Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
217 results · page 4 of 5
Sep 13, 2022IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to obtain root privileges.CVE-2022-36768 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to obtain root privileges. IBM X-Force ID: 232014.
- Product
- AIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 25, 2022SEO Scout plugin <= 0.9.83 at: Cross-Site Request Forgery (CSRF)CVE-2022-36358 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in SEO Scout plugin <= 0.9.83 at WordPress allows attackers to trick users with administrative rights to unintentionally change the plugin settings.
- Product
- SEO Scout plugin <= 0.9.83 at
- Affected
- up to 0.9.83
- What to do
- Affects up to 0.9.83. Update SEO Scout plugin <= 0.9.83 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 2, 2022NetScout nGeniusONE 6.3.2 allows Java RMI Code Execution.CVE-2021-45983 · Other software · Netscout · reported by MITRECritical 9.8
NetScout nGeniusONE 6.3.2 allows Java RMI Code Execution.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Jun 2, 2022NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user.CVE-2021-45982 · Other software · Netscout · reported by MITREHigh 8.8
NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Jun 2, 2022NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack.CVE-2021-45981 · Other software · Netscout · reported by MITRECritical 9.8
NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
May 5, 2022Server-Side Request Forgery in scout in GitHub repository clinical-genomics/scout prior to v4.42.CVE-2022-1592 · Other software · clinical-genomics · reported by security@huntr.devHigh 8.2
Server-Side Request Forgery in scout in GitHub repository clinical-genomics/scout prior to v4.42. An attacker could make the application perform arbitrary requests to fishing steal cookie, request to private area, or lead to xss...
- Product
- clinical-genomics/scout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2022Path Traversal due to `send_file` call in GitHub repository clinical-genomics/scout prior to 4.52.CVE-2022-1554 · Other software · clinical-genomics · reported by security@huntr.devHigh 7.5
Path Traversal due to `send_file` call in GitHub repository clinical-genomics/scout prior to 4.52.
- Product
- clinical-genomics/scout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2021ForeScout - SecureConnector Local Service DoS - A low privilaged user which doesn't have permissions to shutdown the secure connector service writes a large amoCVE-2021-36724 · Other software · ForeScout · reported by cna@cyber.gov.ilMedium 6.1
ForeScout - SecureConnector Local Service DoS - A low privilaged user which doesn't have permissions to shutdown the secure connector service writes a large amount of characters in the installationPath. This will cause the buffer to overflow and override the stack cookie causing the service to crash.
- Product
- eServices / eNvoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2021NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows URL redirection in redirector.CVE-2021-35205 · Other software · Netscout · reported by MITREMedium 5.4
NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows URL redirection in redirector.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Sep 30, 2021NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflected Cross-Site Scripting (XSS) in the support endpoint.CVE-2021-35204 · Other software · Netscout · reported by MITREMedium 5.4
NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflected Cross-Site Scripting (XSS) in the support endpoint.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Sep 30, 2021NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Arbitrary File Read operations via the FDSQueryService endpoint.CVE-2021-35203 · Other software · Netscout · reported by MITREMedium 5.7
NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Arbitrary File Read operations via the FDSQueryService endpoint.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Sep 30, 2021NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authorization Bypass (to access an endpoint) in FDSQueryService.CVE-2021-35202 · Other software · Netscout · reported by MITREMedium 4.3
NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authorization Bypass (to access an endpoint) in FDSQueryService.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Sep 30, 2021NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks.CVE-2021-35201 · Other software · Netscout · reported by MITREMedium 6.5
NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Sep 30, 2021NETSCOUT nGeniusONE 6.3.0 build 1196 allows high-privileged users to achieve Stored Cross-Site Scripting (XSS) in FDSQueryService.CVE-2021-35200 · Other software · Netscout · reported by MITREMedium 4.8
NETSCOUT nGeniusONE 6.3.0 build 1196 allows high-privileged users to achieve Stored Cross-Site Scripting (XSS) in FDSQueryService.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Sep 30, 2021NETSCOUT nGeniusONE 6.3.0 build 1196 and earlier allows Stored Cross-Site Scripting (XSS) in UploadFile.CVE-2021-35199 · Other software · Netscout · reported by MITREMedium 5.4
NETSCOUT nGeniusONE 6.3.0 build 1196 and earlier allows Stored Cross-Site Scripting (XSS) in UploadFile.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Sep 30, 2021NETSCOUT nGeniusONE 6.3.0 build 1004 and earlier allows Stored Cross-Site Scripting (XSS) in the Packet Analysis module.CVE-2021-35198 · Other software · Netscout · reported by MITREMedium 5.4
NETSCOUT nGeniusONE 6.3.0 build 1004 and earlier allows Stored Cross-Site Scripting (XSS) in the Packet Analysis module.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Jul 15, 2021Nightscout Web Monitor (aka cgm-remote-monitor) 14.2.2 allows XSS via a crafted X-Forwarded-For header.CVE-2021-36755 · Other software · Cgm-remote-monitor Project · reported by MITREMedium 6.1
Nightscout Web Monitor (aka cgm-remote-monitor) 14.2.2 allows XSS via a crafted X-Forwarded-For header.
- Product
- Cgm-remote-monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2021The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX aCVE-2021-24246 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues
- Product
- Workscout Core
- Fixed in
- 1.3.4
- What to do
- Update Workscout Core to 1.3.4 or newer.
Apr 14, 2021An issue was discovered in Forescout CounterACT before 8.1.4.CVE-2021-28098 · Other software · Forescout · reported by MITREHigh 7.8
An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector runs with administrative privileges and writes logs entries to a file in %PROGRAMDATA%\ForeScout SecureConnector\ that has full permissions for the Everyone group. Using a symbolic link allows an attacker to point the log file to a privileged location such as %WINDIR%\System32. The resulting log file adopts the file permissions of the source of the symbolic link (in this case, the Everyone group). The log file in System32 can be replaced and renamed with a malicious DLL for DLL hijacking.
- Product
- Counteract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.forescout.comjordanpotti.com
Apr 5, 2021WooCommerce Help Scout: (https://woocommerceCVE-2021-24212 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated users to upload any files to the site which by default will end up in wp-content/uploads/hstmp.
- Product
- WooCommerce Help Scout
- Fixed in
- 2.9.1
- What to do
- Update WooCommerce Help Scout to 2.9.1 or newer.
Full record and what to do →NVD recorddzv365zjfbd8v.cloudfront.netwpscan.com
Dec 9, 2020A buffer overflow in the web server of Flexense DupScout Enterprise 10.0.18 allows a remote anonymous attacker to execute code as SYSTEM by overflowing the sid CVE-2020-29659 · Other software · Flexense · reported by MITRECritical 9.8
A buffer overflow in the web server of Flexense DupScout Enterprise 10.0.18 allows a remote anonymous attacker to execute code as SYSTEM by overflowing the sid parameter via a GET /settings&sid= attack.
- Product
- Dupscout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comdupscout.com
Dec 3, 2020NETSCOUT AirMagnet Enterprise 11.1.4 build 37257 and earlier has a sensor escalated privileges vulnerability that can be exploited to provide someone with adminCVE-2020-28251 · Other software · Netscout · reported by MITREHigh 8.1
NETSCOUT AirMagnet Enterprise 11.1.4 build 37257 and earlier has a sensor escalated privileges vulnerability that can be exploited to provide someone with administrative access to a sensor, with credentials to invoke a command to provide root access to the operating system. The attacker must complete a straightforward password-cracking exercise.
- Product
- Airmagnet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Dec 12, 2019The Scoutnet Kalender plugin 1.1.0 for WordPress allows XSS.CVE-2019-19198 · WordPress plugins & themes · reported by MITREMedium 5.4
The Scoutnet Kalender plugin 1.1.0 for WordPress allows XSS.
