Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
395 results · page 4 of 8
Dec 20, 2022Some smartphones have authentication-related (including session management) vulnerabilities as the setup wizard is bypassed.CVE-2022-41590 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Some smartphones have authentication-related (including session management) vulnerabilities as the setup wizard is bypassed. Successful exploitation of this vulnerability affects the smartphone availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Dec 1, 2022A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 1CVE-2022-3709 · Network & remote access · Sophos · reported by security-alert@sophos.comMedium 6.8
A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 19.5 GA.
- Product
- Sophos Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep54_pskpwd parameter at /goform/form2WizardStep54.CVE-2022-43002 · Other software · Dlink · reported by MITRECritical 9.8
D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep54_pskpwd parameter at /goform/form2WizardStep54.
- Product
- Dir-816 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep4_pskpwd parameter at /goform/form2WizardStep4.CVE-2022-43000 · Other software · Dlink · reported by MITRECritical 9.8
D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep4_pskpwd parameter at /goform/form2WizardStep4.
- Product
- Dir-816 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2022An injection vulnerability in the syslog-ng configuration wizard in Securonix Snypr 6.4 allows an application user with the "Manage Ingesters" permission to exeCVE-2022-37108 · Other software · Securonix · reported by MITREHigh 8.7
An injection vulnerability in the syslog-ng configuration wizard in Securonix Snypr 6.4 allows an application user with the "Manage Ingesters" permission to execute arbitrary code on remote ingesters by appending arbitrary text to text files that are executed by the system, such as users' crontab files. The patch for this was present in SNYPR version 6.4 Jun 2022 R3_[06170871], but may have been introduced sooner.
- Product
- Snypr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconway.scotconway.scot
Aug 31, 2022In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.CVE-2022-37128 · Other software · Dlink · reported by MITRECritical 9.8
In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.
- Product
- Dir-816 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the function fromWizardHandle.CVE-2022-37805 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the function fromWizardHandle.
- Product
- Ac1206 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022The file upload wizard in Zengenti Contensis Classic before 15.2.1.79 does not correctly check that a user has authenticated.CVE-2022-34919 · Other software · Zengenti · reported by MITRECritical 9.8
The file upload wizard in Zengenti Contensis Classic before 15.2.1.79 does not correctly check that a user has authenticated. By uploading a crafted aspx file, it is possible to execute arbitrary commands.
- Product
- Contensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzengenti.com
Jul 21, 2022Web page which "wizardpwd.asp" ALLNET Router model WR0500AC is prone to Authorization bypass vulnerability – the password, located at "admin" allows changing thCVE-2022-34767 · Other software · ALLNET Gmbh · reported by cna@cyber.gov.ilMedium 5.9
Web page which "wizardpwd.asp" ALLNET Router model WR0500AC is prone to Authorization bypass vulnerability – the password, located at "admin" allows changing the http[s]://wizardpwd.asp/cgi-bin. Does not validate the user's identity and can be accessed publicly.
- Product
- ALLNET Gmbh - ADSL/VDSL Router inkl. Modem and Wlan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022MiniTool Partition Wizard v12.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.CVE-2022-29320 · Other software · Minitool · reported by MITREHigh 7.8
MiniTool Partition Wizard v12.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.
- Product
- Partition Wizard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
May 12, 2022Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click oCVE-2022-22796 · Other software · SysAid · reported by cna@cyber.gov.ilHigh 7
Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authentication.
- Product
- Sysaid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022An access control issue in the authentication module of wizplat PD065 v1.19 allows attackers to access sensitive data and cause a Denial of Service (DoS).CVE-2021-46167 · Other software · Wizplat · reported by MITREHigh 7.8
An access control issue in the authentication module of wizplat PD065 v1.19 allows attackers to access sensitive data and cause a Denial of Service (DoS).
- Product
- Pd065 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanWizardSetup.CVE-2022-27294 · Other software · Dlink · reported by MITREHigh 7.5
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanWizardSetup. This vulnerability allows attackers to cause a Denial of Service (DoS) via the webpage parameter.
