Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
153 results · page 3 of 4
Feb 18, 2022Pexip Infinity Connect before 1.8.0 omits certain provisioning authenticity checks.CVE-2021-29655 · Other software · Pexip · reported by MITRECritical 9.8
Pexip Infinity Connect before 1.8.0 omits certain provisioning authenticity checks. Thus, untrusted code may execute.
- Product
- Infinity Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Feb 9, 2022Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmdCVE-2021-46354 · Other software · Cybelesoft · reported by MITREHigh 7.5
Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increase the attack surface.
- Product
- Thinfinity Virtualui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 28, 2022Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.CVE-2021-27654 · Other software · Pegasystems · reported by security@pega.comHigh 7.8
Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcollaborate.pega.comcollaborate.pega.com
Jan 15, 2022Pexip Infinity before 26.2 allows temporary remote Denial of Service (abort) because of missing call-setup input validation.CVE-2021-42555 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 26.2 allows temporary remote Denial of Service (abort) because of missing call-setup input validation.
- Product
- Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jan 15, 2022Pexip Infinity before 26 allows temporary remote Denial of Service (abort) because of missing call-setup input validation.CVE-2021-35969 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 26 allows temporary remote Denial of Service (abort) because of missing call-setup input validation.
- Product
- Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jan 15, 2022Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 2 of 2).CVE-2021-33499 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 2 of 2).
- Product
- Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jan 15, 2022Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 1 of 2).CVE-2021-33498 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 1 of 2).
- Product
- Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jan 15, 2022Pexip Infinity before 26 allows remote denial of service because of missing RTMP input validation.CVE-2021-32545 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 26 allows remote denial of service because of missing RTMP input validation.
- Product
- Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Dec 20, 2021Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI.CVE-2021-44554 · Other software · Cybelesoft · reported by MITREMedium 5.3
Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI. By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to the configuration of VirtualUI. Common users are administrator, admin, guest and krgtbt.
- Product
- Thinfinity Virtualui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter.CVE-2021-45092 · Other software · Cybelesoft · reported by MITRECritical 9.8
Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter.
- Product
- Thinfinity Virtualui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 12, 2021In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exiCVE-2021-44848 · Other software · Cybelesoft · reported by MITREMedium 5.3
In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists.
- Product
- Thinfinity Virtualui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Nov 5, 2021Irfanview v4.53 was discovered to contain an infinity loop via JPEG2000!ShowPlugInSaveOptions_W+0x1ecd8.CVE-2020-23566 · Other software · Irfanview · reported by MITREMedium 5.5
Irfanview v4.53 was discovered to contain an infinity loop via JPEG2000!ShowPlugInSaveOptions_W+0x1ecd8.
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2021Pexip Infinity 25.x before 25.4 has Improper Input Validation, and thus an unauthenticated remote attacker can cause a denial of service via the administrative CVE-2021-31925 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity 25.x before 25.4 has Improper Input Validation, and thus an unauthenticated remote attacker can cause a denial of service via the administrative web interface.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 7, 2021Pexip Infinity 22.x through 24.x before 24.2 has Improper Input Validation for call setup.CVE-2020-25868 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity 22.x through 24.x before 24.2 has Improper Input Validation for call setup. An unauthenticated remote attacker can trigger a software abort (temporary loss of service).
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Apr 29, 2021In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.CVE-2021-27651 · Other software · Pegasystems · reported by security@pega.comCritical 9.8
In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcollaborate.pega.comcollaborate.pega.com
Apr 1, 2021Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure.CVE-2021-27653 · Other software · Pega Systems · reported by security@pega.comMedium 6.6
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcollaborate.pega.comrobertwillishacking.com
Nov 23, 2020Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackCVE-2020-26890 · Other software · Matrix · reported by MITREHigh 7.5
Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such a malformed event is accepted into the room's state, the impact is long-lasting and is not fixed by an upgrade to a newer version, requiring the event to be manually redacted instead. Since events are replicated to servers of other room members, the impact is not constrained to the server of the event sender.
- Product
- Synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Sep 25, 2020Pexip Infinity before 24.1 has Improper Input Validation, leading to temporary denial of service via SIP.CVE-2020-24615 · Other software · Pexip · reported by MITREMedium 5.3
Pexip Infinity before 24.1 has Improper Input Validation, leading to temporary denial of service via SIP.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.compexip.com
Sep 25, 2020Pexip Infinity before 23.4 has a lack of input validation, leading to temporary denial of service via H.323.CVE-2020-13387 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 23.4 has a lack of input validation, leading to temporary denial of service via H.323.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.compexip.com
Sep 25, 2020Pexip Infinity 23.x before 23.3 has improper input validation, leading to a temporary software abort via RTP.CVE-2020-12824 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity 23.x before 23.3 has improper input validation, leading to a temporary software abort via RTP.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.compexip.com
Sep 25, 2020Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN.CVE-2020-11805 · Other software · Pexip · reported by MITRECritical 9.8
Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Sep 25, 2020Pexip Infinity before 20.1 allows privilege escalation by restoring a system backup.CVE-2019-7178 · Other software · Pexip · reported by MITREHigh 7.2
Pexip Infinity before 20.1 allows privilege escalation by restoring a system backup.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Sep 25, 2020Pexip Infinity before 20.1 allows Code Injection onto nodes via an admin.CVE-2019-7177 · Other software · Pexip · reported by MITREHigh 7.2
Pexip Infinity before 20.1 allows Code Injection onto nodes via an admin.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Sep 25, 2020Pexip Infinity before 18 allows remote Denial of Service (XML parsing).CVE-2018-10585 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 18 allows remote Denial of Service (XML parsing).
