Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
234 results · page 4 of 5
Aug 29, 2019The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.CVE-2019-15781 · WordPress plugins & themes · reported by MITREHigh 8.8
The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.
- Product
- facebook-by-weblizar
- Fixed in
- 2.8.5
- What to do
- Update facebook-by-weblizar to 2.8.5 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 27, 2019The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.CVE-2015-9351 · WordPress plugins & themes · reported by MITRECritical 9.8
The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.
- Product
- feed-them-social
- Fixed in
- 1.7.0
- What to do
- Update feed-them-social to 1.7.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 27, 2019The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.CVE-2015-9350 · WordPress plugins & themes · reported by MITREMedium 6.1
The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.
- Product
- feed-them-social
- Fixed in
- 1.7.0
- What to do
- Update feed-them-social to 1.7.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 20, 2019A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resulting in memory exhauCVE-2019-11924 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resulting in memory exhaustion. This issue affects versions v2019.01.28.00 and above of fizz, until v2019.08.05.00.
- Product
- fizz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2019A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output bufCVE-2019-11922 · Other software · Facebook · reported by cve-assign@fb.comHigh 8.1
A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
- Product
- Zstandard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jul 25, 2019An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformeCVE-2019-11921 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformed binary content in Structured HTTP Headers. This issue affects versions of proxygen prior to v2019.07.22.00.
- Product
- Proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
Jul 18, 2019Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p).CVE-2019-3570 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p). This happens if the parameters are configurable by an attacker for instance by providing the output of scrypt_enc() in a context where Hack/PHP code would attempt to verify it by re-running scrypt_enc() with the same parameters. This could result in information disclosure, memory being overwriten or crashes of the HHVM process. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2019An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed witCVE-2019-3571 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.3
An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed with a wrong extension.
- Product
- WhatsApp Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacebook.comfacebook.com
Jun 26, 2019HHVM, when used with FastCGI, would bind by default to all available interfaces.CVE-2019-3569 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2019An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers.CVE-2018-6350 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android prior to 2.18.276, WhatsApp Business for Android prior to 2.18.99, WhatsApp for iOS prior to 2.18.100.6, WhatsApp Business for iOS prior to 2.18.100.2, and WhatsApp for Windows Phone prior to 2.18.224.
- Product
- WhatsApp for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comfacebook.com
Jun 14, 2019When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow.CVE-2018-6349 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects WhatsApp for Android prior to 2.18.248 and WhatsApp Business for Android prior to 2.18.132.
- Product
- WhatsApp for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comfacebook.com
Jun 14, 2019When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in.CVE-2018-6339 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An off-by-one error meant that data was written beyond the allocated space on the stack. This issue affects WhatsApp for Android starting in version 2.18.180 and was fixed in version 2.18.295. It also affects WhatsApp Business for Android starting in version v2.18.103 and was fixed in version v2.18.150.
- Product
- WhatsApp for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacebook.comfacebook.com
Jun 14, 2019When receiving calls using WhatsApp for iOS, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow.CVE-2018-20655 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
When receiving calls using WhatsApp for iOS, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects WhatsApp for iOS prior to v2.18.90.24 and WhatsApp Business for iOS prior to v2.18.90.24.
- Product
- WhatsApp for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comfacebook.com
Jun 3, 2019In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious binarCVE-2019-3567 · Other software · Facebook · reported by cve-assign@fb.comHigh 8.1
In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious binary to a folder with known 'safe' permissions. Under those circumstances osquery will load said malicious executable with SYSTEM permissions. The solution is to migrate installations to the 'Program Files' directory on Windows which restricts unprivileged write access. This issue affects osquery prior to v3.4.0.
- Product
- osquery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacebook.comfacebook.com
May 10, 2019A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover prevCVE-2019-3566 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.9
A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover previously sent messages. This behavior requires independent knowledge of metadata for previous messages, which are not available publicly. This issue affects WhatsApp for Android 2.19.52 and 2.19.54 - 2.19.103, as well as WhatsApp Business for Android starting in v2.19.22 until v2.19.38.