- Product
- Dir-619 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker package installation beforeCVE-2022-24932 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.2
Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker package installation before finishing Setup wizard.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 10, 2022Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privilegCVE-2022-24618 · Other software · Heimdalsecurity · reported by MITREHigh 7.8
Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the "Browse For Folder" window accessible by triggering a "Repair" on the MSI package located in C:\Windows\Installer.
- Product
- Heimdal Premium Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.heimdalsecurity.comsupport.heimdalsecurity.com
Feb 17, 2022Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-CVE-2021-46315 · Other software · Dlink · reported by MITRECritical 9.8
Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicoius users can use this vulnerability to use "\ " or backticks in the shell metacharacters in the ssid0 or ssid1 parameters to cause arbitrary command execution. Since CVE-2019-17510 vulnerability has not been patched and improved www/hnap1/control/setwizardconfig.php, can also use line breaks and backquotes to bypass.
- Product
- Dir-846 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments.CVE-2021-26616 · Other software · secuwiz co., ltd · reported by vuln@krcert.or.krHigh 7.8
An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments.
- Product
- SecuwaySSL U V2.0 client for MacOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022The initial admin account setup wizard on Lexmark devices allow unauthenticated access to the “out of service erase” feature.CVE-2021-44736 · Other software · Lexmark · reported by MITRECritical 9.8
The initial admin account setup wizard on Lexmark devices allow unauthenticated access to the “out of service erase” feature.
- Product
- Mc3224i Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lexmark.comzerodayinitiative.com
Jan 12, 2022SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP arCVE-2021-41597 · Other software · Salesagility · reported by MITREHigh 8.8
SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP archive.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comdocs.suitecrm.com
Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard.CVE-2021-20150 · Other software · Trendnet · reported by vulnreport@tenable.comMedium 5.3
Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. Authentication can be bypassed and a user may view information as Admin by manually browsing to the setup wizard and forcing it to redirect to the desired page.
- Product
- Tew-827dru Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Nov 8, 2021Qwizcards – online quizzes and flashcards: Does not properly sanitize and escape some of its settingsCVE-2021-24706 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Qwizcards – online quizzes and flashcards WordPress plugin before 3.62 does not properly sanitize and escape some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Qwizcards – online quizzes and flashcards
- Fixed in
- 3.62
- What to do
- Update Qwizcards – online quizzes and flashcards to 3.62 or newer.
Oct 28, 2021DEXT5 Upload 5.0.0.117 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the argumeCVE-2020-7875 · Other software · RAONWIZ · reported by vuln@krcert.or.krHigh 7.5
DEXT5 Upload 5.0.0.117 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the argument, variable in the activeX module. This can be leveraged for code execution.
- Product
- DEXT5 Upload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2021As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges byCVE-2021-35231 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 6.7
As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry. Example vulnerable path: "Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Kiwi Syslog Server\Parameters\Application".
- Product
- Kiwi Syslog Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Oct 22, 2021As a result of an unquoted service path vulnerability present in the Kiwi CatTools Installation Wizard, a local attacker could gain escalated privileges by inseCVE-2021-35230 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 6.7
As a result of an unquoted service path vulnerability present in the Kiwi CatTools Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry.
- Product
- Kiwi CatTools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsolarwinds.comsolarwinds.com
Oct 6, 2021In RGB_to_BGR1_portable of SkSwizzler_opts.h, there is a possible out of bounds read due to a missing bounds check.CVE-2021-0689 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In RGB_to_BGR1_portable of SkSwizzler_opts.h, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-190188264
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Sep 7, 2021A vulnerability (improper input validation) in the DEXT5 Upload solution allows an unauthenticated attacker to download and execute an arbitrary file via AddUplCVE-2020-7832 · Other software · RAONWIZ · reported by vuln@krcert.or.krHigh 8.8
A vulnerability (improper input validation) in the DEXT5 Upload solution allows an unauthenticated attacker to download and execute an arbitrary file via AddUploadFile, SetSelectItem, DoOpenFile function.(CVE-2020-7832)
- Product
- DEXT5 Upload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021Nagios XI Docker Wizard before version 1.1.3 is vulnerable to SSRF due to improper sanitation in table_population.php.CVE-2021-37353 · Other software · Nagios · reported by MITRECritical 9.8
Nagios XI Docker Wizard before version 1.1.3 is vulnerable to SSRF due to improper sanitation in table_population.php.
