Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,210 results · page 36 of 45

Jun 7, 2013Cross-site request forgery (CSRF) vulnerability in cgi-bin/create_user.cgi on QNAP VioStor NVR devices with firmware 4.0.3 allows remote attackers to hijack theCVE-2013-0144 · Network & remote access · Qnap · reported by cret@cert.orgMedium 6.8
Cross-site request forgery (CSRF) vulnerability in cgi-bin/create_user.cgi on QNAP VioStor NVR devices with firmware 4.0.3 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a NEW USER action.
Product
Viostor Network Video Recorder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
May 29, 2013Session fixation vulnerability in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to hijack web sessions via unspecified vectors.CVE-2013-2313 · Other software · Lockon · reported by vultures@jpcert.or.jpMedium 4
Session fixation vulnerability in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to hijack web sessions via unspecified vectors.
Product
Ec-cube
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
May 15, 2013Session fixation vulnerability in Cisco Secure Access Control System (ACS) allows remote attackers to hijack web sessions via unspecified vectors, aka Bug ID CSCVE-2013-1200 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.8
Session fixation vulnerability in Cisco Secure Access Control System (ACS) allows remote attackers to hijack web sessions via unspecified vectors, aka Bug ID CSCud95787.
Product
Secure Access Control System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
May 10, 2013Cross-site request forgery (CSRF) vulnerability in the Login With Ajax plugin before 3.1 for WordPress allows remote attackers to hijack the authentication of aCVE-2013-2707 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Login With Ajax plugin before 3.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.
Product
Cross-site request forgery (CSRF) vulnerability in the Login With Ajax
Fixed in
3.1
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Login With Ajax to 3.1 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 8, 2013Multiple cross-site request forgery (CSRF) vulnerabilities in the Noma component in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to hijack the autCVE-2013-3513 · Other software · Gwos · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Noma component in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to hijack the authentication of unspecified victims for requests that (1) store XSS sequences or (2) delete entries.
Product
Groundwork Monitor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.groundworkopensource.com
May 5, 2013Cross-site request forgery (CSRF) vulnerability in the Facebook Members plugin before 5.0.5 for WordPress allows remote attackers to hijack the authentication oCVE-2013-2703 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Facebook Members plugin before 5.0.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify this plugin's settings.
Product
Cross-site request forgery (CSRF) vulnerability in the Facebook Members
Fixed in
5.0.5
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Facebook Members to 5.0.5 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
May 5, 2013Cross-site request forgery (CSRF) vulnerability in the Easy AdSense Lite plugin before 6.10 for WordPress allows remote attackers to hijack the authentication oCVE-2013-2702 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Easy AdSense Lite plugin before 6.10 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.
Product
Cross-site request forgery (CSRF) vulnerability in the Easy AdSense Lite
Fixed in
6.10
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Easy AdSense Lite to 6.10 or newer.
Full record and what to do →NVD record secunia.com secunia.com
Apr 26, 2013Cross-site request forgery (CSRF) vulnerability in the FourSquare Checkins plugin before 1.3 for WordPress allows remote attackers to hijack the authentication CVE-2013-2709 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the FourSquare Checkins plugin before 1.3 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Product
Cross-site request forgery (CSRF) vulnerability in the FourSquare Checkins
Fixed in
1.3
What to do
Update Cross-site request forgery (CSRF) vulnerability in the FourSquare Checkins to 1.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Apr 25, 2013Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster plugin before 8.2.4 for WordPress allows remote attackers to hijack the authenticatiCVE-2013-2696 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster plugin before 8.2.4 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Product
Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster
Fixed in
8.2.4
What to do
Update Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster to 8.2.4 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Apr 25, 2013Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0 allows remote attackers to hijack the authentication of arbitCVE-2013-3269 · Other software · Cybozu · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0 allows remote attackers to hijack the authentication of arbitrary users for requests that change mobile passwords, a different vulnerability than CVE-2013-2305.
Product
Cybozu Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cs.cybozu.co.jp jvn.jp
Apr 24, 2013Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary userCVE-2013-1088 · Other software · Novell · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request validation by iManager code deployed within an Apache Tomcat container.
Product
Imanager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record novell.com bugzilla.novell.com
Apr 23, 2013Multiple cross-site request forgery (CSRF) vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3, and 8, allow remote attackers to hijack tCVE-2012-5950 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3, and 8, allow remote attackers to hijack the authentication of arbitrary users for requests that modify data records via vectors involving (1) the html/en/default/ directory or (2) sqa/html/en/default/process/comm/saveProps.jsp.