- Affected
- 1.1.0 to 1.1.0
- What to do
- Affects 1.1.0 to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Aug 12, 2019The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the autCVE-2019-14951 · Other software · Telenav · reported by MITREHigh 7.5
The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the authentication process, which makes it easier for attackers to obtain multimedia-screen access via port 7050 on the cellular network, as demonstrated by a DrivingRestriction method call to uma/jsonrpc/mobile.
- Product
- Scout GPS Link
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsites.google.comsites.google.com
Sep 13, 2018HiScout GRC Suite before 3.1.5 allows Unrestricted Upload of Files with Dangerous Types.CVE-2018-16796 · Other software · Hiscout · reported by MITREHigh 8.8
HiScout GRC Suite before 3.1.5 allows Unrestricted Upload of Files with Dangerous Types.
- Product
- GRC Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2018XSS exists in Flexense DupScout Enterprise from v10.0.18 to v10.7.CVE-2018-10566 · Other software · Flexense · reported by MITREMedium 6.1
XSS exists in Flexense DupScout Enterprise from v10.0.18 to v10.7.
- Product
- Dupscout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.n0ipr0cs.ioseclists.org
Jan 24, 2018A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, anCVE-2017-13696 · Other software · Flexense · reported by MITRECritical 9.8
A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, and Disk Pulse Enterprise 9.9.16 where an attacker can craft a malicious GET request and exploit the web server component. Successful exploitation of the software will allow an attacker to gain complete access to the system with NT AUTHORITY / SYSTEM level privileges. The vulnerability lies due to improper handling and sanitization of the incoming request.
- Product
- Dupscout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Sep 9, 2014The Scoutmob local deals & events (aka com.scoutmob.ile) application 3.0.18 for Android does not verify X.509 certificates from SSL servers, which allows man-inCVE-2014-5694 · Other software · Scoutmob · reported by cret@cert.orgMedium 5.4
The Scoutmob local deals & events (aka com.scoutmob.ile) application 3.0.18 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Scoutmob Local Deals & Event
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Dec 5, 2012The Forescout CounterACT NAC device 6.3.4.1 does not block ARP and ICMP traffic from unrecognized clients, which allows remote attackers to conduct ARP poisoninCVE-2012-4985 · Other software · Forescout · reported by MITREMedium 4.3
The Forescout CounterACT NAC device 6.3.4.1 does not block ARP and ICMP traffic from unrecognized clients, which allows remote attackers to conduct ARP poisoning attacks via crafted packets.
- Product
- Counteract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgreactionpenetrationtesting.co.uk
Dec 5, 2012Multiple cross-site scripting (XSS) vulnerabilities on the Forescout CounterACT NAC device before 7.0 allow remote attackers to inject arbitrary web script or HCVE-2012-4983 · Other software · Forescout · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities on the Forescout CounterACT NAC device before 7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the a parameter to assets/login or (2) the query parameter to assets/rangesearch.
- Product
- Counteract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordreactionpenetrationtesting.co.uksecurityfocus.com
Dec 5, 2012Open redirect vulnerability in assets/login on the Forescout CounterACT NAC device before 7.0 allows remote attackers to redirect users to arbitrary web sites aCVE-2012-4982 · Other software · Forescout · reported by MITREMedium 5.8
Open redirect vulnerability in assets/login on the Forescout CounterACT NAC device before 7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the a parameter.
- Product
- Counteract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordreactionpenetrationtesting.co.uksecurityfocus.com
Nov 26, 2012Directory traversal vulnerability in ibrowser.php in the CMScout 2.09 IBrowser TinyMCE Plugin 1.4.1, when magic_quotes_gpc is disabled, allows remote attackers CVE-2010-5281 · Other software · Net4visions · reported by MITREMedium 6.8
Directory traversal vulnerability in ibrowser.php in the CMScout 2.09 IBrowser TinyMCE Plugin 1.4.1, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter. NOTE: some of these details are obtained from third party information.