- Product
- Nagios XI Docker Wizard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS CommanCVE-2021-37346 · Other software · Nagios · reported by MITRECritical 9.8
Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Command (OS Command injection).
- Product
- Nagios XI Watchguard Wizard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (OCVE-2021-37344 · Other software · Nagios · reported by MITRECritical 9.8
Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (OS Command injection).
- Product
- Nagios XI Switch Wizard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2021A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a specially-crafted web page.CVE-2020-7863 · Other software · Raonwiz,inc · reported by vuln@krcert.or.krHigh 8.8
A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a specially-crafted web page. This vulnerability is due to insufficient validation of the parameter of the specific method. An attacker could exploit this vulnerability by setting the parameter to the command they want to execute. A successful exploit could allow the attacker to execute arbitrary commands on a target system as the user. However, the victim must run the Internet Explorer browser with administrator privileges because of the cross-domain policy.
- Product
- RAON K Upload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2021An issue in RAONWIZ K Editor v2018.0.0.10 allows attackers to perform a DLL hijacking attack when the service or system is restarted.CVE-2020-29157 · Other software · Raonwiz · reported by MITREHigh 7.8
An issue in RAONWIZ K Editor v2018.0.0.10 allows attackers to perform a DLL hijacking attack when the service or system is restarted.
- Product
- Raon K Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.microsoft.comgist.github.com
Jun 15, 2021Parameter manipulation can bypass authentication to cause file upload and execution.CVE-2020-7864 · Other software · Raonwiz · reported by vuln@krcert.or.krHigh 7.8
Parameter manipulation can bypass authentication to cause file upload and execution. This will execute the remote code. This issue affects: Raonwiz DEXT5Editor versions prior to 3.5.1405747.1100.03.
- Product
- DEXT5Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
May 11, 2021Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Share URL XSS."CVE-2021-32604 · Other software · Solarwinds · reported by MITREMedium 5.4
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Share URL XSS."
- Product
- Serv-u
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comtrustwave.com
May 5, 2021themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizard_actions hook.CVE-2020-36333 · Other software · Themegrill · reported by MITRECritical 9.1
themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizard_actions hook.
- Product
- Themegrill Demo Importer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comwebarxsecurity.com
Apr 2, 2021An issue was discovered in WiZ Colors A60 1.14.0.CVE-2020-11924 · Other software · Wizconnected · reported by MITREMedium 5.5
An issue was discovered in WiZ Colors A60 1.14.0. Wi-Fi credentials are stored in cleartext in flash memory, which presents an information-disclosure risk for a discarded or resold device.
- Product
- Colors A60 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgeurofins-cybersecurity.com
Apr 2, 2021An issue was discovered in WiZ Colors A60 1.14.0.CVE-2020-11923 · Other software · Wizconnected · reported by MITREMedium 5.5
An issue was discovered in WiZ Colors A60 1.14.0. API credentials are locally logged.
- Product
- WIZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgeurofins-cybersecurity.com
Apr 2, 2021An issue was discovered in WiZ Colors A60 1.14.0.CVE-2020-11922 · Other software · Wizconnected · reported by MITREMedium 4.3
An issue was discovered in WiZ Colors A60 1.14.0. The device sends unnecessary information to the cloud controller server. Although this information is sent encrypted and has low risk in isolation, it decreases the privacy of the end user. The information sent includes the local IP address being used and the SSID of the Wi-Fi network the device is connected to. (Various resources such as wigle.net can be use for mapping of SSIDs to physical locations.)
- Product
- A60 Colors Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgcwe.mitre.org
Jan 26, 2021Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to CVE-2021-3193 · Other software · Nagios · reported by MITRECritical 9.8
Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2020In DriverGenius 9.61.5480.28 there is a local privilege escalation vulnerability in the driver wizard, attackers can use constructed programs to increase user pCVE-2020-23740 · Other software · Drivergenius · reported by MITREHigh 7.8
In DriverGenius 9.61.5480.28 there is a local privilege escalation vulnerability in the driver wizard, attackers can use constructed programs to increase user privileges.
