Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
248 results · page 4 of 5
Jun 2, 2023Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instaCVE-2023-2816 · Other software · HashiCorp · reported by security@hashicorp.comHigh 8.7
Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Jun 2, 2023Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corCVE-2023-1297 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.9
Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Jun 2, 2023eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /scheduler/indeCVE-2023-33763 · Other software · Simpleredak · reported by MITREMedium 6.1
eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /scheduler/index.php.
- Product
- Simpleredak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a SQL injection vulnerability via the Activity parameter.CVE-2023-33762 · Other software · Simpleredak · reported by MITRECritical 9.8
eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a SQL injection vulnerability via the Activity parameter.
- Product
- Simpleredak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /view/cb/formatCVE-2023-33761 · Other software · Simpleredak · reported by MITREMedium 6.1
eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /view/cb/format_642.php.
- Product
- Simpleredak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component #/de/casting/show/CVE-2023-33764 · Other software · Simpleredak · reported by MITREMedium 5.4
eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component #/de/casting/show/detail/<ID>.
- Product
- Simpleredak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for CVE-2023-30531 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for attackers to observe and capture it.
- Product
- Jenkins Consul KV Builder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Apr 12, 2023Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controllerCVE-2023-30530 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
- Product
- Jenkins Consul KV Builder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 20, 2023A vulnerability, which was classified as critical, has been found in ATM Consulting dolibarr_module_quicksupplierprice up to 1.1.6.CVE-2022-4933 · Other software · ATM Consulting · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in ATM Consulting dolibarr_module_quicksupplierprice up to 1.1.6. Affected by this issue is the function upatePrice of the file script/interface.php. The manipulation leads to sql injection. The attack may be launched remotely. Upgrading to version 1.1.7 is able to address this issue. The patch is identified as ccad1e4282b0e393a32fcc852e82ec0e0af5446f. It is recommended to upgrade the affected component. VDB-223382 is the identifier assigned to this vulnerability.
- Product
- dolibarr_module_quicksupplierprice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to cCVE-2023-0845 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.9
Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to crash under certain circumstances. This vulnerability was fixed in Consul 1.14.5.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comlists.fedoraproject.org
Jan 24, 2023B2B Customer Ordering System developed by ID Software Project and Consultancy Services before version 1.0.0.347 has an authenticated Reflected XSS vulnerabilityCVE-2022-4554 · Other software · ID Software Project and Consultancy Services · reported by iletisim@usom.gov.trMedium 5.4
B2B Customer Ordering System developed by ID Software Project and Consultancy Services before version 1.0.0.347 has an authenticated Reflected XSS vulnerability. This has been fixed in the version 1.0.0.347.
- Product
- B2B Customer Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jan 12, 2023Online Health Care System v1.0 was discovered to contain a SQL injection vulnerability via the consulting_id parameter at /healthcare/Admin/consulting_detail.phCVE-2022-46471 · Other software · Online Health Care System Project · reported by MITRECritical 9.8
Online Health Care System v1.0 was discovered to contain a SQL injection vulnerability via the consulting_id parameter at /healthcare/Admin/consulting_detail.php.
- Product
- Online Health Care System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UCVE-2022-3920 · Other software · HashiCorp · reported by security@hashicorp.comMedium 5.3
HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Sep 23, 2022HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enablingCVE-2022-40716 · Other software · Hashicorp · reported by MITREMedium 6.5
HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Sep 22, 2022HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertiCVE-2021-41803 · Other software · Hashicorp · reported by MITREHigh 7.1
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comlists.fedoraproject.org
Aug 17, 2022HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute methCVE-2022-38149 · Other software · Hashicorp · reported by MITREHigh 7.5
HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.
- Product
- Consul Template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Jul 19, 2022Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input.CVE-2022-32458 · Other software · Data Systems Consulting Co., Ltd. · reported by twcert@cert.org.twHigh 7.5
Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.
- Product
- BPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Jul 19, 2022Digiwin BPM has inadequate filtering for URL parameter.CVE-2022-32457 · Other software · Data Systems Consulting Co., Ltd. · reported by twcert@cert.org.twMedium 5.3
Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.