Product
Tririga Application Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com exchange.xforce.ibmcloud.com
Apr 19, 2013Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote attackers to hijack the authentication CVE-2013-2697 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Product
Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager
Fixed in
1.61
What to do
Update Cross-site request forgery (CSRF) vulnerability in the WP-DownloadManager to 1.61 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Apr 9, 2013Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of usCVE-2012-6134 · Other software · Omniauth-oauth2 Project · reported by Red HatMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.
Product
Omniauth-oauth2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rubysec.github.io seclists.org
Apr 8, 2013Cross-site request forgery (CSRF) vulnerability in addressbook/register/delete_user.php in PHP Address Book 8.2.5 allows remote attackers to hijack the authentiCVE-2013-2778 · Other software · Chatelao · reported by MITREHigh 7.5
Cross-site request forgery (CSRF) vulnerability in addressbook/register/delete_user.php in PHP Address Book 8.2.5 allows remote attackers to hijack the authentication of administrators for requests that delete accounts, a different vulnerability than CVE-2013-0135.1.
Product
PHP Address Book
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record acadion.nl acadion.nl
Mar 27, 2013The Java Console in IBM Domino 8.5.x allows remote authenticated users to hijack temporary credentials by leveraging knowledge of configuration details, aka SPRCVE-2013-0487 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
The Java Console in IBM Domino 8.5.x allows remote authenticated users to hijack temporary credentials by leveraging knowledge of configuration details, aka SPR KLYH8TNNDN.
Product
Lotus Domino
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com exchange.xforce.ibmcloud.com
Mar 19, 2013Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authenticCVE-2013-0327 · Websites & servers · Jenkins · reported by Red HatMedium 6.8
Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via unknown vectors.
Product
Jenkins
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com cloudbees.com
Mar 19, 2013Cross-site request forgery (CSRF) vulnerability in the Mark Complete module 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authenticatiCVE-2013-0207 · Other software · Leighton Whiting · reported by Red HatMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Mark Complete module 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Product
Mark Complete
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupalcode.org openwall.com
Mar 13, 2013Cross-site request forgery (CSRF) vulnerability in the LocalFiles Editor plugin in Piwigo before 2.4.7 allows remote attackers to hijack the authentication of aCVE-2013-1468 · Other software · Piwigo · reported by MITREHigh 7.6
Cross-site request forgery (CSRF) vulnerability in the LocalFiles Editor plugin in Piwigo before 2.4.7 allows remote attackers to hijack the authentication of administrators for requests that create arbitrary PHP files via unspecified vectors.
Product
Piwigo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com packetstormsecurity.com
Mar 12, 2013Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allow remote attackers to bypass intended read restrictions for content, and hijack userCVE-2013-0080 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allow remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "Callback Function Vulnerability."
Product
Sharepoint Foundation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov docs.microsoft.com
Mar 7, 2013Cross-site request forgery (CSRF) vulnerability in the web interface in Cisco Prime Infrastructure allows remote attackers to hijack the authentication of arbitCVE-2013-1153 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the web interface in Cisco Prime Infrastructure allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCue84676.
Product
Prime Infrastructure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Feb 20, 2013Cross-site request forgery (CSRF) vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote attackers to hijack theCVE-2012-5763 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Product
Netezza
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com exchange.xforce.ibmcloud.com
Feb 15, 2013Multiple cross-site request forgery (CSRF) vulnerabilities in the server in Cisco Unified MeetingPlace before 7.1(2.2000) allow remote attackers to hijack the aCVE-2013-1128 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the server in Cisco Unified MeetingPlace before 7.1(2.2000) allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCuc64903. NOTE: some of these details are obtained from third party information.
Product
Unified Meetingplace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com tools.cisco.com
Feb 6, 2013Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Unity Express with software before 8.0 allow remote attackers to hijack the authenticatiCVE-2013-1120 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Unity Express with software before 8.0 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCue35910.
Product
Unity Express Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Feb 6, 2013EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC 5.x before 5.2SP1 allow remote attackers to conduct clickjacking attacks via a crafted web page.CVE-2012-2294 · Other software · EMC · reported by security_alert@emc.comMedium 6.8
EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC 5.x before 5.2SP1 allow remote attackers to conduct clickjacking attacks via a crafted web page.
