Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
150 results · page 3 of 3
May 28, 2021The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.CVE-2021-33587 · Other software · Css-what Project · reported by MITREHigh 7.5
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
- Product
- Css-what
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Feb 17, 2021The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0.CVE-2021-26697 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0.
- Product
- Apache Airflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Dec 15, 2020In priorLinearAllocation of C2AllocatorIon.cpp, there is a possible use-after-free due to improper locking.CVE-2020-27035 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In priorLinearAllocation of C2AllocatorIon.cpp, there is a possible use-after-free due to improper locking. This could lead to local information disclosure in the media codec with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-152239213
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Feb 11, 2020The KRandom::random function in KDE Paste Applet after 4.10.5 in kdeplasma-addons uses the GNU C Library rand function's linear congruential generator, which maCVE-2013-2213 · Other software · KDE · reported by Red HatMedium 5.5
The KRandom::random function in KDE Paste Applet after 4.10.5 in kdeplasma-addons uses the GNU C Library rand function's linear congruential generator, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the generator output.
- Product
- Paste Applet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Dec 11, 2019An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via degenerate chains of linear pagetables, because ofCVE-2019-19578 · Other software · XEN · reported by MITREHigh 8.8
An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via degenerate chains of linear pagetables, because of an incorrect fix for CVE-2017-15595. "Linear pagetables" is a technique which involves either pointing a pagetable at itself, or to another pagetable of the same or higher level. Xen has limited support for linear pagetables: A page may either point to itself, or point to another pagetable of the same level (i.e., L2 to L2, L3 to L3, and so on). XSA-240 introduced an additional restriction that limited the "depth" of such chains by allowing pages to either *point to* other pages of the same level, or *be pointed to* by other pages of the same level, but not both. To implement this, we keep track of the number of outstanding times a page points to or is pointed to another page table, to prevent both from happening at the same time. Unfortunately, the original commit introducing this reset this count when resuming validation of a partially-validated pagetable, incorrectly dropping some "linear_pt_entry" counts. If an attacker could engineer such a situation to occur, they might be able to make loops or other arbitrary chains
- Product
- XEN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.fedoraproject.org
Sep 25, 2019An issue was discovered in the linea crate through 0.9.4 for Rust.CVE-2019-16880 · Other software · Linea Project · reported by MITRECritical 9.8
An issue was discovered in the linea crate through 0.9.4 for Rust. There is double free in the Matrix::zip_elements method.
- Product
- Linea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 30, 2019Datalogic AV7000 Linear barcode scanner all versions prior to 4.6.0.0 is vulnerable to authentication bypass, which may allow an attacker to remotely execute arCVE-2019-13526 · Other software · Datalogic · reported by ics-cert@hq.dhs.govHigh 8.8
Datalogic AV7000 Linear barcode scanner all versions prior to 4.6.0.0 is vulnerable to authentication bypass, which may allow an attacker to remotely execute arbitrary code.
- Product
- Av7000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Jul 23, 2019LineageOS 16.0 and earlier is affected by: Incorrect Access Control.CVE-2019-1010221 · Other software · LineageOS · reported by josh@bress.netMedium 6.8
LineageOS 16.0 and earlier is affected by: Incorrect Access Control. The impact is: The property checked by `adb root` can also be set in a normal adb shell session. The component is: adb shell (patches to fix this are at https://review.lineageos.org/c/LineageOS/android_system_core/+/234800, https://review.lineageos.org/c/LineageOS/android_device_lineage_sepolicy/+/234799). The attack vector is: When adb is enabled, and an attacker has physical access, `adb shell setprop service.adb.root 1` allows restarting adb as root.
- Product
- LineageOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 2, 2019Linear eMerge E3-Series devices allow Privilege Escalation.CVE-2019-7258 · Other software · Nortekcontrol · reported by MITREHigh 8.8
Linear eMerge E3-Series devices allow Privilege Escalation.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow Unrestricted File Upload.CVE-2019-7257 · Other software · Nortekcontrol · reported by MITRECritical 10
Linear eMerge E3-Series devices allow Unrestricted File Upload.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Nice Linear eMerge E3-Series OS Command Injection VulnerabilityCVE-2019-7256 · Other software · Nice · reported by MITREExploitedCritical 9.8
Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution.