- Product
- Ibrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Aug 23, 2012The default configuration of the SMTP component in Websense Email Security 6.1 through 7.3 enables weak SSL ciphers in the "SurfControl plc\SuperScout Email FilCVE-2012-4605 · Other software · Websense · reported by MITREMedium 5
The default configuration of the SMTP component in Websense Email Security 6.1 through 7.3 enables weak SSL ciphers in the "SurfControl plc\SuperScout Email Filter\SMTP" registry key, which makes it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data.
- Product
- Websense Email Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comwebsense.com
Jun 11, 2012Multiple cross-site scripting (XSS) vulnerabilities in the status program on the ForeScout CounterACT appliance with software 6.3.3.2 through 6.3.4.10 allow remCVE-2012-1825 · Other software · Forescout · reported by cret@cert.orgMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the status program on the ForeScout CounterACT appliance with software 6.3.3.2 through 6.3.4.10 allow remote attackers to inject arbitrary web script or HTML via (1) the loginname parameter in a forgotpass action or (2) the username parameter.
- Product
- Counteract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Jan 3, 2012The (1) bin/invscoutClient_VPD_Survey and (2) sbin/invscout_lsvpd programs in invscout.rte before 2.2.0.19 on IBM AIX 7.1, 6.1, 5.3, and earlier allow local useCVE-2011-1384 · Other software · IBM · reported by MITREMedium 4
The (1) bin/invscoutClient_VPD_Survey and (2) sbin/invscout_lsvpd programs in invscout.rte before 2.2.0.19 on IBM AIX 7.1, 6.1, 5.3, and earlier allow local users to delete arbitrary files, or trigger inventory scout operations on arbitrary files, via a symlink attack on an unspecified file.
- Product
- Invscout.rte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaix.software.ibm.comsecunia.com
Nov 22, 2011SQL injection vulnerability in index.php in CMScout 2.0.8 allows remote attackers to execute arbitrary SQL commands via the album parameter in a photos action.CVE-2010-5059 · Other software · Cmscout · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in CMScout 2.0.8 allows remote attackers to execute arbitrary SQL commands via the album parameter in a photos action.
- Product
- Cmscout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Jun 3, 2010Cross-site scripting (XSS) vulnerability in the Search Site in CMScout 2.09, and possibly other versions, allows remote attackers to inject arbitrary web scriptCVE-2010-2154 · Other software · Cmscout · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Search Site in CMScout 2.09, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: some of these details are obtained from third party information.
- Product
- Cmscout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2009SQL injection vulnerability in the Boy Scout Advancement (com_bsadv) component 0.3 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commCVE-2009-2290 · Other software · KIM Eckert · reported by MITREHigh 7.5
SQL injection vulnerability in the Boy Scout Advancement (com_bsadv) component 0.3 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a (1) account or (2) event task to index.php.
- Product
- COM Bsadv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Apr 17, 2009Multiple directory traversal vulnerabilities in CMScout 2.06, when register_globals is enabled, allow remote attackers to include and execute arbitrary local fiCVE-2008-6726 · Other software · Cmscout · reported by MITREMedium 6
Multiple directory traversal vulnerabilities in CMScout 2.06, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the bit parameter to (1) admin.php and (2) index.php, different vectors than CVE-2008-3415.
- Product
- Cmscout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2009Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) index.php CVE-2008-6725 · Other software · Cmscout · reported by MITREMedium 6
Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) index.php in a mythings page (mythings.php) and (2) the users page in admin.php.
- Product
- Cmscout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2009NetScout (formerly Network General) Visualizer V2100 and InfiniStream i1730 do not restrict access to ResourceManager/en_US/domains/add_domain.jsp, which allowsCVE-2008-6701 · Other software · Netscout · reported by MITREHigh 7.5
NetScout (formerly Network General) Visualizer V2100 and InfiniStream i1730 do not restrict access to ResourceManager/en_US/domains/add_domain.jsp, which allows remote attackers to gain administrator privileges via a direct request.
