Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
192 results · page 4 of 4
Mar 29, 2022A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified CVE-2022-28138 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credential.
- Product
- Jenkins RocketChat Notifier Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 14, 2022Advanced Product Labels for WooCommerce: Does not sanitise and escape the tax_color_set_type parameter before outputting it back in the berocket_apl_color_listener AJAX action's responseCVE-2022-0399 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_set_type parameter before outputting it back in the berocket_apl_color_listener AJAX action's response, leading to a Reflected Cross-Site Scripting
- Product
- Advanced Product Labels for WooCommerce
- Fixed in
- 1.2.3.7
- What to do
- Update Advanced Product Labels for WooCommerce to 1.2.3.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Oct 18, 2021A link preview rendering issue in Rocket.Chat versions before 3.9 could lead to potential XSS attacks.CVE-2020-8291 · Other software · Rocket.chat · reported by support@hackerone.comMedium 6.1
A link preview rendering issue in Rocket.Chat versions before 3.9 could lead to potential XSS attacks.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2021Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript.CVE-2021-32832 · Other software · RocketChat · reported by GitHubMedium 4.3
Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an issue with certain regular expressions could lead potentially to Denial of Service. This was fixed in versions 3.11.3, 3.12.2, and 3.13.
- Product
- Rocket.Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rocket.chatgithub.com
Aug 9, 2021A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result in a NoSQL iCVE-2021-22910 · Other software · Rocket.chat · reported by support@hackerone.comCritical 9.8
A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comhackerone.com
Jul 5, 2021The Rocket.Chat desktop application 2.17.11 opens external links without user interaction.CVE-2020-26763 · Other software · Rocket.chat · reported by MITREHigh 7.5
The Rocket.Chat desktop application 2.17.11 opens external links without user interaction.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2021A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentiCVE-2021-22911 · Other software · Rocket.chat · reported by support@hackerone.comCritical 9.8
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
May 27, 2021An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumeratCVE-2021-22892 · Other software · Rocket.chat · reported by support@hackerone.comHigh 7.5
An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumeration and validation checks.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
May 18, 2021Epic Games / Psyonix Rocket League <=1.95 is affected by Buffer Overflow.CVE-2021-32238 · Other software · Psyonix · reported by MITREHigh 7.8
Epic Games / Psyonix Rocket League <=1.95 is affected by Buffer Overflow. Stack-based buffer overflow occurs when Rocket League handles UPK object files that can result in code execution and denial of service scenario.
- Product
- Rocket League
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comzeroscience.mk
Apr 1, 2021An issue was discovered in the rocket crate before 0.4.7 for Rust.CVE-2021-29935 · Other software · Rocket · reported by MITREHigh 7.3
An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics.
- Product
- Rocket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Mar 26, 2021Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inCVE-2021-22886 · Other software · Rocket.chat · reported by support@hackerone.comMedium 6.1
Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rocket.chatgithub.com
Jan 26, 2021Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting (XSS) vulnerability via the drag & drop functionality in message boxes.CVE-2020-8292 · Other software · Rocket.chat · reported by support@hackerone.comMedium 5.4
Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting (XSS) vulnerability via the drag & drop functionality in message boxes.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rocket.chathackerone.com
Jan 26, 2021The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `value` parameter.CVE-2020-8288 · Other software · Rocket.chat · reported by support@hackerone.comMedium 5.4
The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `value` parameter.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rocket.chathackerone.com
Jan 19, 2021A stored Cross-Site Scripting (XSS) vulnerability in the survey feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary CVE-2020-27852 · Other software · Rocketgenius · reported by MITREMedium 5.4
A stored Cross-Site Scripting (XSS) vulnerability in the survey feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via a textarea field. This code is interpreted by users in a privileged role (Administrator, Editor, etc.).
- Product
- Gravityforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddigital.securitydigital.security
Jan 19, 2021Multiple stored HTML injection vulnerabilities in the "poll" and "quiz" features in an additional paid add-on of Rocketgenius Gravity Forms before 2.4.21 allowsCVE-2020-27851 · Other software · Rocketgenius · reported by MITREMedium 5.4
Multiple stored HTML injection vulnerabilities in the "poll" and "quiz" features in an additional paid add-on of Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary HTML code via poll or quiz answers. This code is interpreted by users in a privileged role (Administrator, Editor, etc.).