- Product
- Linear eMerge E3-Series
- On CISA’s list since
- Mar 25, 2024 (federal fix deadline Apr 15, 2024)
- What to do
- Attackers are using this now. Install Nice’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Jul 2, 2019Linear eMerge E3-Series devices allow XSS.CVE-2019-7255 · Other software · Nortekcontrol · reported by MITREMedium 6.1
Linear eMerge E3-Series devices allow XSS.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow File Inclusion.CVE-2019-7254 · Other software · Nortekcontrol · reported by MITREHigh 7.5
Linear eMerge E3-Series devices allow File Inclusion.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow Directory Traversal.CVE-2019-7253 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices allow Directory Traversal.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices have Default Credentials.CVE-2019-7252 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices have Default Credentials.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).CVE-2019-7262 · Other software · Nortekcontrol · reported by MITREHigh 8.8
Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices have Hard-coded Credentials.CVE-2019-7261 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices have Hard-coded Credentials.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices have Cleartext Credentials in a Database.CVE-2019-7260 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices have Cleartext Credentials in a Database.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure.CVE-2019-7259 · Other software · Nortekcontrol · reported by MITREHigh 8.8
Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge 50P/5000P devices allow Cross-Site Request Forgery (CSRF).CVE-2019-7270 · Other software · Nortekcontrol · reported by MITREHigh 8.8
Linear eMerge 50P/5000P devices allow Cross-Site Request Forgery (CSRF).
- Product
- Linear Emerge 50p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Jul 2, 2019Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution.CVE-2019-7269 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution.
- Product
- Linear Emerge 50p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge 50P/5000P devices allow Unauthenticated File Upload.CVE-2019-7268 · Other software · Nortekcontrol · reported by MITRECritical 10
Linear eMerge 50P/5000P devices allow Unauthenticated File Upload.
- Product
- Linear Emerge 50p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge 50P/5000P devices allow Cookie Path Traversal.CVE-2019-7267 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge 50P/5000P devices allow Cookie Path Traversal.
- Product
- Linear Emerge 50p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge 50P/5000P devices allow Authentication Bypass.CVE-2019-7266 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge 50P/5000P devices allow Authentication Bypass.
- Product
- Linear Emerge 50p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH).CVE-2019-7265 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH).
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices allow a Stack-based Buffer Overflow on the ARM platform.CVE-2019-7264 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices allow a Stack-based Buffer Overflow on the ARM platform.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Jul 2, 2019Linear eMerge E3-Series devices have a Version Control Failure.CVE-2019-7263 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Linear eMerge E3-Series devices have a Version Control Failure.
- Product
- Linear Emerge Essential Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Jul 1, 2019In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attackeCVE-2019-13147 · Other software · Audiofile · reported by MITREMedium 6.5
In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.
- Product
- Audiofile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 1, 2019Nortek Linear eMerge 50P/5000P devices have Default Credentials.CVE-2019-7271 · Other software · Nortekcontrol · reported by MITRECritical 9.8
Nortek Linear eMerge 50P/5000P devices have Default Credentials.
- Product
- Linear Emerge 50p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comapplied-risk.com
Apr 15, 2019When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulneraCVE-2019-0232 · Websites & servers · Apache · reported by security@apache.orgHigh 8.1
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).
- Product
- Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 9, 2018In Impact and Lineage Analysis in SAP Data Services, version 4.2, the management console does not sufficiently validate user-controlled inputs, which results inCVE-2018-2466 · Network & remote access · SAP · reported by cna@sap.comMedium 5.4
In Impact and Lineage Analysis in SAP Data Services, version 4.2, the management console does not sufficiently validate user-controlled inputs, which results in Cross-Site Scripting (XSS) vulnerability.
