Other software · Mayan EDMS · reported by cve@rapid7.comMedium 5.4
An XSS vulnerability was discovered in the Mayan EDMS DMS. Successful XSS exploitation was observed in the in-product tagging system.
- Product
- Mayan EDMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmayan-edms.comrapid7.com
Feb 7, 2023 Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored (persistent, or "Type II") XSS condition.CVE-2022-47413 · Other software · OpenKM · reported by cve@rapid7.comMedium 5.4
Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored (persistent, or "Type II") XSS condition.
- Product
- OpenKM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2023Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS)CVE-2022-47412 · Other software · ONLYOFFICE · reported by cve@rapid7.comMedium 5.4
Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition.
- Product
- Workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023CKAN is an open-source DMS (data management system) for powering data hubs and data portals.CVE-2023-22746 · Other software · ckan · reported by GitHubHigh 8.6
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of the Docker images listed below, the same secret key was being used by default. If the users didn't set a custom value via environment variables in the `.env` file, that key was shared across different CKAN instances, making it easy to forge authentication requests. Users overriding the default secret key in their own `.env` file are not affected by this issue. Note that the legacy images (ckan/ckan) located in the main CKAN repo are not affected by this issue. The affected images are ckan/ckan-docker, (ckan/ckan-base images), okfn/docker-ckan (openknowledge/ckan-base and openknowledge/ckan-dev images) keitaroinc/docker-ckan (keitaro/ckan images).
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023An arbitrary file upload vulnerability in Ftdms v3.1.6 allows attackers to execute arbitrary code via uploading a crafted JPG file.CVE-2023-23135 · Other software · Ftdms Project · reported by MITREHigh 7.2
An arbitrary file upload vulnerability in Ftdms v3.1.6 allows attackers to execute arbitrary code via uploading a crafted JPG file.
- Product
- Ftdms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of this vulnerability may dCVE-2022-47976 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of this vulnerability may disconnect normal service connections.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Dec 14, 2022A vulnerability, which was classified as problematic, has been found in collective.dms.basecontent up to 1.6.CVE-2022-4495 · Other software · Collective.dms.basecontent Project · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in collective.dms.basecontent up to 1.6. This issue affects the function renderCell of the file src/collective/dms/basecontent/browser/column.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.7 is able to address this issue. The name of the patch is 6c4d616fcc771822a14ebae5e23f3f6d96d134bd. It is recommended to upgrade the affected component. The identifier VDB-215813 was assigned to this vulnerability.
- Product
- Collective.dms.basecontent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022ZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site Scripting (XSS).CVE-2022-44213 · Other software · Zkteco · reported by MITREMedium 4.8
ZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site Scripting (XSS).
- Product
- Automatic Data Master Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthe-it-wonders.blogspot.comthe-it-wonders.blogspot.com
Dec 8, 2022Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack.CVE-2022-44938 · Other software · Seeddms · reported by MITRECritical 9.8
Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill_session interface.CVE-2022-38542 · Other software · Archerydms · reported by MITRECritical 9.8
Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill_session interface. The project has released an update, please upgrade to v1.9.0 and above.
- Product
- Archery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordannouncements.bybit.comgithub.com
Sep 13, 2022Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_time parameters in the my2sql interface.CVE-2022-38541 · Other software · Archerydms · reported by MITRECritical 9.8
Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_time parameters in the my2sql interface.
- Product
- Archery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordannouncements.bybit.comgithub.com
Sep 13, 2022Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session interface.CVE-2022-38540 · Other software · Archerydms · reported by MITRECritical 9.8
Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session interface.
- Product
- Archery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordannouncements.bybit.comgithub.com
Sep 13, 2022Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/apply.CVE-2022-38539 · Other software · Archerydms · reported by MITRECritical 9.8
Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/apply.
- Product
- Archery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordannouncements.bybit.comgithub.com
Sep 13, 2022Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module.CVE-2022-38538 · Other software · Archerydms · reported by MITRECritical 9.8
Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module.
- Product
- Archery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordannouncements.bybit.comgithub.com
Sep 13, 2022Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_file, end_file, start_time, and stop_time parameters in CVE-2022-38537 · Other software · Archerydms · reported by MITRECritical 9.8
Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_file, end_file, start_time, and stop_time parameters in the binlog2sql interface.
- Product
- Archery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordannouncements.bybit.comgithub.com
Jun 21, 2022A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versCVE-2022-33139 · Other software · Siemens · reported by productcert@siemens.comCritical 9.8
A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC WinCC OA V3.17 (All versions in non-default configuration), SIMATIC WinCC OA V3.18 (All versions in non-default configuration). Affected applications use client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated.
