Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
143 results · page 3 of 3
Feb 20, 2020An issue was discovered in Open Network Operating System (ONOS) 1.14.CVE-2019-16302 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the Ethernet VPN application (org.onosproject.evpnopenflow), the host event listener does not handle the following event types: HOST_MOVED, HOST_UPDATED. In combination with other applications, this could lead to the absence of intended code execution.
- Product
- Open Network Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordndss-symposium.orgndss-symposium.org
Feb 20, 2020An issue was discovered in Open Network Operating System (ONOS) 1.14.CVE-2019-16301 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the virtual tenant network application (org.onosproject.vtn), the host event listener does not handle the following event types: HOST_MOVED. In combination with other applications, this could lead to the absence of intended code execution.
- Product
- Open Network Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordndss-symposium.orgndss-symposium.org
Feb 20, 2020An issue was discovered in Open Network Operating System (ONOS) 1.14.CVE-2019-16300 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the access control application (org.onosproject.acl), the host event listener does not handle the following event types: HOST_REMOVED. In combination with other applications, this could lead to the absence of intended code execution.
- Product
- Open Network Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordndss-symposium.orgndss-symposium.org
Feb 20, 2020An issue was discovered in Open Network Operating System (ONOS) 1.14.CVE-2019-16299 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the mobility application (org.onosproject.mobility), the host event listener does not handle the following event types: HOST_ADDED, HOST_REMOVED, HOST_UPDATED. In combination with other applications, this could lead to the absence of intended code execution.
- Product
- Open Network Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordndss-symposium.orgndss-symposium.org
Feb 20, 2020An issue was discovered in Open Network Operating System (ONOS) 1.14.CVE-2019-16298 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the virtual broadband network gateway application (org.onosproject.virtualbng), the host event listener does not handle the following event types: HOST_MOVED, HOST_REMOVED, HOST_UPDATED. In combination with other applications, this could lead to the absence of intended code execution.
- Product
- Open Network Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordndss-symposium.orgndss-symposium.org
Feb 20, 2020An issue was discovered in Open Network Operating System (ONOS) 1.14.CVE-2019-16297 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the P4 tutorial application (org.onosproject.p4tutorial), the host event listener does not handle the following event types: HOST_MOVED, HOST_REMOVED, HOST_UPDATED. In combination with other applications, this could lead to the absence of intended code execution.
- Product
- Open Network Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordndss-symposium.orgndss-symposium.org
Feb 20, 2020Authentication Bypass by Spoofing in org.onosproject.acl (access control) and org.onosproject.mobility (host mobility) in ONOS v2.0 and earlier allows attackersCVE-2019-11189 · Other software · Opennetworking · reported by MITREHigh 7.5
Authentication Bypass by Spoofing in org.onosproject.acl (access control) and org.onosproject.mobility (host mobility) in ONOS v2.0 and earlier allows attackers to bypass network access control via data plane packet injection. To exploit the vulnerability, an attacker sends a gratuitous ARP reply that causes the host mobility application to remove existing access control flow denial rules in the network. The access control application does not re-install flow deny rules, so the attacker can bypass the intended access control policy.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordndss-symposium.orgndss-symposium.org
Jan 30, 2020In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input fCVE-2020-8496 · Other software · Kronos · reported by MITREMedium 4.8
In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input field of the /ApplicationBanner page as an authenticated administrator.
- Product
- Web Time And Attendance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnolanbkennedy.comkronos.com
Jan 30, 2020In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with TimekeeperCVE-2020-8495 · Other software · Kronos · reported by MITREHigh 7.5
In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and delegatorUserId parameters.
- Product
- Web Time And Attendance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comnolanbkennedy.com
Jan 30, 2020In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with TimekeeperCVE-2020-8494 · Other software · Kronos · reported by MITREHigh 8.8
In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the emp_id, userid, pw1, pw2, supervisor, and timekeeper parameters.
- Product
- Web Time And Attendance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnolanbkennedy.comkronos.com
Jan 30, 2020A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message, BCVE-2020-8493 · Other software · Kronos · reported by MITREMedium 4.8
A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message, Banner Message, and Password Instructions) of the com.threeis.webta.H261configMenu servlet via an authenticated administrator.