Product
RSA Archer Smartsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com archives.neohapsis.com
Feb 2, 2013The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking aCVE-2013-0213 · Other software · Samba · reported by Red HatMedium 5.1
The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element.
Product
Samba
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Jan 23, 2013Cross-site request forgery (CSRF) vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authentication of administrators for requests thCVE-2012-6518 · Other software · Diy-cms · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authentication of administrators for requests that create a poll via an add action to the poll module.
Product
Diy-cms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com packetstormsecurity.org
Jan 23, 2013Multiple cross-site request forgery (CSRF) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hijack the authentication of administrators CVE-2012-6508 · Other software · Netartmedia · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hijack the authentication of administrators for requests that (1) change arbitrary user passwords via a nouveau action in the security module to cars/ADMIN/index.php; (2) create a user or (3) create a sub user via a sub_accounts action in the home module to USERS/index.php; or (4) change profile information via an edit action in the profile module to USERS/index.php.
Product
CAR Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Jan 23, 2013Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of administrators for requestCVE-2012-1922 · Other software · Sitecom · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of administrators for requests that modify settings for (1) Mac Filtering via admin/formFilter, (2) IP/Port Filtering via formFilter, (3) Port Forwarding via formPortFw, (4) Wireless Access Control via admin/formWlAc, (5) Wi-Fi Protected Setup via formWsc, (6) URL Blocking Filter via formURL, (7) Domain Blocking Filter via formDOMAINBLK, and (8) IP Address ACL Filter via admin/formACL in goform/, different vectors than CVE-2012-1921.
Product
Wlm-2501
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record webapp-security.com webapp-security.com
Jan 3, 2013Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of adminCVE-2012-6434 · Other software · E107 · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) download_url, (2) download_url_extended, (3) download_author_email, (4) download_author_website, (5) download_image, (6) download_thumb, (7) download_visible, or (8) download_class parameter.
Product
E107
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record e107.org e107.svn.sourceforge.net
Jan 3, 2013Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators CVE-2012-6433 · Other software · E107 · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that conduct XSS attacks via the news_title parameter in a create action.
Product
E107
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record e107.org e107.svn.sourceforge.net
Dec 19, 2012Cross-site request forgery (CSRF) vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to hijack the authentication of arbitraCVE-2012-5178 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that complete a purchase.
Product
Cross-site request forgery (CSRF) vulnerability in the Welcart
Fixed in
1.2.2
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Welcart to 1.2.2 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Dec 5, 2012The web interface in EMC RSA NetWitness Informer before 2.0.5.6 allows remote attackers to conduct clickjacking attacks via unspecified vectors.CVE-2012-4609 · Other software · EMC · reported by security_alert@emc.comMedium 4.3
The web interface in EMC RSA NetWitness Informer before 2.0.5.6 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
Product
RSA Netwitness Informer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com archives.neohapsis.com
Dec 5, 2012Cross-site request forgery (CSRF) vulnerability in the web interface in EMC RSA NetWitness Informer before 2.0.5.6 allows remote attackers to hijack the authentCVE-2012-4608 · Other software · EMC · reported by security_alert@emc.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the web interface in EMC RSA NetWitness Informer before 2.0.5.6 allows remote attackers to hijack the authentication of arbitrary users.
Product
RSA Netwitness Informer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com archives.neohapsis.com
Dec 3, 2012Cross-site request forgery (CSRF) vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to hijack the authentication of unspecifCVE-2012-5549 · Other software · Carlos Carvalhar · reported by Red HatMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Product
Time Spent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org openwall.com
Dec 3, 2012Multiple cross-site request forgery (CSRF) vulnerabilities in the Search API module 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the autheCVE-2012-5547 · Other software · Thomas Seidl · reported by Red HatMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Search API module 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable a server via a server action or (2) enable a search index via an enable index action.
Product
Search API
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Dec 3, 2012Cross-site request forgery (CSRF) vulnerability in the Commerce Extra Panes module 7.x-1.x before 7.x-1.1 in Drupal allows remote attackers to hijack the authenCVE-2012-5542 · Websites & servers · Pedro Cambra · reported by Red HatMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Commerce Extra Panes module 7.x-1.x before 7.x-1.1 in Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable a Commerce extra panes pane via unspecified vectors related to "the link to reorder items."