- Product
- Gravityforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddigital.securitydigital.security
Jan 19, 2021A stored Cross-Site Scripting (XSS) vulnerability in forms import feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrarCVE-2020-27850 · Other software · Rocketgenius · reported by MITREMedium 4.8
A stored Cross-Site Scripting (XSS) vulnerability in forms import feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via the import of a GF form. This code is interpreted by users in a privileged role (Administrator, Editor, etc.).
- Product
- Gravityforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddigital.securitydigital.security
Jan 8, 2021An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.CVE-2020-28208 · Other software · Rocket.chat · reported by MITREMedium 5.3
An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 31, 2020An issue was discovered in the rocket crate before 0.4.5 for Rust.CVE-2020-35882 · Other software · Rocket · reported by MITREHigh 8.1
An issue was discovered in the rocket crate before 0.4.5 for Rust. LocalRequest::clone creates more than one mutable references to the same object, possibly causing a data race.
- Product
- Rocket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 30, 2020Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login.CVE-2020-29594 · Other software · Rocket.chat · reported by MITRECritical 9.8
Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2020Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES850CVE-2020-12504 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comCritical 9.8
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below has an active TFTP-Service.
- Product
- P+F Comtrol RocketLinx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 15, 2020Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES850CVE-2020-12503 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 7.2
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to multiple authenticated command injections.
- Product
- P+F Comtrol RocketLinx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 15, 2020Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES850CVE-2020-12502 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 8.8
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to unauthenticated device administration.
- Product
- P+F Comtrol RocketLinx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 15, 2020Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES850CVE-2020-12501 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comCritical 9.8
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) use undocumented accounts.
- Product
- P+F Comtrol RocketLinx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 15, 2020Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES850CVE-2020-12500 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comCritical 9.8
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) allows unauthenticated device administration.
- Product
- P+F Comtrol RocketLinx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Aug 18, 2020Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the client which results in rCVE-2020-15926 · Other software · Rocket.chat · reported by MITREMedium 6.1
Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the client which results in remote code execution on the client side.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.redteam.plgithub.com
May 14, 2020In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent fCVE-2019-17572 · Websites & servers · Apache · reported by security@apache.orgMedium 5.3
In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.
- Product
- Rocketmq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgseclists.org
Oct 21, 2019Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.CVE-2019-17220 · Other software · Rocket.chat · reported by MITREMedium 6.1
Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jul 12, 2018An integer overflow vulnerability exists in the function multiTransfer of Rocket Coin (XRC), an Ethereum token smart contract.CVE-2018-13836 · Other software · Rocket Coin Project · reported by MITREHigh 7.5
An integer overflow vulnerability exists in the function multiTransfer of Rocket Coin (XRC), an Ethereum token smart contract. An attacker could use it to set any user's balance.
- Product
- Rocket Coin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2018A reflected XSS issue was discovered in the registration form in Rocket.Chat before 0.66.CVE-2018-13879 · Other software · Rocket.chat · reported by MITREMedium 5.4
A reflected XSS issue was discovered in the registration form in Rocket.Chat before 0.66. When one creates an account, the next step will ask for a username. This field will not save HTML control characters but an error will be displayed that shows the attempted username unescaped via packages/rocketchat-ui-login/client/username/username.js in packages/rocketchat-ui-login/client/username/username.html.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2018An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65.CVE-2018-13878 · Other software · Rocket.chat · reported by MITREMedium 6.1
An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018There is an information leak vulnerability in Sprockets.CVE-2018-3760 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.
- Product
- Sprockets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 2, 2018Rocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeoverCVE-2017-1000493 · Other software · Rocket.chat · reported by MITRECritical 9.8
Rocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeover
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sbarbeau.frgithub.com
Jul 26, 2017In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, this is insufficientCVE-2017-11658 · WordPress plugins & themes · reported by MITREHigh 7.5
In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, this is insufficient to stop remote attacks and can be bypassed by using 0x00 bytes, as demonstrated by a .%00.../.%00.../ attack.
