Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
122 results · page 3 of 3
Feb 22, 2021OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administratorsCVE-2021-26724 · Other software · Nozomi Networks · reported by prodsec@nozominetworks.comHigh 8.6
OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrators to perform remote code execution. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions.
- Product
- Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.nozominetworks.comsecurity.nozominetworks.com
Jun 30, 2020Nozomi Networks OS before 19.0.4 allows /#/network?tab=network_node_list.html CSV Injection.CVE-2020-7049 · Other software · Nozominetworks · reported by MITREHigh 7.3
Nozomi Networks OS before 19.0.4 allows /#/network?tab=network_node_list.html CSV Injection.
- Product
- Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww2.deloitte.comwww2.deloitte.com
Jun 30, 2020Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to create a custom field with a crafted fiCVE-2020-15307 · Other software · Nozominetworks · reported by MITREMedium 6.1
Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to create a custom field with a crafted field name.
- Product
- Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww2.deloitte.comwww2.deloitte.com
Jun 25, 2020In Argent RecoveryManager before 0xdc350d09f71c48c5D22fBE2741e4d6A03970E192, the executeRecovery function does not require any signatures in the zero-guardian cCVE-2020-15302 · Other software · Argent · reported by MITREHigh 7.5
In Argent RecoveryManager before 0xdc350d09f71c48c5D22fBE2741e4d6A03970E192, the executeRecovery function does not require any signatures in the zero-guardian case, which allows attackers to cause a denial of service (locking) or a takeover.
- Product
- Recoverymanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.openzeppelin.comblog.openzeppelin.com
Jun 9, 2020A security feature bypass vulnerability exists when Windows Host Guardian Service improperly handles hashes recorded and logged, aka 'Windows Host Guardian ServCVE-2020-1259 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
A security feature bypass vulnerability exists when Windows Host Guardian Service improperly handles hashes recorded and logged, aka 'Windows Host Guardian Service Security Feature Bypass Vulnerability'.
- Product
- Windows Server, version 2004 (Server Core installation)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Aug 6, 2019Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter.CVE-2019-14696 · Other software · Open-school · reported by MITREMedium 6.1
Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter.
- Product
- Open-school
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopen-school.org
Oct 23, 2018Stegdetect through 2018-05-26 has an out-of-bounds write in f5_compress in the f5.c file.CVE-2018-18599 · Other software · Guardianproject · reported by MITREHigh 8.8
Stegdetect through 2018-05-26 has an out-of-bounds write in f5_compress in the f5.c file.
- Product
- Stegdetect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2018Digital Guardian Management Console 7.1.2.0015 has a Directory Traversal issue.CVE-2018-10176 · Other software · Digitalguardian · reported by MITREMedium 6.5
Digital Guardian Management Console 7.1.2.0015 has a Directory Traversal issue.
- Product
- Management Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Apr 20, 2018Digital Guardian Management Console 7.1.2.0015 has an XXE issue.CVE-2018-10175 · Other software · Digitalguardian · reported by MITREMedium 6.5
Digital Guardian Management Console 7.1.2.0015 has an XXE issue.
- Product
- Management Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Apr 20, 2018Digital Guardian Management Console 7.1.2.0015 has an SSRF issue that allows remote attackers to read arbitrary files via file:// URLs, send TCP traffic to intrCVE-2018-10174 · Other software · Digitalguardian · reported by MITREMedium 6.5
Digital Guardian Management Console 7.1.2.0015 has an SSRF issue that allows remote attackers to read arbitrary files via file:// URLs, send TCP traffic to intranet hosts, or obtain an NTLM hash. This can occur even if the logged-in user has a read-only role.
- Product
- Management Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Apr 20, 2018Digital Guardian Management Console 7.1.2.0015 allows authenticated remote code execution because of Arbitrary File Upload functionality.CVE-2018-10173 · Other software · Digitalguardian · reported by MITREHigh 8.8
Digital Guardian Management Console 7.1.2.0015 allows authenticated remote code execution because of Arbitrary File Upload functionality.
- Product
- Management Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jan 13, 2010Cross-site scripting (XSS) vulnerability in Canon IT Solutions Inc.CVE-2009-4608 · Other software · Canon-its · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Canon IT Solutions Inc. ACCESSGUARDIAN 3.0.14 and earlier, and 3.5.6 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to authentication.
