Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

167 results · page 3 of 4

Jun 2, 2022Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_edit.php?booking=31&user_id=.CVE-2022-30833 · Other software · Wedding Management System Project · reported by MITREHigh 7.2
Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_edit.php?booking=31&user_id=.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_assign.php?booking=31&user_id=.CVE-2022-30832 · Other software · Wedding Management System Project · reported by MITREHigh 7.2
Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_assign.php?booking=31&user_id=.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022Wedding Management System v1.0 is vulnerable to SQL Injection via Wedding-Management/wedding_details.php.CVE-2022-30831 · Other software · Wedding Management System Project · reported by MITREHigh 7.2
Wedding Management System v1.0 is vulnerable to SQL Injection via Wedding-Management/wedding_details.php.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\feature_edit.php.CVE-2022-30830 · Other software · Wedding Management System Project · reported by MITREHigh 7.2
Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\feature_edit.php.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\users_edit.php.CVE-2022-30829 · Other software · Wedding Management System Project · reported by MITREHigh 7.2
Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\users_edit.php.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\photos_edit.php.CVE-2022-30828 · Other software · Wedding Management System Project · reported by MITREHigh 7.2
Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\photos_edit.php.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\package_edit.php.CVE-2022-30827 · Other software · Wedding Management System Project · reported by MITREHigh 7.2
Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\package_edit.php.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022Wedding Management System v1.0 is vulnerable to SQL Injection via admin\client_assign.php.CVE-2022-30826 · Other software · Wedding Management System Project · reported by MITREHigh 7.2
Wedding Management System v1.0 is vulnerable to SQL Injection via admin\client_assign.php.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\client_edit.php.CVE-2022-30825 · Other software · Wedding Management System Project · reported by MITREHigh 7.2
Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\client_edit.php.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\blog_events_edit.php.CVE-2022-30823 · Other software · Wedding Management System Project · reported by MITREHigh 7.2
Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\blog_events_edit.php.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_profile.php" file.CVE-2022-30822 · Other software · Wedding Management System Project · reported by MITREHigh 8.8
In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_profile.php" file.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022In Wedding Management System v1.0, the editing function of the "Services" module in the background management system has an arbitrary file upload vulnerability CVE-2022-30821 · Other software · Wedding Management System Project · reported by MITREHigh 8.8
In Wedding Management System v1.0, the editing function of the "Services" module in the background management system has an arbitrary file upload vulnerability in the picture upload point of "package_edit.php" file.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022In Wedding Management v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_edit.php" file.CVE-2022-30820 · Other software · Wedding Management System Project · reported by MITREHigh 8.8
In Wedding Management v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_edit.php" file.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "photos_edit.php" file.CVE-2022-30819 · Other software · Wedding Management System Project · reported by MITREHigh 8.8
In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "photos_edit.php" file.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022Wedding Management System v1.0 is vulnerable to SQL injection via /Wedding-Management/admin/blog_events_edit.php?id=31.CVE-2022-30818 · Other software · Wedding Management System Project · reported by MITREHigh 7.2
Wedding Management System v1.0 is vulnerable to SQL injection via /Wedding-Management/admin/blog_events_edit.php?id=31.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 11, 2022Wedding Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Wedding-Management/package_detail.php.CVE-2022-29656 · Other software · Wedding Management System Project · reported by MITRECritical 9.8
Wedding Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Wedding-Management/package_detail.php.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackmd.io hackmd.io
May 11, 2022An arbitrary file upload vulnerability in the Upload Photos module of Wedding Management System v1.0 allows attackers to execute arbitrary code via a crafted PHCVE-2022-29655 · Other software · Wedding Management System Project · reported by MITREHigh 7.2
An arbitrary file upload vulnerability in the Upload Photos module of Wedding Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
Product
Wedding Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackmd.io hackmd.io
Feb 11, 2022The Entity Embed module provides a filter to allow embedding entities in content fields.CVE-2020-13673 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.1
The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.
Product
Entity Embed
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Dec 8, 2021Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content.CVE-2021-43543 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org lists.debian.org
Oct 21, 2021Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added.CVE-2021-41168 · Other software · reddit · reported by GitHubMedium 6.5
Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added. In affected versions snudown was found to be vulnerable to denial of service attacks to its reference table implementation. References written in markdown ` [reference_name]: https://www.example.com` are inserted into a hash table which was found to have a weak hash function, meaning that an attacker can reliably generate a large number of collisions for it. This makes the hash table vulnerable to a hash-collision DoS attack, a type of algorithmic complexity attack. Further the hash table allowed for duplicate entries resulting in long retrieval times. Proofs of concept and further discussion of the hash collision issue are discussed on the snudown GHSA(https://github.com/reddit/snudown/security/advisories/GHSA-6gvv-9q92-w5f6). Users are advised to update to version 1.7.0.