- Product
- Web Time And Attendance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comnolanbkennedy.com
Oct 24, 2019clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management.CVE-2019-18418 · Other software · Clonos · reported by MITRECritical 9.8
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management.
- Product
- Clonos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 24, 2019A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via theCVE-2019-18419 · Other software · Clonos · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
- Product
- Clonos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2019The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes EAP Success messages before any EAP metCVE-2019-12586 · Other software · Espressif · reported by MITREMedium 6.5
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes EAP Success messages before any EAP method completion or failure, which allows attackers in radio range to cause a denial of service (crash) via a crafted message.
- Product
- Arduino-esp32
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2019The client 802.11 mac implementation in Espressif ESP8266_NONOS_SDK 2.2.0 through 3.1.0 does not validate correctly the RSN AuthKey suite list count in beacon fCVE-2019-12588 · Other software · Espressif · reported by MITREMedium 6.5
The client 802.11 mac implementation in Espressif ESP8266_NONOS_SDK 2.2.0 through 3.1.0 does not validate correctly the RSN AuthKey suite list count in beacon frames, probe responses, and association responses, which allows attackers in radio range to cause a denial of service (crash) via a crafted message.
- Product
- Arduino Esp8266
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2019The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a zero Pairwise MasterCVE-2019-12587 · Other software · Espressif · reported by MITREHigh 8.1
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a zero Pairwise Master Key (PMK) after the completion of any EAP authentication method, which allows attackers in radio range to replay, decrypt, or spoof frames via a rogue access point.
- Product
- Esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2019The WEB control panel before 2019-04-30 for ClonOS allows SQL injection in clonos.php.CVE-2019-15571 · Other software · Clonos Project · reported by MITRECritical 9.8
The WEB control panel before 2019-04-30 for ClonOS allows SQL injection in clonos.php.
- Product
- Clonos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2019The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation.CVE-2019-1010234 · Other software · The Linux Foundation · reported by josh@bress.netCritical 9.8
The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending malicious http request to the controller. The component is: Method runJavaCompiler in YangLiveCompilerManager.java. The attack vector is: network connectivity.
- Product
- ONOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Jul 19, 2019The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation.CVE-2019-1010245 · Other software · The Linux Foundation · reported by josh@bress.netCritical 9.8
The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A remote attacker can execute arbitrary commands on the controller. The component is: apps/yang/src/main/java/org/onosproject/yang/impl/YangLiveCompilerManager.java. The attack vector is: network connectivity. The fixed version is: 1.15.
- Product
- ONOS SDN Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgerrit.onosproject.org
Jul 18, 2019The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation.CVE-2019-1010252 · Other software · The Linux Foundation · reported by josh@bress.netMedium 4.9
The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: applyFlowRules() and apply() functions in FlowRuleManager.java. The attack vector is: network management and connectivity.
- Product
- ONOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Jul 18, 2019The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation.CVE-2019-1010250 · Other software · The Linux Foundation · reported by josh@bress.netMedium 4.9
The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: createFlow() and createFlows() functions in FlowWebResource.java (RESTful service). The attack vector is: network management and connectivity.
- Product
- ONOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Jul 18, 2019The Linux Foundation ONOS 2.0.0 and earlier is affected by: Integer Overflow.CVE-2019-1010249 · Other software · The Linux Foundation · reported by josh@bress.netMedium 4.9
The Linux Foundation ONOS 2.0.0 and earlier is affected by: Integer Overflow. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: createFlow() and createFlows() functions in FlowWebResource.java (RESTful service). The attack vector is: network management and connectivity.
- Product
- ONOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Jul 16, 2019In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings that can be used in a sCVE-2019-13624 · Other software · Onosproject · reported by MITRECritical 9.8
In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings that can be used in a shell command.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.onosproject.orggerrit.onosproject.org
Jun 21, 2019SQL injection vulnerability in ChronoScan version 1.5.4.3 and earlier allows an unauthenticated attacker to execute arbitrary SQL commands via the wcr_machineidCVE-2018-15868 · Other software · Chronoscan · reported by MITRECritical 9.8
SQL injection vulnerability in ChronoScan version 1.5.4.3 and earlier allows an unauthenticated attacker to execute arbitrary SQL commands via the wcr_machineid cookie.