- Product
- Accessguardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2010The command line interface in Overland Storage Snap Server 410 with GuardianOS 5.1.041 runs the "less" utility with a higher-privileged uid than the CLI user anCVE-2009-4607 · Other software · Overlandstorage · reported by MITREHigh 7.2
The command line interface in Overland Storage Snap Server 410 with GuardianOS 5.1.041 runs the "less" utility with a higher-privileged uid than the CLI user and without sufficient restriction on shell escapes, which allows local users to gain privileges using the "!" character within less to access a privileged shell.
- Product
- Snap Server 410
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjuniper.netsecurityfocus.com
Mar 4, 2009SmoothWall SmoothGuardian, as used in SmoothWall Firewall, NetworkGuardian, and SchoolGuardian 2008, when transparent interception mode is enabled, uses the HTTCVE-2009-0803 · Other software · Smoothwall · reported by MITREMedium 5.4
SmoothWall SmoothGuardian, as used in SmoothWall Firewall, NetworkGuardian, and SchoolGuardian 2008, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.
- Product
- Networkguardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
May 29, 2007Credant Mobile Guardian Shield for Windows 5.2.1.105 and earlier stores account names and passwords in plaintext in memory, which allows local users to obtain sCVE-2007-2883 · Other software · Credant · reported by MITREMedium 4.6
Credant Mobile Guardian Shield for Windows 5.2.1.105 and earlier stores account names and passwords in plaintext in memory, which allows local users to obtain sensitive information by (1) reading the paging file or (2) dumping and searching the memory image. NOTE: This issue crosses privilege boundaries because the product is intended to protect the data on a stolen computer.
- Product
- Credant Mobile Guardian Shield - Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2004Unknown vulnerability in DansGuardian before 2.6.1-13 allows remote attackers to bypass URL filters via a crafted request that causes a page to be added to the CVE-2004-2283 · Other software · Daniel Barron · reported by MITREMedium 5
Unknown vulnerability in DansGuardian before 2.6.1-13 allows remote attackers to bypass URL filters via a crafted request that causes a page to be added to the clean page cache.
- Product
- Dansguardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddansguardian.orgosvdb.org
Dec 31, 2004DansGuardian before 2.7.7-2 allows remote attackers to bypass URL filters via a ".." in the request.CVE-2004-2282 · Other software · Daniel Barron · reported by MITREMedium 5
DansGuardian before 2.7.7-2 allows remote attackers to bypass URL filters via a ".." in the request.
- Product
- Dansguardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddansguardian.orgosvdb.org
Dec 31, 2004DansGuardian 2.8 and earlier allows remote attackers to bypass the extension filtering rule via a hex encoded extension or .CVE-2004-2065 · Other software · Daniel Barron · reported by MITREHigh 7.5
DansGuardian 2.8 and earlier allows remote attackers to bypass the extension filtering rule via a hex encoded extension or . in the filename.
- Product
- Dansguardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddansguardian.orgmarc.info
Dec 31, 2003Cross-site scripting (XSS) vulnerability in dansguardian.pl in Adelix CensorNet 3.0 through 3.2 allows remote attackers to execute arbitrary script as other useCVE-2003-1506 · Other software · Daniel Barron · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in dansguardian.pl in Adelix CensorNet 3.0 through 3.2 allows remote attackers to execute arbitrary script as other users by injecting arbitrary HTML or script into the DENIEDURL parameter.
- Product
- Dansguardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Mar 3, 2003miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in BaCVE-2003-0101 · Other software · Engardelinux · reported by MITREHigh 10
miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges.
- Product
- Guardian Digital Webtool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpatches.sgi.comarchives.neohapsis.com
Jul 23, 2002DansGuardian before 2.4.5-1 allows remote attackers to bypass content filtering rules via hex-encoded URLs.CVE-2002-1599 · Other software · Daniel Barron · reported by MITREHigh 7.5
DansGuardian before 2.4.5-1 allows remote attackers to bypass content filtering rules via hex-encoded URLs.
- Product
- Dansguardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddansguardian.orgdansguardian.org
Oct 18, 2001Guardian Digital WebTool in EnGarde Secure Linux 1.0.1 allows restarted services to inherit some environmental variables, which could allow local users to gain CVE-2001-0739 · Other software · Engardelinux · reported by MITREHigh 7.2
Guardian Digital WebTool in EnGarde Secure Linux 1.0.1 allows restarted services to inherit some environmental variables, which could allow local users to gain root privileges.
- Product
- Secure Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlinuxsecurity.comredhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.