Product
snudown
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 26, 2021TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to obfuscate and embed crafted files used to escalate privileges.CVE-2020-18171 · Other software · Techsmith · reported by MITREHigh 8.8
TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to obfuscate and embed crafted files used to escalate privileges. NOTE: This implies that Snagit's use of OLE is a security vulnerability unto itself and it is not. See reference document for more details.
Product
Snagit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.google.com github.com
Nov 13, 2019A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial CVE-2019-18397 · Other software · GNU · reported by MITREHigh 7.8
A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.
Product
Fribidi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Sep 30, 2019A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to CVE-2019-16414 · Other software · GFI · reported by MITREMedium 6.1
A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI.
Product
Kerio Control
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 17, 2019In Foxit Reader SDK (ActiveX) Professional 5.4.0.1031, an uninitialized object in IReader_ContentProvider::GetDocEventHandler occurs when embedding the control CVE-2018-19448 · Other software · Foxitsoftware · reported by MITREHigh 7.8
In Foxit Reader SDK (ActiveX) Professional 5.4.0.1031, an uninitialized object in IReader_ContentProvider::GetDocEventHandler occurs when embedding the control into Office documents. By opening a specially crafted document, an attacker can trigger an out of bounds write condition, possibly leveraging this to gain remote code execution.
Product
Foxit PDF SDK Activex
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com foxitsoftware.com
May 31, 2019Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as the /Applications/Calculator.apCVE-2019-10038 · Other software · Evernote · reported by MITREHigh 7.8
Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as the /Applications/Calculator.app/Contents/MacOS/Calculator file.
Product
Evernote
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drive.google.com evernote.com
Apr 8, 2019A vulnerability in the Object Linking & Embedding (OLE2) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow CVE-2019-1788 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
A vulnerability in the Object Linking & Embedding (OLE2) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for OLE2 files sent an affected device. An attacker could exploit this vulnerability by sending malformed OLE2 files to the device running an affected version ClamAV Software. An exploit could allow the attacker to cause an out-of-bounds write condition, resulting in a crash that could result in a denial of service condition on an affected device.
Product
ClamAV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Jun 28, 2018The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding CVE-2018-11510 · Network & remote access · Asustor · reported by MITRECritical 9.8
The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the 'script' parameter.
Product
ADM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Apr 7, 2018In Gxlcms QY v1.0.0713, Lib\Lib\Action\Home\HitsAction.class.php allows remote attackers to read data from a database by embedding a FROM clause in a query striCVE-2018-9852 · Other software · Gxlcms · reported by MITRECritical 9.8
In Gxlcms QY v1.0.0713, Lib\Lib\Action\Home\HitsAction.class.php allows remote attackers to read data from a database by embedding a FROM clause in a query string within a Home-Hits request, as demonstrated hy sid=user,password%20from%20mysql.user%23.
Product
Gxlcms QY
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record atksec.com atksec.com
Mar 6, 2018In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandleCVE-2018-7738 · Other software · Kernel · reported by MITREHigh 7.8
In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.
Product
Util-linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugs.debian.org
Dec 18, 2017DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to membCVE-2017-17727 · Other software · Dedecms · reported by MITREHigh 8.8
DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/article_edit.php.
Product
Dedecms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seebug.org seebug.org
Dec 14, 2017scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by the BROWSER environmentCVE-2017-17516 · Other software · Reddit Terminal Viewer Project · reported by MITREHigh 8.8
scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Reddit Terminal Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Oct 31, 2017Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential CVE-2017-3933 · Other software · McAfee · reported by secure@intel.comMedium 5.4
Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via a cross site request forgery attack.
Product
Network Data Loss Prevention
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com kc.mcafee.com
May 17, 2017Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/coCVE-2017-4011 · Other software · McAfee · reported by secure@intel.comMedium 6.1
Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request.
Product
Network Data Loss Prevention (NDLP)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com kc.mcafee.com
Nov 11, 2014Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution VulnerabilityCVE-2014-6332 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site.