- Product
- WhatsApp for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacebook.comfacebook.com
May 6, 2019Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown type.CVE-2019-3565 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.05.06.00.
- Product
- Facebook Thrift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
May 6, 2019Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type.CVE-2019-3564 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
- Product
- Facebook Thrift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
May 6, 2019Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type.CVE-2019-3559 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
- Product
- Facebook Thrift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
May 6, 2019Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type.CVE-2019-3558 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
- Product
- Facebook Thrift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
May 6, 2019C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type.CVE-2019-3552 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
- Product
- Facebook Thrift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Apr 29, 2019Wangle's LineBasedFrameDecoder contains logic for identifying newlines which incorrectly advances a buffer, leading to a potential underflow.CVE-2019-3563 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
Wangle's LineBasedFrameDecoder contains logic for identifying newlines which incorrectly advances a buffer, leading to a potential underflow. This affects versions of Wangle prior to v2019.04.22.00
- Product
- Wangle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2019Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory.CVE-2019-3561 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects all supported versions of HHVM (4.0.3, 3.30.4, and 3.27.7 and below).
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2019An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denial-of-service based on user input.CVE-2019-3560 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denial-of-service based on user input. This issue affected versions of fizz prior to v2019.03.04.00.
- Product
- fizz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Mar 21, 2019The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS.CVE-2019-9911 · WordPress plugins & themes · reported by MITREMedium 6.1
The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS.
- Product
- social-networks-auto-poster-facebook-twitter-g
- Fixed in
- 4.2.8
- What to do
- Update social-networks-auto-poster-facebook-twitter-g to 4.2.8 or newer.
Full record and what to do →NVD recordseclists.orglists.openwall.net
Jan 15, 2019The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently.CVE-2019-3557 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2019Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attack against systems acCVE-2019-3554 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.9
Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attack against systems accepting such connections. This affects versions of Wangle prior to v2019.01.14.00
- Product
- Wangle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2019The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large.CVE-2018-6345 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal implementation of the function will cause a string to be created with an invalid length, which can then interact poorly with other functions. This affects all supported versions of HHVM (3.30.1 and 3.27.5 and below).
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).CVE-2018-20682 · Other software · Fork-cms · reported by MITREMedium 5.4
Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).
- Product
- Fork CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsparker.comnetsparker.com
Dec 31, 2018The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering.CVE-2018-6333 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content inside of the editor's context, which could potentially be chained to lead to code execution. This issue affected Nuclide prior to v0.290.0.
- Product
- Nuclide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018Buck parser-cache command loads/saves state using Java serialized object.CVE-2018-6331 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01.
- Product
- Buck
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack.CVE-2018-6347 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This affects Proxygen prior to v2018.12.31.00.
- Product
- Proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency).CVE-2018-6346 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). This affects Proxygen prior to v2018.12.31.00.
- Product
- Proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established.CVE-2018-6344 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established. The vulnerability can be used to cause denial of service. It affects WhatsApp for Android prior to v2.18.293, WhatsApp for iOS prior to v2.18.93, and WhatsApp for Windows Phone prior to v2.18.172.
- Product
- WhatsApp for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgoogleprojectzero.blogspot.com
Dec 31, 2018Proxygen fails to validate that a secondary auth manager is set before dereferencing it.CVE-2018-6343 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00.
- Product
- Proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor.CVE-2018-6342 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. This issue affects multiple branches: 1.x.x prior to 1.0.4, 2.x.x prior to 2.0.2, 3.x.x prior to 3.1.2, 4.x.x prior to 4.2.2, and 5.x.x prior to 5.0.2.
- Product
- react-dev-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time.CVE-2018-6341 · Other software · Facebook · reported by cve-assign@fb.comMedium 6.1
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.