- Product
- Cerberus DMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jun 17, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via \rdms\admin?page=user\manage_user&id=.CVE-2022-31941 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via \rdms\admin?page=user\manage_user&id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2022SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS.CVE-2022-28479 · Other software · Seeddms · reported by MITREMedium 4.8
SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS. An attacker with admin privileges can inject the payload inside the "Role management" menu and then trigger the payload by loading the "Users management" menu
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Jun 6, 2022SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal.CVE-2022-28478 · Other software · Seeddms · reported by MITREMedium 6.5
SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal. The "Remove file" functionality inside the "Log files management" menu does not sanitize user input allowing attackers with admin privileges to delete arbitrary files on the remote system.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Jun 6, 2022The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to inCVE-2022-28051 · Other software · Seeddms · reported by MITREMedium 5.4
The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to inject malicious javascript code.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/respondent_types/manage_respondent_type.php?id=.CVE-2022-31965 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/respondent_types/manage_respondent_type.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/respondent_types/view_respondent_type.php?id=.CVE-2022-31964 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/respondent_types/view_respondent_type.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/view_incident.php?id=.CVE-2022-31962 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/view_incident.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/manage_incident.php?id=.CVE-2022-31961 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/manage_incident.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/teams/manage_team.php?id=.CVE-2022-31959 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/teams/manage_team.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/teams/view_team.php?id=.CVE-2022-31957 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/teams/view_team.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/manage_report.php?id=.CVE-2022-31956 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/manage_report.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/view_report.php?id=.CVE-2022-31953 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/view_report.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL injection via /rdms/classes/Master.php?f=delete_incident.CVE-2022-31952 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL injection via /rdms/classes/Master.php?f=delete_incident.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_respondent_type.CVE-2022-31951 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_respondent_type.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_report.CVE-2022-31948 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_report.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_team.CVE-2022-31946 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_team.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to Delete any file via /rdms/classes/Master.php?f=delete_img.CVE-2022-31945 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.1
Rescue Dispatch Management System v1.0 is vulnerable to Delete any file via /rdms/classes/Master.php?f=delete_img.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2022Rescue Dispatch Management System 1.0 is vulnerable to Incorrect Access Control via http://localhost/rdms/admin/?page=system_info.CVE-2022-30016 · Other software · Rescue Dispatch Management System Project · reported by MITREHigh 8.8
Rescue Dispatch Management System 1.0 is vulnerable to Incorrect Access Control via http://localhost/rdms/admin/?page=system_info.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
May 20, 2022School Dormitory Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /dms/admin/reports/daily_collection_rCVE-2022-30886 · Other software · School Dormitory Management System Project · reported by MITRECritical 9.8
School Dormitory Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /dms/admin/reports/daily_collection_report.php.
- Product
- School Dormitory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Mar 3, 2022A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggerCVE-2021-3640 · Computers, phones & browsers · Linux · reported by Red HatHigh 7
A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgit.kernel.org
Feb 4, 2022Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "referuCVE-2021-45408 · Other software · Seeddms · reported by MITREMedium 6.1
Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "referuri" parameter.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsunil-singh.notion.sitesunil-singh.notion.site
Oct 22, 2021SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component AddEvent.php via the name and comment pCVE-2020-23048 · Other software · Seeddms · reported by MITREMedium 6.1
SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component AddEvent.php via the name and comment parameters.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Sep 14, 2021A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), Cerberus DMS V5.0 (CVE-2021-37181 · Other software · Siemens · reported by productcert@siemens.comCritical 10
A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), Cerberus DMS V5.0 (All versions < v5.0 QU1), Desigo CC Compact V4.0 (All versions), Desigo CC Compact V4.1 (All versions), Desigo CC Compact V4.2 (All versions), Desigo CC Compact V5.0 (All versions < V5.0 QU1), Desigo CC V4.0 (All versions), Desigo CC V4.1 (All versions), Desigo CC V4.2 (All versions), Desigo CC V5.0 (All versions < V5.0 QU1). The application deserialises untrusted data without sufficient validations, that could result in an arbitrary deserialization. This could allow an unauthenticated attacker to execute code in the affected system. The CCOM communication component used for Windows App / Click-Once and IE Web / XBAP client connectivity are affected by the vulnerability.
- Product
- Cerberus DMS V4.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Aug 9, 2021There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product.CVE-2021-21740 · Other software · ZTE · reported by psirt@zte.com.cnLow 2.4
There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product. The attacker could insert the USB disk with the symbolic link into the residential gateway, and access unauthorized directory information through the symbolic link, causing information leak.
- Product
- Zxhn H2640 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zte.com.cnsupport.zte.com.cn
Aug 3, 2021Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unlockCVE-2021-36543 · Other software · Seeddms · reported by MITREMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unlock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberdivision.medium.comcyberdivision.medium.com
Aug 3, 2021Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any CVE-2021-36542 · Other software · Seeddms · reported by MITREMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document nameCVE-2021-35343 · Other software · Seeddms · reported by MITREMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document name without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2021SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php.CVE-2021-26216 · Other software · Seeddms · reported by MITREMedium 4.3
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtuhin1729.medium.comtuhin1729.medium.com
Mar 18, 2021SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php.CVE-2021-26215 · Other software · Seeddms · reported by MITREMedium 4.3
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtuhin1729.medium.comtuhin1729.medium.com
Dec 7, 2020Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChooser.php.CVE-2020-28727 · Other software · Seeddms · reported by MITREMedium 6.1
Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChooser.php.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Nov 24, 2020Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php.CVE-2020-28726 · Other software · Seeddms · reported by MITREMedium 6.1
Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.