- Product
- Ngenius Infinistream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2008Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary localCVE-2008-3415 · Other software · Cmscout · reported by MITREHigh 7.5
Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter, as demonstrated by an upload to avatar/ of a .jpg file containing PHP sequences.
- Product
- Cmscout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Jun 25, 2008Cross-site scripting (XSS) vulnerability in the TrailScout module 5.x before 5.x-1.4 for Drupal allows remote authenticated users, with create post permissions,CVE-2008-2849 · Websites & servers · Drupal · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the TrailScout module 5.x before 5.x-1.4 for Drupal allows remote authenticated users, with create post permissions, to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Trailscout Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2008SQL injection vulnerability in the TrailScout module 5.x before 5.x-1.4 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified cooCVE-2008-2850 · Websites & servers · Drupal · reported by MITREHigh 7.5
SQL injection vulnerability in the TrailScout module 5.x before 5.x-1.4 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified cookies, related to improper use of the Drupal database API.
- Product
- Trailscout Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2007Unspecified vulnerability in invscout in Inventory Scout in invscout.rte in IBM AIX 5.2 and 5.3 allows local users to delete system files that have names matchiCVE-2007-4798 · Other software · IBM · reported by MITREMedium 6.6
Unspecified vulnerability in invscout in Inventory Scout in invscout.rte in IBM AIX 5.2 and 5.3 allows local users to delete system files that have names matching the final substring of a hostname alias, as demonstrated by hostnames ending in "unix".
- Product
- AIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2007SQL injection vulnerability in forums.php in CMScout 1.23 and earlier allows remote attackers to execute arbitrary SQL commands via the f parameter in a forums CVE-2007-3812 · Other software · Cmscout · reported by MITREHigh 7.5
SQL injection vulnerability in forums.php in CMScout 1.23 and earlier allows remote attackers to execute arbitrary SQL commands via the f parameter in a forums action to index.php.
- Product
- Cmscout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgpacketstorm.linuxsecurity.com
Sep 26, 2006Unspecified vulnerability in IBM Inventory Scout for AIX 2.2.0.0 through 2.2.0.9 (invscoutClient_VPD_Survey) allows attackers to overwrite arbitrary files via uCVE-2006-5002 · Other software · IBM · reported by MITREMedium 5
Unspecified vulnerability in IBM Inventory Scout for AIX 2.2.0.0 through 2.2.0.9 (invscoutClient_VPD_Survey) allows attackers to overwrite arbitrary files via unspecified vectors.
- Product
- Inventory Scout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaix.software.ibm.comsecunia.com
Jun 28, 2006SQL injection vulnerability in SPT--ForumTopics.php in Scout Portal Toolkit (SPT) 1.4.0 and earlier allows remote attackers to execute arbitrary SQL commands viCVE-2006-3309 · Other software · Internet Scout Project · reported by MITREHigh 7.5
SQL injection vulnerability in SPT--ForumTopics.php in Scout Portal Toolkit (SPT) 1.4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the forumid parameter.
- Product
- Scout Portal Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2006Multiple cross-site scripting (XSS) vulnerabilities in CMScout 1.10 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the Body fCVE-2006-2188 · Other software · Cmscout · reported by MITREMedium 6.8
Multiple cross-site scripting (XSS) vulnerabilities in CMScout 1.10 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the Body field of a private message (PM), (2) BBCode, or (3) a forum post.
- Product
- Cmscout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Dec 13, 2005Multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the PareCVE-2005-4195 · Other software · Internet Scout · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the ParentId parameter in SPT--BrowseResources.php, (2) ResourceId parameter in SPT--FullRecord.php, (3) ResourceOffset parameter in SPT--Home.php, and (4) F_UserName and (5) F_Password in SPT--UserLogin.php. NOTE: it was later reported that vector 1 is also present in 1.4.0.
- Product
- Scout Portal Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.