- Product
- BPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Jul 19, 2022Digiwin BPM’s function has insufficient validation for user input.CVE-2022-32456 · Other software · Data Systems Consulting Co., Ltd. · reported by twcert@cert.org.twCritical 9.8
Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service.
- Product
- BPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
May 25, 2022When a non-existent resource is requested, the LCDS LAquis SCADA application (version 4.3.1.1011 and prior) returns error messages which may allow reflected croCVE-2021-32989 · Other software · LCDS—Leão Consultoria e Desenvolvimento de Sistemas Ltda ME · reported by ics-cert@hq.dhs.govCritical 9.3
When a non-existent resource is requested, the LCDS LAquis SCADA application (version 4.3.1.1011 and prior) returns error messages which may allow reflected cross-site scripting.
- Product
- LAquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2022HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects retCVE-2022-29153 · Other software · Hashicorp · reported by MITREHigh 7.5
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Mar 30, 2022Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Group Functionality of Profelis IT Consultancy SambaBox allows AUCVE-2022-25620 · Other software · Profelis IT Consultancy · reported by cve@profelis.com.trLow 3.8
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Group Functionality of Profelis IT Consultancy SambaBox allows AUTHENTICATED user to cause execute arbitrary codes on the vulnerable server. This issue affects: Profelis IT Consultancy SambaBox 4.0 version 4.0 and prior versions on x86.
- Product
- SambaBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsambabox.iosambabox.io
Mar 30, 2022Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in ping tool of Profelis IT Consultancy SambaBox allows AUTHENCVE-2022-25619 · Other software · Profelis IT Consultancy · reported by cve@profelis.com.trLow 3.8
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in ping tool of Profelis IT Consultancy SambaBox allows AUTHENTICATED user to cause run arbitrary code. This issue affects: Profelis IT Consultancy SambaBox 4.0 version 4.0 and prior versions on x86.
- Product
- SambaBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsambabox.iosambabox.io
Feb 24, 2022HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to reCVE-2022-24687 · Other software · Hashicorp · reported by MITREMedium 6.5
HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10.8, and 1.11.3.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Dec 12, 2021HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control.CVE-2021-41805 · Other software · Hashicorp · reported by MITREHigh 8.8
HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a different namespace.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comsecurity.netapp.com
Sep 7, 2021HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.CVE-2021-38698 · Other software · Hashicorp · reported by MITREMedium 6.5
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comsecurity.gentoo.org
Sep 7, 2021HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functCVE-2021-37219 · Other software · Hashicorp · reported by MITREHigh 8.8
HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comsecurity.gentoo.org
Aug 24, 2021Philips Healthcare Tasy Electronic Medical Record (EMR) 3.06 allows SQL injection via the CorCad_F2/executaConsultaEspecifico IE_CORPO_ASSIST or CD_USUARIO_CONVCVE-2021-39376 · Other software · Philips · reported by MITREHigh 8.8
Philips Healthcare Tasy Electronic Medical Record (EMR) 3.06 allows SQL injection via the CorCad_F2/executaConsultaEspecifico IE_CORPO_ASSIST or CD_USUARIO_CONVENIO parameter.
- Product
- Tasy Electronic Medical Record
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiesec.home.blogdiesec.home.blog
Jul 17, 2021HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing thCVE-2021-36213 · Other software · Hashicorp · reported by MITREHigh 7.5
HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comgithub.com
Jul 17, 2021HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject CVE-2021-32574 · Other software · Hashicorp · reported by MITREHigh 7.5
HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comgithub.com
Apr 20, 2021HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events.CVE-2021-28156 · Other software · Hashicorp · reported by MITREHigh 7.5
HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comsecurity.gentoo.org
Apr 20, 2021HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting.CVE-2020-25864 · Other software · Hashicorp · reported by MITREMedium 6.1
HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comsecurity.gentoo.org
Jan 22, 2021Online Invoicing System (OIS) is open source software which is a lean invoicing system for small businesses, consultants and freelancers created using AppGini.CVE-2021-21260 · Other software · bigprof-software · reported by GitHubHigh 7.6
Online Invoicing System (OIS) is open source software which is a lean invoicing system for small businesses, consultants and freelancers created using AppGini. In OIS version 4.0 there is a stored XSS which can enables an attacker takeover of the admin account through a payload that extracts a csrf token and sends a request to change password. It has been found that Item description is reflected without sanitization in app/items_view.php which enables the malicious scenario.
