Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 26 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list
36added in the last 30 days
479new WordPress flaws this week
390,525entries in the database

137 results · page 3 of 3

  • Aug 21, 2020Nessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted period in certain scenarios.CVE-2020-5774 · Other software · Tenable · reported by vulnreport@tenable.comHigh 7.1

    Nessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted period in certain scenarios. The lack of proper session expiration could allow attackers with local access to login into an existing browser session.

    Product
    Nessus
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 12, 2020Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web scCVE-2020-13278 · Other software · RosarioSIS · reported by cve@gitlab.comMedium 6.1

    Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web script via embedding javascript or HTML tags in a GET request.

    Product
    RosarioSIS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 15, 2020RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script.CVE-2020-15718 · Other software · Rosariosis · reported by MITREMedium 6.1

    RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script. A remote attacker could exploit this vulnerability using the include_inactive parameter in a crafted URL.

    Product
    Rosariosis
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 15, 2020RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script.CVE-2020-15717 · Other software · Rosariosis · reported by MITREMedium 6.1

    RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced parameter in a crafted URL.

    Product
    Rosariosis
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 15, 2020RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script.CVE-2020-15716 · Other software · Rosariosis · reported by MITREMedium 6.1

    RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script. A remote attacker could exploit this vulnerability using the tab parameter in a crafted URL.

    Product
    Rosariosis
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 14, 2020RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.CVE-2020-15721 · Other software · Rosariosis · reported by MITREMedium 6.1

    RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.

    Product
    Rosariosis
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 12, 2020Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which wouCVE-2020-6251 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5

    Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted.

    Product
    SAP BusinessObjects Business Intelligence Platform
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 29, 2020Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios.CVE-2020-11021 · Other software · actions · reported by GitHubMedium 6.3

    Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an authorization header 2. that request leads to a redirect (302) and 3. the redirect url redirects to another domain or hostname Then the authorization header will get passed to the other domain. The problem is fixed in version 1.0.8.

    Product
    http-client
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 3, 2019gen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in scenarios where CONFCVE-2019-11690 · Other software · Denx · reported by MITREMedium 5.9

    gen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in scenarios where CONFIG_RANDOM_UUID is enabled, and Das U-Boot is relied upon for UUID values of a GUID Partition Table of a boot device.

    Product
    U-boot
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 21, 2019RISI Gestao de Horarios v3201.09.08 rev.23 allows SQL Injection.CVE-2019-6491 · Other software · Risi · reported by MITREHigh 8.8

    RISI Gestao de Horarios v3201.09.08 rev.23 allows SQL Injection.

    Product
    Gestao DE Horarios
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 3, 2019Remedy AR System Server in BMC Remedy 7.1 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the idCVE-2018-19505 · Other software · BMC · reported by MITREMedium 6.5

    Remedy AR System Server in BMC Remedy 7.1 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the identity of a different user, because userdata.js in the WOI:WorkOrderConsole component allows a username substitution involving a UserData_Init call.

    Product
    Remedy Action Request System Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 18, 2018Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary user when the ID number is known.CVE-2018-19829 · Other software · Artica · reported by MITREMedium 6.5

    Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary user when the ID number is known.

    Product
    Integria IMS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 5, 2018HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseCVE-2018-19786 · Other software · Hashicorp · reported by MITREHigh 8.1

    HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported.

    Product
    Vault
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 16, 2018SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=[SQL] SQL Injection.CVE-2018-18763 · Other software · Saltos · reported by MITRECritical 9.8

    SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=[SQL] SQL Injection.

    Product
    Saltos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 1, 2018IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the CVE-2018-1672 · Other software · IBM · reported by psirt@us.ibm.comMedium 5

    IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the identity of a different user. IBM X-Force ID: 144958.

    Product
    WebSphere Portal
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 23, 2018GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, CVE-2018-15685 · Other software · Electronjs · reported by MITREHigh 8.1

    GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.

    Product
    Electron
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 21, 2017In all Qualcomm products with Android releases from CAF using the Linux kernel, potential use after free scenarios and race conditions can occur when accessing CVE-2017-9676 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comMedium 4.7

    In all Qualcomm products with Android releases from CAF using the Linux kernel, potential use after free scenarios and race conditions can occur when accessing global static variables without using a lock.