- Product
- SAP Data Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comlaunchpad.support.sap.com
Feb 19, 2018A Command Injection issue was discovered in Nortek Linear eMerge E3 series Versions V0.32-07e and prior.CVE-2018-5439 · Other software · Nortekcontrol · reported by ics-cert@hq.dhs.govCritical 9.8
A Command Injection issue was discovered in Nortek Linear eMerge E3 series Versions V0.32-07e and prior. A remote attacker may be able to execute arbitrary code on a target machine with elevated privileges.
- Product
- Emerge E3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Jun 16, 2017The msm_bus_dbg_update_request_write function in drivers/platform/msm/msm_bus/msm_bus_dbg.c in android_kernel_huawei_msm8916 through 2017-06-16 in LineageOS, anCVE-2017-6899 · Other software · Lineageos · reported by MITREMedium 6.2
The msm_bus_dbg_update_request_write function in drivers/platform/msm/msm_bus/msm_bus_dbg.c in android_kernel_huawei_msm8916 through 2017-06-16 in LineageOS, and possibly other kernels for MSM devices, allows attackers to cause a denial of service (NULL pointer dereference and device crash) via a crafted /sys/kernel/debug/msm-bus-dbg/client-data/update-request write request.
- Product
- Lineageos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.secret-team.cnsecurityfocus.com
Mar 20, 2017Heap-based buffer overflow in the ulaw2linear_buf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0, 0.CVE-2017-6834 · Other software · Audiofile · reported by MITREMedium 5.5
Heap-based buffer overflow in the ulaw2linear_buf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0, 0.2.7 allows remote attackers to cause a denial of service (crash) via a crafted file.
- Product
- Audiofile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgopenwall.com
Mar 20, 2017Heap-based buffer overflow in the alaw2linear_buf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of CVE-2017-6830 · Other software · Audiofile · reported by MITREMedium 5.5
Heap-based buffer overflow in the alaw2linear_buf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.
- Product
- Audiofile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgopenwall.com
Sep 21, 2015Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear algorithm for selecting CVE-2015-7296 · Other software · Securifi · reported by cret@cert.orgMedium 4.3
Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear algorithm for selecting the ID value in the header of a DNS query performed on behalf of the device itself, which makes it easier for remote attackers to spoof responses by including this ID value, as demonstrated by a response containing the address of the firmware update server, a different vulnerability than CVE-2015-2914.
- Product
- Almond Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Jun 15, 2015Cross-site scripting (XSS) vulnerability in the Linear Case module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with certain permissions CVE-2015-4380 · Other software · Linear Case Project · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the Linear Case module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Linear Case
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Nov 19, 2014Use-after-free vulnerability in the CPDF_Parser::IsLinearizedFile function in fpdfapi/fpdf_parser/fpdf_parser_parser.cpp in PDFium, as used in Google Chrome befCVE-2014-7900 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 7.5
Use-after-free vulnerability in the CPDF_Parser::IsLinearizedFile function in fpdfapi/fpdf_parser/fpdf_parser_parser.cpp in PDFium, as used in Google Chrome before 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgooglechromereleases.blogspot.comsecurityfocus.com
Mar 11, 2011WebKit in Apple Safari before 5.0.4, when the Web Inspector is used, does not properly handle the window.console._inspectorCommandLineAPI property, which allowsCVE-2011-0169 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 2.6
WebKit in Apple Safari before 5.0.4, when the Web Inspector is used, does not properly handle the window.console._inspectorCommandLineAPI property, which allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted web site.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comsupport.apple.com
Jun 25, 2010The Linear eMerge 50 and 5000 uses a default password of eMerge for the IEIeMerge account, which makes it easier for remote attackers to obtain Video Recorder dCVE-2010-2469 · Other software · Linearcorp · reported by MITREMedium 5
The Linear eMerge 50 and 5000 uses a default password of eMerge for the IEIeMerge account, which makes it easier for remote attackers to obtain Video Recorder data by establishing a session to the device.