- Product
- Chronoscan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchronoscan.orgredsec.io
Jan 9, 2019Insufficient data validation in crosh could lead to a command injection under chronos privileges in Networking in Google Chrome on Chrome OS prior to 61.0.3163.CVE-2017-15403 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 7.3
Insufficient data validation in crosh could lead to a command injection under chronos privileges in Networking in Google Chrome on Chrome OS prior to 61.0.3163.113 allowed a local attacker to execute arbitrary code via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Jul 23, 2018Open Networking Foundation (ONF) ONOS version 1.13.2 and earlier version contains a Directory Traversal vulnerability in core/common/src/main/java/org/onosprojeCVE-2018-1999020 · Other software · Opennetworking · reported by MITREMedium 5.5
Open Networking Foundation (ONF) ONOS version 1.13.2 and earlier version contains a Directory Traversal vulnerability in core/common/src/main/java/org/onosproject/common/app/ApplicationArchive.java line 35 that can result in arbitrary file deletion (overwrite). This attack appear to be exploitable via a specially crafted zip file should be uploaded.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgms.cl0udz.comgerrit.onosproject.org
Jul 9, 2018ONOS ONOS controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in onos\drivers\utilities\src\main\java\org\onosproject\driveCVE-2018-1000616 · Other software · Onosproject · reported by MITRECritical 9.8
ONOS ONOS controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in onos\drivers\utilities\src\main\java\org\onosproject\drivers\utilities\XmlConfigParser.java loadxml() that can result in An adversary can remotely launch XXE attacks on ONOS controller via an OpenConfig Terminal Device.. This attack appear to be exploitable via network connectivity.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgms.cl0udz.comgerrit.onosproject.org
Jul 9, 2018ONOS ONOS Controller version 1.13.1 and earlier contains a Denial of Service (Service crash) vulnerability in OVSDB component in ONOS that can result in An adveCVE-2018-1000615 · Other software · Onosproject · reported by MITREHigh 7.5
ONOS ONOS Controller version 1.13.1 and earlier contains a Denial of Service (Service crash) vulnerability in OVSDB component in ONOS that can result in An adversary can remotely crash OVSDB service ONOS controller via a normal switch.. This attack appear to be exploitable via the attacker should be able to control or forge a switch in the network..
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgms.cl0udz.comgerrit.onosproject.org
Jul 9, 2018ONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in providers/netconf/alarm/src/main/java/org/onosproject/provCVE-2018-1000614 · Other software · Onosproject · reported by MITRECritical 9.8
ONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in providers/netconf/alarm/src/main/java/org/onosproject/provider/netconf/alarm/NetconfAlarmTranslator.java that can result in An adversary can remotely launch advanced XXE attacks on ONOS controller without authentication.. This attack appear to be exploitable via crafted protocol message.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgms.cl0udz.comgerrit.onosproject.org
Jul 5, 2018Time-of-check to time-of-use (TOCTOU) race condition in org.onosproject.acl (aka the access control application) in ONOS v1.13 and earlier allows attackers to bCVE-2018-12691 · Other software · Onosproject · reported by MITREMedium 6.8
Time-of-check to time-of-use (TOCTOU) race condition in org.onosproject.acl (aka the access control application) in ONOS v1.13 and earlier allows attackers to bypass network access control via data plane packet injection.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.onosproject.orgwiki.onosproject.org
Jul 3, 2018The UPnP HTTP server on Sonos wireless speaker products allow unauthorized access via a DNS rebinding attack.CVE-2018-11316 · Other software · Sonos · reported by MITRECritical 9.6
The UPnP HTTP server on Sonos wireless speaker products allow unauthorized access via a DNS rebinding attack. This can result in remote device control and privileged device and network information to be exfiltrated by an attacker.
