Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
108 results · page 3 of 3
Apr 9, 2021Discord Recon Server is a bot that allows you to do your reconnaissance process from your Discord.CVE-2021-21433 · Other software · DEMON1A · reported by GitHubCritical 9.9
Discord Recon Server is a bot that allows you to do your reconnaissance process from your Discord. Remote code execution in version 0.0.1 would allow remote users to execute commands on the server resulting in serious issues. This flaw is patched in 0.0.2.
- Product
- Discord-Recon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2021The ProBot bot through 2021-02-08 for Discord might allow attackers to interfere with the intended purpose of the "Send an image when a user joins the server" fCVE-2021-26918 · Other software · probot · reported by MITRECritical 9.8
The ProBot bot through 2021-02-08 for Discord might allow attackers to interfere with the intended purpose of the "Send an image when a user joins the server" feature (or possibly have unspecified other impact) because the uploader web service allows double extensions (such as .html.jpg) with the text/html content type. NOTE: there may not be cases in which an uploader web service is customer controlled; however, the nature of the issue has substantial interaction with customer controlled configuration. NOTE: the vendor states "This is just an uploader (like any other one) which uploads files to cloud storage and accepts various file types. There is no kind of vulnerability and it won't compromise either the client side or the server side.
- Product
- bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comraw.githubusercontent.com
Dec 8, 2020Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot.CVE-2020-26249 · Other software · Cog-Creators · reported by GitHubHigh 7.7
Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This high severity exploit has been fixed on version 0.1.7a. There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue.
- Product
- Red-Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2020Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module.CVE-2020-15278 · Other software · Cog-Creators · reported by GitHubHigh 7.7
Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module. This exploit allows Discord users with a high privilege level within the guild to bypass hierarchy checks when the application is in a specific condition that is beyond that user's control. By abusing this exploit, it is possible to perform destructive actions within the guild the user has high privileges in. This exploit has been fixed in version 3.4.1. As a workaround, unloading the Mod module with unload mod or, disabling the massban command with command disable global massban can render this exploit not accessible. We still highly recommend updating to 3.4.1 to completely patch this issue.
- Product
- Red-DiscordBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2020The Act module for Red Discord Bot before commit 6b9f3b86 is vulnerable to Remote Code Execution.CVE-2020-15172 · Other software · zephyrkul · reported by GitHubHigh 8.7
The Act module for Red Discord Bot before commit 6b9f3b86 is vulnerable to Remote Code Execution. With this exploit, Discord users can use specially crafted messages to perform destructive actions and/or access sensitive information. Unloading the Act module with `unload act` can render this exploit inaccessible.
- Product
- FluffyCogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2020Red Discord Bot before versions 3.3.12 and 3.4 has a Remote Code Execution vulnerability in the Streams module.CVE-2020-15147 · Other software · Cog-Creators · reported by GitHubHigh 8.5
Red Discord Bot before versions 3.3.12 and 3.4 has a Remote Code Execution vulnerability in the Streams module. This exploit allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. As a workaround, unloading the Trivia module with `unload streams` can render this exploit not accessible. It is highly recommended updating to 3.3.12 or 3.4 to completely patch this issue.
- Product
- Red-DiscordBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2020In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usCVE-2020-15140 · Other software · Cog-Creators · reported by GitHubHigh 8.2
In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This critical exploit has been fixed on version 3.3.11.
- Product
- Red-DiscordBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2018discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.CVE-2017-16207 · Other software · HackerOne · reported by support@hackerone.comHigh 7.3
discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.
- Product
- discordi.js node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.