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Sep 25, 2020Pexip Infinity before 18 allows Remote Denial of Service (TLS handshakes in RTMP).CVE-2018-10432 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 18 allows Remote Denial of Service (TLS handshakes in RTMP).
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Sep 25, 2020Pexip Infinity before 17 allows an unauthenticated remote attacker to achieve stored XSS via management web interface views.CVE-2017-17477 · Other software · Pexip · reported by MITREMedium 6.1
Pexip Infinity before 17 allows an unauthenticated remote attacker to achieve stored XSS via management web interface views.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.compexip.com
Sep 23, 2020The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request.CVE-2015-4719 · Other software · Pexip · reported by MITRECritical 9.8
The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jun 30, 2020An issue was discovered in Activision Infinity Ward Call of Duty Modern Warfare 2 through 2019-12-11.CVE-2019-20893 · Other software · Activision · reported by MITRECritical 9.8
An issue was discovered in Activision Infinity Ward Call of Duty Modern Warfare 2 through 2019-12-11. PartyHost_HandleJoinPartyRequest has a buffer overflow vulnerability and can be exploited by using a crafted joinParty packet. This can be utilized to conduct arbitrary code execution on a victim's machine.
- Product
- Call Of Duty Modern Warfare 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2020Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?miCVE-2019-16385 · Other software · Cybelesoft · reported by MITREMedium 6.1
Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?mimetype= substring. The victim user must load an application request to view a PDF, containing the malicious payload. This results in a reflected XSS payload being executed.
- Product
- Thinfinity Virtualui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.nettitude.comlabs.nettitude.com
Jun 4, 2020Cybele Thinfinity VirtualUI 2.5.17.2 allows ../ path traversal that can be used for data exfiltration.CVE-2019-16384 · Other software · Cybelesoft · reported by MITREMedium 6.5
Cybele Thinfinity VirtualUI 2.5.17.2 allows ../ path traversal that can be used for data exfiltration. This enables files outside of the web directory to be retrieved if the exact location is known and the user has permissions.
- Product
- Thinfinity Virtualui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.nettitude.comlabs.nettitude.com
Nov 14, 2019The Hisense F17 Android device with a build fingerprint of Hisense/F17_4G/HS6739MT:8.1.0/O11019/Hisense_F17_4G_00_S01:user/release-keys contains a pre-installedCVE-2019-15372 · Other software · Hisense · reported by MITREMedium 5.5
The Hisense F17 Android device with a build fingerprint of Hisense/F17_4G/HS6739MT:8.1.0/O11019/Hisense_F17_4G_00_S01:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
- Product
- Infinity F17 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkryptowire.comkryptowire.com
Nov 14, 2019The Hisense U965 Android device with a build fingerprint of Hisense/U965_4G_10/HS6739MT:8.1.0/O11019/Hisense_U965_4G_10_S01:user/release-keys contains a pre-insCVE-2019-15360 · Other software · Hisense · reported by MITREMedium 5.5
The Hisense U965 Android device with a build fingerprint of Hisense/U965_4G_10/HS6739MT:8.1.0/O11019/Hisense_U965_4G_10_S01:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
- Product
- Infinity U965 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkryptowire.comkryptowire.com
Sep 10, 2019The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter.CVE-2017-18599 · WordPress plugins & themes · reported by MITREMedium 6.1
The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter.
- Product
- Pinfinity
- Fixed in
- 2.0
- What to do
- Update Pinfinity to 2.0 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Apr 19, 2019SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, whCVE-2018-20817 · Other software · Activision · reported by MITRECritical 9.8
SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, which allows one to execute code on the remote target machine when sending a steam authentication request. This affects Call of Duty: Modern Warfare 2, Call of Duty: Modern Warfare 3, Call of Duty: Ghosts, Call of Duty: Advanced Warfare, Call of Duty: Black Ops 1, and Call of Duty: Black Ops 2.
- Product
- Call Of Duty\
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2019Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions.CVE-2018-19014 · Other software · ICS-CERT · reported by ics-cert@hq.dhs.govMedium 6.5
Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. Log files are accessible over an unauthenticated network connection. By accessing the log files, an attacker is able to gain insights about internals of the patient monitor, the location of the monitor, and wired network configuration.