Product
Commerce Extra Panes
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Nov 30, 2012Cross-site request forgery (CSRF) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of adminisCVE-2012-4478 · Other software · David Alkire · reported by Red HatMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators.
Product
Drag & Drop Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org openwall.com
Nov 26, 2012Cross-site request forgery (CSRF) vulnerability in X7 Chat 2.0.5.1 and earlier allows remote attackers to hijack the authentication of administrators for requesCVE-2012-6047 · Other software · X7 Group · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in X7 Chat 2.0.5.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that add a user to an arbitrary group via the users page in an adminpanel action to index.php.
Product
X7 Chat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Nov 26, 2012Cross-site request forgery (CSRF) vulnerability in admin.php in Collabtive 0.6.5 allows remote attackers to hijack the authentication of administrators for requCVE-2010-5285 · Other software · O-dyn · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in admin.php in Collabtive 0.6.5 allows remote attackers to hijack the authentication of administrators for requests that add administrative users via the edituser action.
Product
Collabtive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Nov 26, 2012Cross-site request forgery (CSRF) vulnerability in OpenText ECM (formerly Livelink ECM) 9.7.1 allows remote attackers to hijack the authentication of administraCVE-2010-5283 · Other software · Opentext · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in OpenText ECM (formerly Livelink ECM) 9.7.1 allows remote attackers to hijack the authentication of administrators for requests that change folder and resource permissions.
Product
Livelink ECM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com packetstormsecurity.org
Nov 24, 2012Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to conduct clickjacking attacks to delete arbitrary users and bypass CSRF protection viCVE-2012-2246 · Other software · Mahara · reported by security@debian.orgMedium 6.8
Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to conduct clickjacking attacks to delete arbitrary users and bypass CSRF protection via account/delete.php.
Product
Mahara
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record debian.org bugs.launchpad.net
Nov 23, 2012Session fixation vulnerability in BIGACE before 2.7.8 allows remote attackers to hijack web sessions via unspecified vectors.CVE-2012-5173 · Other software · Bigace · reported by vultures@jpcert.or.jpMedium 6.8
Session fixation vulnerability in BIGACE before 2.7.8 allows remote attackers to hijack web sessions via unspecified vectors.
Product
Bigace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Nov 18, 2012Multiple cross-site request forgery (CSRF) vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to hijack the autCVE-2012-4943 · Other software · Agilefleet · reported by cret@cert.orgMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to hijack the authentication of arbitrary users for requests that modify (1) passwords, (2) accounts, or (3) permissions.
Product
Fleetcommander
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org securityfocus.com
Nov 18, 2012Session fixation vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack web sessions via a jsession_id cookie.CVE-2012-4937 · Other software · Patterninsight · reported by cret@cert.orgMedium 6.8
Session fixation vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack web sessions via a jsession_id cookie.
Product
Pattern Insight
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com kb.cert.org
Nov 18, 2012The web interface in Pattern Insight 2.3 allows remote attackers to conduct clickjacking attacks via a FRAME element.CVE-2012-4936 · Other software · Patterninsight · reported by cret@cert.orgMedium 6.8
The web interface in Pattern Insight 2.3 allows remote attackers to conduct clickjacking attacks via a FRAME element.
Product
Pattern Insight
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com kb.cert.org
Nov 18, 2012Cross-site request forgery (CSRF) vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack the authentication of arbitrary usCVE-2012-4935 · Other software · Patterninsight · reported by cret@cert.orgMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack the authentication of arbitrary users.
Product
Pattern Insight
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com kb.cert.org
Nov 17, 2012Cross-site request forgery (CSRF) vulnerability in SAMEDIA LandShop 0.9.2 allows remote attackers to hijack the authentication of administrators for requests thCVE-2012-5898 · Other software · Samedia · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in SAMEDIA LandShop 0.9.2 allows remote attackers to hijack the authentication of administrators for requests that change account settings.
Product
Landshop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Nov 17, 2012Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to hijack the authenticCVE-2012-5891 · Other software · Dalbum · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an add action, (2) change user passwords via a change action, or (3) delete a user via a delete action.
Product
Dalbum
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Nov 11, 2012Joomla! 2.5.x before 2.5.8 and 3.0.x before 3.0.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors involving "Inadequate protectiCVE-2012-5827 · Websites & servers · Joomla · reported by MITREMedium 4.3
Joomla! 2.5.x before 2.5.8 and 3.0.x before 3.0.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors involving "Inadequate protection."
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.