Product
Windows
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Oct 21, 2014The Fusion Flowers - Weddings (aka com.triactivemedia.fusionweddings) application @7F0801AA for Android does not verify X.509 certificates from SSL servers, whiCVE-2014-7746 · Other software · Pocketmags · reported by cret@cert.orgMedium 5.4
The Fusion Flowers - Weddings (aka com.triactivemedia.fusionweddings) application @7F0801AA for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Fusion Flowers - Weddings
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Oct 21, 2014The Villa Antonia (aka com.appbuilder.u7p5019) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attCVE-2014-7631 · Other software · Texasweddingmall · reported by cret@cert.orgMedium 5.4
The Villa Antonia (aka com.appbuilder.u7p5019) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Villa Antonia
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Oct 19, 2014The Inspire Weddings (aka com.magzter.inspireweddings) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-CVE-2014-7373 · Other software · Magzter · reported by cret@cert.orgMedium 5.4
The Inspire Weddings (aka com.magzter.inspireweddings) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Inspire Weddings
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Oct 15, 2014Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution VulnerabilityCVE-2014-4114 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object.
Product
Windows
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.trendmicro.com blogs.technet.com
Sep 30, 2014The My Wedding Planner (aka app.wedding) application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackeCVE-2014-6840 · Other software · Weddingselections · reported by cret@cert.orgMedium 5.4
The My Wedding Planner (aka app.wedding) application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
MY Wedding Planner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Sep 27, 2014The Reddit Aww (aka org.biais.redditawww) application 1.2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attaCVE-2014-6756 · Other software · Biais · reported by cret@cert.orgMedium 5.4
The Reddit Aww (aka org.biais.redditawww) application 1.2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Reddit AWW
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Sep 23, 2014The Wedding Photo Frames-Love Pics (aka com.WeddingPhotoFramesLovePics) application 1.0 for Android does not verify X.509 certificates from SSL servers, which aCVE-2014-6695 · Other software · Wedding Photo Frames-love Pics Project · reported by cret@cert.orgMedium 5.4
The Wedding Photo Frames-Love Pics (aka com.WeddingPhotoFramesLovePics) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Wedding Photo Frames-love Pics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Sep 9, 2014The Eversnap Private Photo Album (aka com.weddingsnap.android) application 1.0.23 for Android does not verify X.509 certificates from SSL servers, which allows CVE-2014-5742 · Other software · Geteversnap · reported by cret@cert.orgMedium 5.4
The Eversnap Private Photo Album (aka com.weddingsnap.android) application 1.0.23 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Eversnap Private Photo Album
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Oct 2, 2013The create certreq command in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commaCVE-2012-4111 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.8
The create certreq command in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86563.
Product
Unified Computing System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Oct 2, 2013run-script in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecCVE-2012-4110 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.8
run-script in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86560.
Product
Unified Computing System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Oct 2, 2013The clear sshkey command in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commandCVE-2012-4109 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.8
The clear sshkey command in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86559.
Product
Unified Computing System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Oct 2, 2013ethanalyzer in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspeCVE-2012-4103 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.8
ethanalyzer in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq02686.
Product
Unified Computing System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Oct 2, 2013The activate firmware command in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding coCVE-2012-4102 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.8
The activate firmware command in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq02600.
Product
Unified Computing System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Apr 25, 2013kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) documCVE-2013-1947 · Other software · Kelly D. Redding · reported by Red HatHigh 9.3
kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.
Product
Kelredd-pruview
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Feb 13, 2013Object Linking and Embedding (OLE) Automation in Microsoft Windows XP SP3 does not properly allocate memory, which allows remote attackers to execute arbitrary CVE-2013-1313 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 9.3
Object Linking and Embedding (OLE) Automation in Microsoft Windows XP SP3 does not properly allocate memory, which allows remote attackers to execute arbitrary code via a crafted RTF document, aka "OLE Automation Remote Code Execution Vulnerability."
Product
Windows XP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov docs.microsoft.com
Jul 14, 2011Cross-site scripting (XSS) vulnerability in the RSS embedding feature in DokuWiki before 2011-05-25a Rincewind allows remote attackers to inject arbitrary web sCVE-2011-2510 · Other software · Dokuwiki · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in the RSS embedding feature in DokuWiki before 2011-05-25a Rincewind allows remote attackers to inject arbitrary web script or HTML via a link.
Product
Dokuwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org lists.fedoraproject.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.