- Product
- Sonos Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2018A Stack-based Buffer Overflow issue was discovered in Emerson Process Management ControlWave Micro Process Automation Controller: ControlWave Micro [ProConOS v.CVE-2018-5452 · Other software · Emerson · reported by ics-cert@hq.dhs.govHigh 7.5
A Stack-based Buffer Overflow issue was discovered in Emerson Process Management ControlWave Micro Process Automation Controller: ControlWave Micro [ProConOS v.4.01.280] firmware: CWM v.05.78.00 and prior. A stack-based buffer overflow vulnerability caused by sending crafted packets on Port 20547 could force the PLC to change its state into halt mode.
- Product
- Controlwave Micro Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Aug 29, 2017ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated.CVE-2017-13763 · Other software · Onosproject · reported by MITREHigh 7.5
ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.onosproject.orggerrit.onosproject.org
Aug 29, 2017ONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS.CVE-2017-13762 · Other software · Onosproject · reported by MITREMedium 6.1
ONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.onosproject.orggerrit.onosproject.org
Aug 24, 2017ONOS before 1.5.0 when using the ifwd app allows remote attackers to cause a denial of service (NULL pointer dereference and switch disconnect) by sending two ECVE-2015-7516 · Other software · Onosproject · reported by Red HatHigh 7.5
ONOS before 1.5.0 when using the ifwd app allows remote attackers to cause a denial of service (NULL pointer dereference and switch disconnect) by sending two Ethernet frames with ether_type Jumbo Frame (0x8870).
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Jul 17, 2017Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code execution.CVE-2017-1000081 · Other software · Onosproject · reported by MITRECritical 9.8
Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code execution.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.onosproject.orgwiki.onosproject.org
Jul 17, 2017Linux foundation ONOS 1.9.0 allows unauthenticated use of websockets.CVE-2017-1000080 · Other software · Onosproject · reported by MITREHigh 7.5
Linux foundation ONOS 1.9.0 allows unauthenticated use of websockets.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.onosproject.orgwiki.onosproject.org
Jul 17, 2017Linux foundation ONOS 1.9.0 is vulnerable to a DoS.CVE-2017-1000079 · Other software · Onosproject · reported by MITREHigh 7.5
Linux foundation ONOS 1.9.0 is vulnerable to a DoS.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.onosproject.orgwiki.onosproject.org
Jul 17, 2017Linux foundation ONOS 1.9 is vulnerable to XSS in the device.CVE-2017-1000078 · Other software · Onosproject · reported by MITREMedium 6.1
Linux foundation ONOS 1.9 is vulnerable to XSS in the device. registration
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.onosproject.orgwiki.onosproject.org
Jan 16, 2015Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant trafficCVE-2014-9195 · Other software · Phoenix Contact · reported by ics-cert@hq.dhs.govHigh 10
Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.
- Product
- ProConOs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govexploit-db.com
Oct 19, 2010Untrusted search path vulnerability in XacRett before 50 allows attackers to execute arbitrary code via a Trojan horse executable file, related to the explorer.CVE-2010-3157 · Other software · Kmonos · reported by vultures@jpcert.or.jpHigh 9.3
Untrusted search path vulnerability in XacRett before 50 allows attackers to execute arbitrary code via a Trojan horse executable file, related to the explorer.exe filename and use of Windows Explorer.
- Product
- Xacrett
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2009Multiple cross-site scripting (XSS) vulnerabilities in Kronos webTA allow remote attackers to inject arbitrary web script or HTML via the description field to (CVE-2008-6666 · Other software · Kronos · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Kronos webTA allow remote attackers to inject arbitrary web script or HTML via the description field to (1) servlet/com.threeis.webta.H710selProject and (2) servlet/com.threeis.webta.H720editProjectInfo. NOTE: BID:29610 states that the initial report was incorrect, but the reason for this conclusion is unknown.
- Product
- Kronos Webta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2007PHP remote file inclusion vulnerability in fw/class.Quick_Config_Browser.php in Cadre PHP Framework 20020724 allows remote attackers to execute arbitrary PHP coCVE-2007-0677 · Other software · Cronosys · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in fw/class.Quick_Config_Browser.php in Cadre PHP Framework 20020724 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[config][framework_path] parameter.
- Product
- Cadre PHP Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.