Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,633 results · page 43 of 73
May 10, 2021Cross Site Scripting (XSS) in Hotels_Server v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fields in the componenCVE-2020-18102 · Other software · Hotels Server Project · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Hotels_Server v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fields in the component "/controller/publishHotel.php".
- Product
- Hotels Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2021Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure CVE-2021-25848 · Other software · Moxa · reported by MITRECritical 9.1
Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure to attackers due to using fixed loop counter variable without checking the actual available length via a crafted lldp packet.
- Product
- Vport 06ec-2v26m Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2021Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure CVE-2021-25847 · Other software · Moxa · reported by MITRECritical 9.1
Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure to attackers due to controllable loop counter variable via a crafted lldp packet.
- Product
- Vport 06ec-2v26m Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2021Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the ECCVE-2021-20717 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser.
- Product
- EC-CUBE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2021In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLFieldCVE-2021-32052 · Other software · Djangoproject · reported by MITREMedium 6.1
In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comdocs.djangoproject.com
May 6, 2021Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cgi ping command, whicCVE-2021-28151 · Other software · Hongdian · reported by MITREHigh 8.8
Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cgi ping command, which is accessible with the username guest and password guest.
- Product
- H8922 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.hongdian.comssd-disclosure.com
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from lack of sanitisation in the label of the Form FieldsCVE-2021-24250 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from lack of sanitisation in the label of the Form Fields, leading to Authenticated Stored Cross-Site Scripting issues across various pages of the plugin.
- Product
- Business Directory Plugin – Easy Listing Directories for
- Fixed in
- 5.11.2
- What to do
- Update Business Directory Plugin – Easy Listing Directories for to 5.11.2 or newer.
May 5, 2021In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded filesCVE-2021-31542 · Other software · Djangoproject · reported by MITREHigh 7.5
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comdocs.djangoproject.com
Apr 30, 2021OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a sCVE-2021-31934 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a smartphone.
- Product
- Open-xchange Appsuite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Apr 30, 2021XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name fieldCVE-2021-31792 · Other software · Salesagility · reported by MITREMedium 5.4
XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchris-forbes.github.iodocs.suitecrm.com
Apr 30, 2021Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to CVE-2020-18084 · Other software · Yzmcms · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component "/member/index/login.html" when logging in.
- Product
- Yzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2021pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field.CVE-2021-27933 · Other software · Pfsense · reported by MITREMedium 6.1
pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Apr 27, 2021Unisys Data Exchange Management Studio through 5.0.34 doesn't sanitize the input to a HTML document field.CVE-2020-35542 · Other software · Unisys · reported by MITREMedium 5.4
Unisys Data Exchange Management Studio through 5.0.34 doesn't sanitize the input to a HTML document field. This could be used for an XSS attack.
- Product
- Data Exchange Management Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublic.support.unisys.compublic.support.unisys.com
Apr 23, 2021Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 throCVE-2021-31405 · Other software · Vaadin · reported by security@vaadin.comHigh 7.5
Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
- Product
- Vaadin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2021Advanced Custom Fields Pro: Did not properly escape the generated update URLCVE-2021-24241 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.
- Product
- Advanced Custom Fields Pro
- Fixed in
- 5.9.1
- What to do
- Update Advanced Custom Fields Pro to 5.9.1 or newer.
Apr 21, 2021Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Chat" and "Personal Address" field on staff/register.phpCVE-2021-31329 · Other software · Remoteclinic · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Chat" and "Personal Address" field on staff/register.php
- Product
- Remote Clinic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2021Stored XSS in Remote Clinic v2.0 in /medicines due to Medicine Name Field.CVE-2021-31327 · Other software · Remoteclinic · reported by MITREMedium 5.4
Stored XSS in Remote Clinic v2.0 in /medicines due to Medicine Name Field.
- Product
- Remote Clinic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2021Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.CVE-2020-28124 · Other software · Lavalite · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2021In parsePrimaryFieldFirstUidAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow.CVE-2021-0426 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In parsePrimaryFieldFirstUidAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174485572
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 12, 2021Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php.CVE-2021-30044 · Other software · Remoteclinic · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php.
- Product
- Remote Clinic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 12, 2021Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Clinic Name", "Clinic Address", "Clinic City", or "Clinic Contact" field on clinics/register.phpCVE-2021-30042 · Other software · Remoteclinic · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Clinic Name", "Clinic Address", "Clinic City", or "Clinic Contact" field on clinics/register.php
- Product
- Remote Clinic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 12, 2021Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-report.php.CVE-2021-30039 · Other software · Remoteclinic · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-report.php.
- Product
- Remote Clinic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 12, 2021Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php.CVE-2021-30034 · Other software · Remoteclinic · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php.
- Product
- Remote Clinic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 12, 2021Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php.CVE-2021-30030 · Other software · Remoteclinic · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php.
- Product
- Remote Clinic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 9, 2021An exploitable SQL injection vulnerability exists in the "forms_fields_rules/rules" page of the Rukovoditel Project Management App 2.7.2.CVE-2020-13587 · Other software · Rukovoditel · reported by talos-cna@cisco.comHigh 8.8
An exploitable SQL injection vulnerability exists in the "forms_fields_rules/rules" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be done either with administrator credentials or through cross-site request forgery.
- Product
- Rukovoditel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Apr 8, 2021Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed.CVE-2021-22115 · Other software · Cloudfoundry · reported by security@vmware.comMedium 6.5
Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed. CAPI database logs service broker password in plain text whenever a job to clean up orphaned items is run by Cloud Controller.