- Product
- Drivergenius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrivergenius.comgithub.com
Oct 14, 2020Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard.CVE-2020-25824 · Other software · Telegram · reported by MITRELow 2.4
Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. The threat model is a victim who has voluntarily opened Export Wizard but is then distracted. An attacker then approaches the unattended desktop and pushes the Export key. This attacker may consequently gain access to all chat conversation and media files.
- Product
- Telegram Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2020RAONWIZ v2018.0.2.50 and earlier versions contains a vulnerability that could allow remote files to be downloaded by lack of validation.CVE-2020-7830 · Other software · RAONWIZ · reported by vuln@krcert.or.krHigh 7.8
RAONWIZ v2018.0.2.50 and earlier versions contains a vulnerability that could allow remote files to be downloaded by lack of validation. Vulnerabilities in downloading with Kupload agent allow files to be downloaded to arbitrary paths due to insufficient verification of extensions and download paths. This issue affects: RAONWIZ RAON KUpload 2018.0.2.50 versions and earlier.
- Product
- RAON KUpload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Aug 17, 2020IBM Spectrum Virtualize 8.3.1 could allow a remote user authenticated via LDAP to escalate their privileges and perform actions they should not have access to.CVE-2020-4686 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM Spectrum Virtualize 8.3.1 could allow a remote user authenticated via LDAP to escalate their privileges and perform actions they should not have access to. IBM X-Force ID: 186678.
- Product
- SAN Volume Controller and Storwize Family
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 14, 2020The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, CVE-2020-6286 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.3
The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal.
- Product
- SAP NetWeaver AS JAVA (LM Configuration Wizard)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jul 10, 2020RAONWIZ v2018.0.2.50 and eariler versions contains a vulnerability that could allow remote files to be downloaded and excuted by lack of validation to file exteCVE-2020-7814 · Other software · RAONWIZ · reported by vuln@krcert.or.krHigh 7.8
RAONWIZ v2018.0.2.50 and eariler versions contains a vulnerability that could allow remote files to be downloaded and excuted by lack of validation to file extension, witch can used as remote-code-excution attacks by hackers File download & execution vulnerability in ____COMPONENT____ of RAONWIZ RAON KUpload allows ____ATTACKER/ATTACK____ to cause ____IMPACT____. This issue affects: RAONWIZ RAON KUpload 2018.0.2.50 versions prior to 2018.0.2.51 on Windows.
- Product
- RAON KUpload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
May 29, 2020Insecure storage of sensitive information in ABB Device Library Wizard versions 6.0.X, 6.0.3.1 and 6.0.3.2 allows unauthenticated low privilege user to read filCVE-2020-8482 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7.8
Insecure storage of sensitive information in ABB Device Library Wizard versions 6.0.X, 6.0.3.1 and 6.0.3.2 allows unauthenticated low privilege user to read file that contains confidential data
- Product
- ABB Device Library Wizard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
May 21, 2020In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update module(web.js) allows an attacker to modify arguments CVE-2020-7808 · Other software · RAONWIZ Inc · reported by vuln@krcert.or.krHigh 8.7
In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update module(web.js) allows an attacker to modify arguments which causes downloading a random DLL and injection on it.
- Product
- K Upload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2020dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arCVE-2019-19164 · Other software · RAONWiz · reported by vuln@krcert.or.krHigh 7.8
dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.
- Product
- dext.ocx ActiveX Control in Dext5 Upload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2020Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download arbitrary file by setting the arguments CVE-2019-19169 · Other software · RAONwiz · reported by vuln@krcert.or.krHigh 7.8
Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.
- Product
- Dext.ocx ActiveX Control in Dext5 Upload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2020Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download and execute remote arbitrary file by setCVE-2019-19168 · Other software · RAONwiz · reported by vuln@krcert.or.krHigh 7.8
Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download and execute remote arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.
- Product
- Dext.ocx ActiveX Control in Dext5 Upload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2020dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability.CVE-2020-11002 · Other software · dropwizard · reported by GitHubHigh 8
dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability. If you are using a self-validating bean an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended. The changes introduced in Dropwizard 1.3.19 and 2.0.2 for CVE-2020-5245 unfortunately did not fix the underlying issue completely. The issue has been fixed in dropwizard-validation 1.3.21 and 2.0.3 or later. We strongly recommend upgrading to one of these versions.
- Product
- dropwizard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.jboss.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.