- Product
- Emerge 50
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblip.tvdarkreading.com
Jun 25, 2010The S2 Security NetBox 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, uses a weak hash algorithm for storing the Administrator CVE-2010-2468 · Other software · S2sys · reported by MITREHigh 10
The S2 Security NetBox 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, uses a weak hash algorithm for storing the Administrator password, which makes it easier for context-dependent attackers to obtain privileged access by recovering the cleartext of this password.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblip.tvdarkreading.com
Jun 25, 2010The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not require setting a password for the FTPCVE-2010-2467 · Other software · S2sys · reported by MITREMedium 5
The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not require setting a password for the FTP server that stores database backups, which makes it easier for remote attackers to download backup files via unspecified FTP requests.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblip.tvdarkreading.com
Jun 25, 2010The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not properly prevent downloading of databaCVE-2010-2466 · Other software · S2sys · reported by MITREMedium 5
The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not properly prevent downloading of database backups, which allows remote attackers to obtain sensitive information via requests for full_*.dar files with predictable filenames.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblip.tvdarkreading.com
Jun 25, 2010The S2 Security NetBox 2.5, 3.3, and 4.0, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, stores sensitive information under the web root witCVE-2010-2465 · Other software · S2sys · reported by MITREMedium 5
The S2 Security NetBox 2.5, 3.3, and 4.0, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download node logs, photographs of persons, and backup files via unspecified HTTP requests.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2010The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to gueCVE-2010-1128 · Websites & servers · PHP · reported by MITREMedium 6.4
The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function.
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Jan 5, 2010Unspecified vulnerability in the management console in the S2 Security Linear eMerge Access Control System 2.5.x allows remote attackers to cause a denial of seCVE-2009-3734 · Other software · S2sys · reported by cret@cert.orgMedium 5
Unspecified vulnerability in the management console in the S2 Security Linear eMerge Access Control System 2.5.x allows remote attackers to cause a denial of service (configuration reset) via a request to a crafted URI.
- Product
- Linear Emerge Access Control System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2009Cross-site scripting (XSS) vulnerability in public/index.php in Linea21 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the search paraCVE-2009-2442 · Other software · Linea21 · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in public/index.php in Linea21 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the search parameter in a resultats-recherche action.
- Product
- Linea21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.compacketstormsecurity.com
May 14, 2007Unspecified vulnerability in the ID Automation Linear Barcode 1.6.0.5 ActiveX control in IDAutomationLinear6.dll allows remote attackers to cause a denial of seCVE-2007-2658 · Other software · ID Automation · reported by MITREHigh 7.8
Unspecified vulnerability in the ID Automation Linear Barcode 1.6.0.5 ActiveX control in IDAutomationLinear6.dll allows remote attackers to cause a denial of service via a long argument to the SaveEnhWMF method.
- Product
- Linear Barcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmoaxb.blogspot.comosvdb.org
Nov 20, 2001Linear key exchange process in High-bandwidth Digital Content Protection (HDCP) System allows remote attackers to access data as plaintext, avoid device blackliCVE-2001-0903 · Other software · Intel · reported by MITREHigh 7.5
Linear key exchange process in High-bandwidth Digital Content Protection (HDCP) System allows remote attackers to access data as plaintext, avoid device blacklists, clone devices, and create new device keyvectors by computing and using alternate key combinations for authentication.
- Product
- High-bandwidth Digital Content Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 1999Vulnerability in StackGuard before 1.21 allows remote attackers to bypass the Random and Terminator Canary security mechanisms by using a non-linear attack whicCVE-1999-1111 · Other software · Immunix · reported by MITREHigh 7.5
Vulnerability in StackGuard before 1.21 allows remote attackers to bypass the Random and Terminator Canary security mechanisms by using a non-linear attack which directly modifies a pointer to a return address instead of using a buffer overflow to reach the return address entry itself.
- Product
- Stackguard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.