- Product
- Dräger Infinity Delta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Jan 28, 2019Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions.CVE-2018-19010 · Other software · ICS-CERT · reported by ics-cert@hq.dhs.govMedium 6.5
Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. A malformed network packet may cause the monitor to reboot. By repeatedly sending the malformed network packet, an attacker may be able to disrupt patient monitoring by causing the monitor to repeatedly reboot until it falls back to default configuration and loses network connectivity.
- Product
- Dräger Infinity Delta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Jan 28, 2019Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions.CVE-2018-19012 · Other software · ICS-CERT · reported by ics-cert@hq.dhs.govHigh 7.8
Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. Via a specific dialog it is possible to break out of the kiosk mode and reach the underlying operating system. By breaking out of the kiosk mode, an attacker is able to take control of the operating system.
- Product
- Dräger Infinity Delta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Jul 24, 2018Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leak.CVE-2018-5386 · Other software · Navarino · reported by cret@cert.orgHigh 7.5
Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leak.
- Product
- Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.commedium.com
Jul 24, 2018Navarino Infinity is prone to session fixation attacks.CVE-2018-5385 · Other software · Navarino · reported by cret@cert.orgHigh 8.8
Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authentication in some installations. This could lead to phishing attacks that can bypass the two factor authentication that is present in some installations.
- Product
- Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.commedium.com
Jul 24, 2018Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection.CVE-2018-5384 · Other software · Navarino · reported by cret@cert.orgCritical 9.8
Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available with no authentication.
- Product
- Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.commedium.com
Jun 11, 2018An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result "POINT_AT_INFINITY" when CVE-2017-7781 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.9
An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result "POINT_AT_INFINITY" when it should not. A man-in-the-middle attacker could use this to interfere with a connection, resulting in an attacked party computing an incorrect shared secret. This vulnerability affects Firefox < 55.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 3, 2018Stack-based buffer overflow in Activision Infinity Ward Call of Duty Modern Warfare 2 before 2018-04-26 allows remote attackers to execute arbitrary code via crCVE-2018-10718 · Other software · Activision · reported by MITRECritical 10
Stack-based buffer overflow in Activision Infinity Ward Call of Duty Modern Warfare 2 before 2018-04-26 allows remote attackers to execute arbitrary code via crafted packets.
- Product
- Call Of Duty Modern Warfare 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commomo5502.com
Oct 6, 2017Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers to download arbitraCVE-2015-1429 · Other software · Cybelesoft · reported by MITREHigh 7.5
Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers to download arbitrary files via a .. (dot dot) in an unspecified parameter.
- Product
- Thinfinity Remote Desktop Workstation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybelesoft.comperspectiverisk.com
Jul 21, 2017libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors.CVE-2015-3886 · Other software · Libinfinity Project · reported by MITRECritical 9.8
libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors.
- Product
- Libinfinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgbugs.debian.org
Jun 19, 2017The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maCVE-2017-1000371 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance between the end of the PIE binary's read-write segment and the start of the stack becomes small enough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to i386 based systems.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Jun 19, 2017The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but does notCVE-2017-1000365 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation. This affects Linux Kernel versions 4.11.5 and earlier. It appears that this feature was introduced in the Linux Kernel version 2.6.23.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2017Pexip Infinity before 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary code via vectors related to Conferencing CVE-2017-6551 · Other software · Pexip · reported by MITRECritical 9.8
Pexip Infinity before 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary code via vectors related to Conferencing Nodes.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.compexip.com
Feb 3, 2015Pexip Infinity before 8 uses the same SSH host keys across different customers' installations, which allows man-in-the-middle attackers to spoof Management and CVE-2014-8779 · Other software · Pexip · reported by MITREHigh 7.1
Pexip Infinity before 8 uses the same SSH host keys across different customers' installations, which allows man-in-the-middle attackers to spoof Management and Conferencing Nodes by leveraging these keys.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compexip.com
Nov 16, 2009cp/profile.php in VivaPrograms Infinity 2.0.5 and earlier does not require administrative authentication for the donewauthor action, which allows remote attackeCVE-2009-3949 · Other software · Vivaprograms · reported by MITREHigh 7.5
cp/profile.php in VivaPrograms Infinity 2.0.5 and earlier does not require administrative authentication for the donewauthor action, which allows remote attackers to create administrative accounts via the name, password, and conf_password parameters.
- Product
- Infinity Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexchange.xforce.ibmcloud.com
Sep 16, 2009SQL injection vulnerability in VivaPrograms Infinity Script 2.x.x, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands CVE-2009-3212 · Other software · Dimofinf · reported by MITREMedium 6.8
SQL injection vulnerability in VivaPrograms Infinity Script 2.x.x, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username field.
- Product
- Infinity Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgexchange.xforce.ibmcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.