    Product
    Android
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 8, 2017Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to disclose information due to how strings are validated in specific scenarios, aka "Microsoft EdCVE-2017-8662 · Computers, phones & browsers · Microsoft Corporation · reported by secure@microsoft.comMedium 4.3

    Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to disclose information due to how strings are validated in specific scenarios, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8644 and CVE-2017-8652.

    Product
    Microsoft Edge
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 17, 2017Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON naCVE-2017-1000043 · Other software · Mapbox · reported by MITREMedium 6.1

    Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control

    Product
    Mapbox.js
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 17, 2017Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON NaCVE-2017-1000042 · Other software · Mapbox Project · reported by MITREMedium 6.1

    Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON Name.

    Product
    Mapbox
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 4, 2017Riverbed RiOS before 9.0.1 does not properly restrict shell access in single-user mode, which makes it easier for physically proximate attackers to obtain root CVE-2017-7307 · Other software · Riverbed · reported by MITREMedium 6.8

    Riverbed RiOS before 9.0.1 does not properly restrict shell access in single-user mode, which makes it easier for physically proximate attackers to obtain root privileges and access decrypted data by replacing the /opt/tms/bin/cli file.

    Product
    Rios
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 4, 2017Riverbed RiOS through 9.6.0 has a weak default password for the secure vault, which makes it easier for physically proximate attackers to defeat the secure-vaulCVE-2017-7306 · Other software · riverbed · reported by MITREMedium 6.4

    Riverbed RiOS through 9.6.0 has a weak default password for the secure vault, which makes it easier for physically proximate attackers to defeat the secure-vault protection mechanism by leveraging knowledge of the password algorithm and the appliance serial number. NOTE: the vendor believes that this does not meet the definition of a vulnerability. The product contains correct computational logic for supporting arbitrary password changes by customers; however, a password change is optional to meet different customers' needs

    Product
    rios
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 4, 2017Riverbed RiOS through 9.6.0 does not require a bootloader password, which makes it easier for physically proximate attackers to defeat the secure-vault protectiCVE-2017-7305 · Other software · riverbed · reported by MITREMedium 4.6

    Riverbed RiOS through 9.6.0 does not require a bootloader password, which makes it easier for physically proximate attackers to defeat the secure-vault protection mechanism via a crafted boot. NOTE: the vendor believes that this does not meet the definition of a vulnerability. The product contains correct computational logic for a bootloader password; however, this password is optional to meet different customers' needs

    Product
    rios
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 4, 2017Riverbed RiOS through 9.6.0 deletes the secure vault with the rm program (not shred or srm), which makes it easier for physically proximate attackers to obtain CVE-2017-5670 · Other software · Riverbed · reported by MITREMedium 4.6

    Riverbed RiOS through 9.6.0 deletes the secure vault with the rm program (not shred or srm), which makes it easier for physically proximate attackers to obtain sensitive information by reading raw disk blocks.

    Product
    Rios
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2014The Birthday widget in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14, in certain user-id sharing scenarios, doCVE-2013-6241 · Other software · Open-xchange · reported by MITREMedium 4

    The Birthday widget in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14, in certain user-id sharing scenarios, does not properly construct a SQL statement for next-year birthdays, which allows remote authenticated users to obtain sensitive birthday, displayname, firstname, and surname information via a birthdays action to api/contacts, aka bug 29315.

    Product
    Open-xchange Appsuite
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 29, 2014The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users tCVE-2014-8989 · Computers, phones & browsers · Linux · reported by MITREMedium 4.6

    The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.

    Product
    Linux Kernel
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 21, 2014The Touriosity Travelmag (aka com.magzter.touriositytravelmag) application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows manCVE-2014-4897 · Other software · Magzter · reported by cret@cert.orgMedium 5.4

    The Touriosity Travelmag (aka com.magzter.touriositytravelmag) application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

    Product
    Touriosity Travelmag
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 18, 2014The musica de barrios sonideros (aka com.nobexinc.wls_93155702.rc) application 3.3.10 for Android does not verify X.509 certificates from SSL servers, which allCVE-2014-7054 · Other software · Nobexrc · reported by cret@cert.orgMedium 5.4

    The musica de barrios sonideros (aka com.nobexinc.wls_93155702.rc) application 3.3.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

    Product
    Musica DE Barrios Sonideros
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 15, 2014The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5, and Artiva ArchiteCVE-2014-0348 · Other software · Ontariosystems · reported by cret@cert.orgLow 3.5

    The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5, and Artiva Architect 3.2 MR5, when the domain-name option is enabled, allows remote attackers to login to arbitrary domain accounts by using the corresponding username on a Windows client machine.