- Product
- WP Rocket
- What to do
- Update WP Rocket to the newest version.
Full record and what to do →NVD recordgist.github.comwp-rocket.me
Jul 17, 2017Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.CVE-2017-1000054 · Other software · Rocketchat · reported by MITREMedium 6.1
Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtheblazehen.comtheblazehen.com
Nov 8, 2014Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.CVE-2014-7819 · Other software · Sprockets Project · reported by Red HatMedium 5
Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
- Product
- Sprockets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Aug 7, 2014Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to (1) create arbitraryCVE-2014-3914 · Other software · Rocketsoftware · reported by MITREHigh 10
Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to (1) create arbitrary files via a .. (dot dot) in the query parameter in a writeDataFile action to the fileRequestor servlet, execute arbitrary files via a .. (dot dot) in the query parameter in a (2) run or (3) runClear action to the fileRequestor servlet, (4) read arbitrary files via a readDataFile action to the fileRequestor servlet, (5) execute arbitrary code via a save_server_groups action to the userRequest servlet, or (6) delete arbitrary files via a del action in the fileRequestServlet servlet.
- Product
- Rocket Servergraph
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comzerodayinitiative.com
Jun 11, 2014The userRequest servlet in the Admin Center for Tivoli Storage Manager in Rocket Servergraph allows remote attackers to execute arbitrary commands via a (1) autCVE-2014-3915 · Other software · Rocketsoftware · reported by MITREHigh 10
The userRequest servlet in the Admin Center for Tivoli Storage Manager in Rocket Servergraph allows remote attackers to execute arbitrary commands via a (1) auth, (2) auth_session, (3) auth_simple, (4) add, (5) add_flat, (6) remove, (7) set_pwd, (8) add_permissions, (9) revoke_permissions, (10) runAsync, or (11) tsmRequest command.
- Product
- Rocket Servergraph
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comzerodayinitiative.com
Apr 19, 2010SQL injection vulnerability in the RokModule (com_rokmodule) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the module CVE-2010-1480 · Other software · Rockettheme · reported by MITREHigh 7.5
SQL injection vulnerability in the RokModule (com_rokmodule) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the module parameter to index.php. NOTE: some of these details are obtained from third party information.
- Product
- COM Rokmodule
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comrockettheme.com
Apr 19, 2010SQL injection vulnerability in the RokModule (com_rokmodule) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the moduleiCVE-2010-1479 · Other software · Rockettheme · reported by MITREHigh 7.5
SQL injection vulnerability in the RokModule (com_rokmodule) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the moduleid parameter in a raw action to index.php.
- Product
- COM Rokmodule
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Mar 23, 2010Directory traversal vulnerability in the RokDownloads (com_rokdownloads) component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitCVE-2010-1056 · Other software · Rockettheme · reported by MITREMedium 6.8
Directory traversal vulnerability in the RokDownloads (com_rokdownloads) component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
- Product
- COM Rokdownloads
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org
Feb 26, 2009Unspecified vulnerability in sISAPILocation before 1.0.2.2 allows remote attackers to bypass intended access restrictions for character encoding and the cookie CVE-2008-6298 · Other software · Rocketeer.dip · reported by MITREMedium 5
Unspecified vulnerability in sISAPILocation before 1.0.2.2 allows remote attackers to bypass intended access restrictions for character encoding and the cookie secure flag via unknown vectors related to the "HTTP header rewrite function."
- Product
- Sisapilocation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2001Directory traversal vulnerability in phprocketaddin in Total PC Solutions PHP Rocket Add-in for FrontPage 1.0 allows remote attackers to read arbitrary files viCVE-2001-1204 · Other software · Total PC Solutions · reported by MITREMedium 5
Directory traversal vulnerability in phprocketaddin in Total PC Solutions PHP Rocket Add-in for FrontPage 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.
- Product
- PHP Rocket Add-in
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.