- Product
- online-invoicing-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user.CVE-2020-29564 · Other software · Hashicorp · reported by MITRECritical 9.8
The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Consul Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2020HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration.CVE-2020-28053 · Other software · Hashicorp · reported by MITREMedium 6.5
HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.gentoo.org
Nov 4, 2020HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft wCVE-2020-25201 · Other software · Hashicorp · reported by MITREHigh 7.5
HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.gentoo.org
Jun 11, 2020HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of CVE-2020-13250 · Other software · Hashicorp · reported by MITREHigh 7.5
HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2020HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary daCVE-2020-13170 · Other software · Hashicorp · reported by MITREHigh 7.5
HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2020HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers.CVE-2020-12797 · Other software · Hashicorp · reported by MITREMedium 5.3
HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2020HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry.CVE-2020-12758 · Other software · Hashicorp · reported by MITREHigh 7.5
HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2020Cross-site scripting vulnerability in Sales Force Assistant version 11.2.48 and earlier allows remote authenticated attackers to inject arbitrary web script or CVE-2020-5570 · Other software · NI Consulting CO.,Ltd. · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Sales Force Assistant version 11.2.48 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Sales Force Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2020HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended informatioCVE-2020-7955 · Other software · Hashicorp · reported by MITREMedium 5.3
HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhashicorp.com
Jan 31, 2020HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of serviceCVE-2020-7219 · Other software · Hashicorp · reported by MITREHigh 7.5
HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhashicorp.com
Nov 7, 2019The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019.CVE-2019-3422 · Other software · ZTE · reported by psirt@zte.com.cnMedium 6.2
The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related product team, the information disclosure vulnerability is confirmed. The MF910S product's one-click upgrade tool can obtain the Telnet remote login password in the reverse way. If Telnet is opened, the attacker can remotely log in to the device through the cracked password, resulting in information leakage. The MF910S was end of service on October 23, 2019, ZTE recommends users to choose new products for the purpose of better security.
- Product
- MF910S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 23, 2019The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.CVE-2019-16377 · Other software · Makandra · reported by MITRECritical 9.8
The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrubygems.org
Jul 19, 2019Akeo Consulting Rufus 3.0 and earlier is affected by: Insecure Permissions.CVE-2019-1010101 · Other software · Akeo Consulting · reported by josh@bress.netCritical 9.8
Akeo Consulting Rufus 3.0 and earlier is affected by: Insecure Permissions. The impact is: arbitrary code execution with escalation of privilege. The component is: Executable installer, portable executable (ALL executables available). The attack vector is: CWE-29, CWE-377, CWE-379.
- Product
- Rufus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jul 19, 2019Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking.CVE-2019-1010100 · Other software · Akeo Consulting · reported by josh@bress.netHigh 7.8
Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is: Arbitrary code execution WITH escalation of privilege. The component is: Executable installers, portable executables (ALL executables on the web site). The attack vector is: CAPEC-471, CWE-426, CWE-427.
- Product
- Rufus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jun 6, 2019HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control.CVE-2019-12291 · Other software · Hashicorp · reported by MITREHigh 7.5
HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2019Opening a specially crafted LCDS LAquis SCADA before 4.3.1.71 ELS file may result in a write past the end of an allocated buffer, which may allow an attacker toCVE-2019-6536 · Other software · LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME · reported by ics-cert@hq.dhs.govHigh 7.8
Opening a specially crafted LCDS LAquis SCADA before 4.3.1.71 ELS file may result in a write past the end of an allocated buffer, which may allow an attacker to execute remote code in the context of the current process.
- Product
- LAquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govzerodayinitiative.com
Mar 26, 2019HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication.CVE-2019-9764 · Other software · Hashicorp · reported by MITREHigh 7.4
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.