- Product
- react-dom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordreactjs.orgtwitter.com
Dec 31, 2018The Memcache::getextendedstats function can be used to trigger an out-of-bounds read.CVE-2018-6340 · Other software · Facebook · reported by cve-assign@fb.comHigh 8.1
The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached server hostnames and/or ports. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018folly::secureRandom will re-use a buffer between parent and child processes when fork() is called.CVE-2018-6337 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018An issue was discovered in osquery.CVE-2018-6336 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.8
An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute. This issue affects osquery prior to v3.2.7
- Product
- osquery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data.CVE-2018-6335 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data. This behavior can lead to denial-of-service. This affects all supported versions of HHVM (3.25.2, 3.24.6, and 3.21.10 and below) when using the proxygen server to handle HTTP2 requests.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018Multipart-file uploads call variables to be improperly registered in the global scope.CVE-2018-6334 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly before being used this can lead to unexpected behavior. This affects all supported versions of HHVM prior to the patch (3.25.1, 3.24.5, and 3.21.9 and below).
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2018A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate resources.CVE-2018-6332 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.9
A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate resources. This affects all supported versions of HHVM (3.24.3 and 3.21.7 and below) when using the proxygen server to handle HTTP2 requests.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2018Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for: Cross-site scriptingCVE-2018-0579 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for
- Fixed in
- 2.2.4.1
- What to do
- Update Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for to 2.2.4.1 or newer.
Feb 11, 2018Cross Site Scripting (XSS) exists in PHP Scripts Mall Facebook Clone Script.CVE-2018-6858 · Other software · Facebook Clone Script Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in PHP Scripts Mall Facebook Clone Script.
- Product
- Facebook Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jan 29, 2018SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chat_im/chat_window.php request_id parameter or the /search_events.php category pCVE-2018-6367 · Other software · Vastal · reported by MITRECritical 9.8
SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chat_im/chat_window.php request_id parameter or the /search_events.php category parameter.
- Product
- I-tech Buddy Zone Facebook Clone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Jan 24, 2018SQL Injection exists in Facebook Style Php Ajax Chat Zechat 1.5 via the login.php User field.CVE-2018-5978 · Other software · Zechat Project · reported by MITRECritical 9.8
SQL Injection exists in Facebook Style Php Ajax Chat Zechat 1.5 via the login.php User field.
- Product
- Zechat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jan 4, 2018The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php.CVE-2018-5214 · WordPress plugins & themes · reported by MITREMedium 5.4
The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php.
- Product
- Add Link to Facebook
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Add Link to Facebook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordpress.org
Dec 13, 2017Facebook Clone Script 1.0 has SQL Injection via the friend-profile.php id parameter.CVE-2017-17615 · Other software · Facebook Clone Script Project · reported by MITREHigh 8.8
Facebook Clone Script 1.0 has SQL Injection via the friend-profile.php id parameter.
- Product
- Facebook Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
May 18, 2017Facebook WhatsApp Messenger before 2.16.323 for Android uses the SD card for cleartext storage of files (Audio, Documents, Images, Video, and Voice Notes) assocCVE-2017-8769 · Other software · Whatsapp · reported by MITREMedium 4.6
Facebook WhatsApp Messenger before 2.16.323 for Android uses the SD card for cleartext storage of files (Audio, Documents, Images, Video, and Voice Notes) associated with a chat, even after that chat is deleted. There may be users who expect file deletion to occur upon chat deletion, or who expect encryption (consistent with the application's use of an encrypted database to store chat text). NOTE: the vendor reportedly indicates that they do not "consider these to be security issues" because a user may legitimately want to preserve any file for use "in other apps like the Google Photos gallery" regardless of whether its associated chat is deleted
- Product
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comwwws.nightwatchcybersecurity.com
Apr 9, 2017Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks.CVE-2015-7265 · Other software · Proxygen Project · reported by cret@cert.orgHigh 7.5
Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks.
- Product
- Proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgroups.google.comgroups.google.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.