    Product
    Artiva Architect
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 16, 2009RioRey RIOS 4.6.6 and 4.7.0 uses an undocumented, hard-coded username (dbadmin) and password (sq!us3r) for an SSH tunnel, which allows remote attackers to gain CVE-2009-3710 · Other software · Riorey · reported by MITREHigh 10

    RioRey RIOS 4.6.6 and 4.7.0 uses an undocumented, hard-coded username (dbadmin) and password (sq!us3r) for an SSH tunnel, which allows remote attackers to gain privileges via port 8022.

    Product
    Rios
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 6, 2009CFNetwork in Apple Mac OS X 10.5 before 10.5.8 places an incorrect URL in a certificate warning in certain 302 redirection scenarios, which makes it easier for CVE-2009-1723 · Computers, phones & browsers · Apple · reported by MITREMedium 4.3

    CFNetwork in Apple Mac OS X 10.5 before 10.5.8 places an incorrect URL in a certificate warning in certain 302 redirection scenarios, which makes it easier for remote attackers to trick a user into visiting an arbitrary https web site by leveraging an open redirect vulnerability, a different issue than CVE-2009-2062.

    Product
    MAC OS X
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 6, 2008SQL injection vulnerability in php/leer_comentarios.php in FlashBlog allows remote attackers to execute arbitrary SQL commands via the articulo_id parameter.CVE-2008-2572 · Other software · Theflashblog · reported by MITREHigh 7.5

    SQL injection vulnerability in php/leer_comentarios.php in FlashBlog allows remote attackers to execute arbitrary SQL commands via the articulo_id parameter.

    Product
    Flashblog
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 15, 2008The SIP module in Ingate Firewall before 4.6.1 and SIParator before 4.6.1 does not reuse SIP media ports in unspecified call hold and send-only stream scenariosCVE-2008-0263 · Other software · Ingate · reported by MITREMedium 5

    The SIP module in Ingate Firewall before 4.6.1 and SIParator before 4.6.1 does not reuse SIP media ports in unspecified call hold and send-only stream scenarios, which allows remote attackers to cause a denial of service (port exhaustion) via unspecified vectors.

    Product
    Firewall
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 18, 2007ircu 2.10.12.05 and earlier does not properly synchronize a kick action in certain cross scenarios, which allows remote authenticated operators to prevent laterCVE-2007-4410 · Other software · Universal Ircd · reported by MITREMedium 6

    ircu 2.10.12.05 and earlier does not properly synchronize a kick action in certain cross scenarios, which allows remote authenticated operators to prevent later kick or de-op actions from non-local ops.

    Product
    Ircu
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 7, 2007Kaspersky Anti-Spam 3.0 MP1 before Critical Fix 2 (3.0.278.4) sets incorrect permissions for application files in certain upgrade scenarios, which might allow lCVE-2007-4206 · Other software · Kaspersky Lab · reported by MITREMedium 4.4

    Kaspersky Anti-Spam 3.0 MP1 before Critical Fix 2 (3.0.278.4) sets incorrect permissions for application files in certain upgrade scenarios, which might allow local users to gain privileges.

    Product
    Kaspersky Anti-spam
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 27, 2006SQL injection vulnerability in comentarios.php in AndoNET Blog 2004.09.02 allows remote attackers to execute arbitrary SQL commands via the entrada parameter.CVE-2006-0462 · Other software · Andonet · reported by MITREHigh 7.5

    SQL injection vulnerability in comentarios.php in AndoNET Blog 2004.09.02 allows remote attackers to execute arbitrary SQL commands via the entrada parameter.

    Product
    Andonet Blog
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 31, 2005BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain "heavy usage" scenarios, report incorrect severity levels for CVE-2005-4753 · Websites & servers · BEA · reported by MITREMedium 5

    BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain "heavy usage" scenarios, report incorrect severity levels for an audit event, which might allow attackers to perform unauthorized actions and avoid detection.

    Product
    Weblogic Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.