- Product
- Capi-release
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudfoundry.orgcloudfoundry.org
Apr 8, 2021An issue was discovered in Realtek rtl8723de BLE Stack <= 4.1 that allows remote attackers to cause a Denial of Service via the interval field to the CONNECT_RECVE-2020-23539 · Network & remote access · Realtek · reported by MITREHigh 7.5
An issue was discovered in Realtek rtl8723de BLE Stack <= 4.1 that allows remote attackers to cause a Denial of Service via the interval field to the CONNECT_REQ message.
- Product
- Rtl8723de Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2021A blind XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in event name and description fields.CVE-2021-30113 · Other software · Web-school · reported by MITREMedium 6.1
A blind XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in event name and description fields. An attacker can inject a JavaScript code that will be stored in the page. If any visitor sees the event, then the payload will be executed and sends the victim's information to the attacker website.
- Product
- Enterprise Resource Planning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb-school.ingithub.com
Apr 8, 2021A stored XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in the event name and description fields.CVE-2021-30111 · Other software · Web-school · reported by MITREMedium 5.4
A stored XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in the event name and description fields. An attack can inject a JavaScript code that will be stored in the page. If any visitor sees the events, then the payload will be executed.
- Product
- Enterprise Resource Planning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb-school.ingithub.com
Apr 6, 2021Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.CVE-2020-36306 · Other software · Redmine · reported by MITREMedium 6.1
Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgredmine.org
Apr 5, 2021The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page.CVE-2021-24211 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to execute JavaScript code in the user's browser.
- Product
- WordPress Related Posts
- Affected
- up to 3.6.4
- What to do
- Affects up to 3.6.4. Update WordPress Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 5, 2021Easy Contact Form Pro: Did not properly sanitise the text fields (suchCVE-2021-24168 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Contact Form Pro WordPress plugin before 1.1.1.9 did not properly sanitise the text fields (such as Email Subject, Email Recipient, etc) when creating or editing a form, leading to an authenticated (author+) stored cross-site scripting issue. This could allow medium privilege accounts (such as author and editor) to perform XSS attacks against high privilege ones like administrator.
- Product
- Easy Contact Form Pro
- Fixed in
- 1.1.1.9
- What to do
- Update Easy Contact Form Pro to 1.1.1.9 or newer.
Apr 2, 2021DMA Softlab Radius Manager 4.4.0 is affected by Cross Site Scripting (XSS) via the description, name, or address field (under admin.php).CVE-2021-29011 · Other software · Dmasoftlab · reported by MITREMedium 6.1
DMA Softlab Radius Manager 4.4.0 is affected by Cross Site Scripting (XSS) via the description, name, or address field (under admin.php).
- Product
- DMA Radius Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 1, 2021Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.CVE-2020-19619 · Other software · Mblog Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2021Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.CVE-2020-19618 · Other software · Mblog Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2021Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.CVE-2020-19617 · Other software · Mblog Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2021Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.CVE-2020-19616 · Other software · Mblog Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2021CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field.CVE-2021-28935 · Other software · Cmsmadesimple · reported by MITREMedium 5.4
CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev.cmsmadesimple.orgpacketstormsecurity.com
Mar 29, 2021Cross Site Scripting (XSS) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page to the "goform/formSCVE-2020-19643 · Other software · Insma · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page to the "goform/formSetFtpCfg" settings page.
- Product
- Wifi Mini SPY 1080p HD Security IP Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxn--sb-lka.orgxn--sb-lka.org
Mar 29, 2021Cross Site Request Forgery (CSRF) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B, via all fields to WebUI.CVE-2020-19639 · Other software · Insma · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B, via all fields to WebUI.
- Product
- Wifi Mini SPY 1080p HD Security IP Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxn--sb-lka.orgxn--sb-lka.org
Mar 29, 2021It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format.CVE-2018-1107 · Other software · Is-my-json-valid Project · reported by Red HatMedium 5.3
It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.
- Product
- Is-my-json-valid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comsnyk.io
Mar 15, 2021The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.CVE-2021-20279 · Other software · Moodle · reported by Red HatMedium 5.4
The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.fedoraproject.org
Mar 11, 2021Cross-site scripting (XSS) vulnerability in Navigation in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.CVE-2021-27679 · Other software · Batflat · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in Navigation in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
- Product
- Batflat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2021Cross-site scripting (XSS) vulnerability in Snippets in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.CVE-2021-27678 · Other software · Batflat · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in Snippets in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
- Product
- Batflat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2021Cross-site scripting (XSS) vulnerability in Galleries in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.CVE-2021-27677 · Other software · Batflat · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in Galleries in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
- Product
- Batflat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2021CSZ CMS 1.2.9 is affected by a cross-site scripting (XSS) vulnerability in multiple pages through the field name.CVE-2021-26776 · Other software · Cszcms · reported by MITREMedium 5.4
CSZ CMS 1.2.9 is affected by a cross-site scripting (XSS) vulnerability in multiple pages through the field name.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2021The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation.CVE-2021-28115 · Other software · Ougc Feedback Project · reported by MITREMedium 6.1
The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation.
- Product
- Ougc Feedback
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 8, 2021A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used.CVE-2021-22134 · Other software · Elastic · reported by security@elastic.coMedium 4.3
A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of documents and fields the attacker should not be able to view.
- Product
- Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.cosecurity.netapp.com
Mar 5, 2021Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced CVE-2021-20665 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2021Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s CVE-2021-20328 · Other software · MongoDB Inc. · reported by cna@mongodb.comMedium 6.4
Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.
- Product
- mongo-java-driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgjira.mongodb.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.