Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

3,318 results · page 43 of 67

Jan 18, 2022Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.CVE-2022-0263 · Other software · pimcore · reported by security@huntr.devHigh 7.8
Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.
Product
pimcore/pimcore
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Jan 18, 2022Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7.CVE-2022-0262 · Other software · pimcore · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7.
Product
pimcore/pimcore
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Jan 14, 2022The broadcast that DevicePickerFragment sends when a new device is paired doesn't have any permission checks, so any app can register to listen for it.CVE-2021-1037 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.3
The broadcast that DevicePickerFragment sends when a new device is paired doesn't have any permission checks, so any app can register to listen for it. This lets apps keep track of what devices are paired without requesting BLUETOOTH permissions.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-162951906
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Jan 10, 2022RegistrationMagic: Does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statementCVE-2021-24862 · WordPress plugins & themes · reported by WPScanHigh 7.2
The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue
Product
RegistrationMagic
Fixed in
5.0.1.6
What to do
Update RegistrationMagic to 5.0.1.6 or newer.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jan 3, 2022Possible denial of service due to improper handling of debug register trap from user applications in Snapdragon Consumer IOT, Snapdragon Industrial IOT, SnapdraCVE-2021-30283 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.1
Possible denial of service due to improper handling of debug register trap from user applications in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
Product
Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Dec 20, 2021Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI.CVE-2021-44554 · Other software · Cybelesoft · reported by MITREMedium 5.3
Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI. By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to the configuration of VirtualUI. Common users are administrator, admin, guest and krgtbt.
Product
Thinfinity Virtualui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 17, 2021Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attCVE-2021-37862 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.7
Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com mattermost.com
Dec 15, 2021In registerSuggestionConnectionStatusListener of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissioCVE-2021-0995 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In registerSuggestionConnectionStatusListener of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-197536547
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Dec 14, 2021The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid useCVE-2021-4073 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid username on the site due to missing identity validation in the social login function social_login_using_email() of the plugin. This affects versions equal to, and less than, 5.0.1.7.
Affected
up to 5.0.1.7
What to do
Affects up to 5.0.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /public_html/users.php.CVE-2021-44937 · Other software · Glfusion · reported by MITREMedium 5.3
glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /public_html/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied.
Product
Glfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attributeCVE-2021-24955 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
User Registration, Login Form, User Profile & Membership
Fixed in
3.2.3
What to do
Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard pageCVE-2021-24954 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard page, leading to a Reflected Cross-Site Scripting issue
Product
User Registration, Login Form, User Profile & Membership
Fixed in
3.2.3
What to do
Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 13, 2021User Meta Shortcodes: Registers a shortcode that allows any user with a roleCVE-2021-24859 · WordPress plugins & themes · reported by WPScanMedium 4.3
The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashes
Product
User Meta Shortcodes
Affected
up to 0.5
What to do
Affects up to 0.5. Update User Meta Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 9, 2021An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when registering ordinary users.CVE-2021-40281 · Other software · Zzcms · reported by MITREHigh 8.8
An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when registering ordinary users.
Product
Zzcms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Dec 6, 2021Registrations for the Events Calendar: Does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statementCVE-2021-24943 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.
Product
Registrations for the Events Calendar
Fixed in
2.7.6
What to do
Update Registrations for the Events Calendar to 2.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Registrations for the Events Calendar: Does not escape the v parameter before outputting it back in an attributeCVE-2021-24876 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
Registrations for the Events Calendar
Fixed in
2.7.5
What to do
Update Registrations for the Events Calendar to 2.7.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 23, 2021Tutor LMS: Does not sanitise and escape user input before outputting back in attributes in the Student Registration pageCVE-2021-24873 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue
Product
Tutor LMS
Fixed in
1.9.11
What to do
Update Tutor LMS to 1.9.11 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 20, 2021NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to access debug registers CVE-2021-1105 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 4.1
NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to access debug registers during runtime, which may lead to information disclosure.
Product
NVIDIA GPU and Tegra hardware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvidia.custhelp.com nvidia.custhelp.com
Nov 19, 2021Easy Registration Forms: Cross-Site Request ForgeryCVE-2021-39353 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajax_add_form function found in the ~/includes/class-form.php file which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 2.1.1.
Product
Easy Registration Forms
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Easy Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 16, 2021A potential vulnerability exists in AMD Platform Security Processor (PSP) that may allow an attacker to zero any privileged register on the System Management NeCVE-2020-12961 · Other software · AMD · reported by psirt@amd.comHigh 7.8
A potential vulnerability exists in AMD Platform Security Processor (PSP) that may allow an attacker to zero any privileged register on the System Management Network which may lead to bypassing SPI ROM protections.
Product
2nd Gen AMD EPYC™
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record amd.com amd.com
Nov 9, 2021In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible.CVE-2021-43196 · Other software · Jetbrains · reported by MITREHigh 7.5
In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible.
Product
Teamcity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.jetbrains.com blog.jetbrains.com
Nov 8, 2021Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes: Does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpCVE-2021-24731 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.
Product
Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
Fixed in
3.7.1.6
What to do
Update Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes to 3.7.1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes: Has a flaw in the social login implementationCVE-2021-24647 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username
Product
Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
Fixed in
3.1.7.6
What to do
Update Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes to 3.1.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 5, 2021Multiple Cross Site Scripting (XSS) vulnerabilities exists in Remote Clinic v2.0 in (1) patients/register-patient.php via the (a) Contact, (b) Email, (c) WeightCVE-2021-39416 · Other software · Remoteclinic · reported by MITREMedium 6.1
Multiple Cross Site Scripting (XSS) vulnerabilities exists in Remote Clinic v2.0 in (1) patients/register-patient.php via the (a) Contact, (b) Email, (c) Weight, (d) Profession, (e) ref_contact, (f) address, (g) gender, (h) age, and (i) serial parameters; in (2) patients/edit-patient.php via the (a) Contact, (b) Email, (c) Weight, Profession, (d) ref_contact, (e) address, (f) serial, (g) age, and (h) gender parameters; in (3) staff/edit-my-profile.php via the (a) Title, (b) First Name, (c) Last Name, (d) Skype, and (e) Address parameters; and in (4) clinics/settings.php via the (a) portal_name, (b) guardian_short_name, (c) guardian_name, (d) opening_time, (e) closing_time, (f) access_level_5, (g) access_level_4, (h) access_level_ 3, (i) access_level_2, (j) access_level_1, (k) currency, (l) mobile_number, (m) address, (n) patient_contact, (o) patient_address, and (p) patient_email parameters.
Product
Remote Clinic
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com remoteclinic.io
Nov 4, 2021A vulnerability in the web-based management interface of Cisco Prime Access Registrar could allow an authenticated, remote attacker to perform a stored cross-siCVE-2021-34731 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.8
A vulnerability in the web-based management interface of Cisco Prime Access Registrar could allow an authenticated, remote attacker to perform a stored cross-site scripting attack on an affected system. This vulnerability exists because the web-based management interface does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker would need valid administrative credentials. Cisco expects to release software updates that address this vulnerability.
Product
Cisco Prime Access Registrar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Oct 29, 2021Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command.CVE-2021-22037 · Other software · VMware · reported by security@vmware.comHigh 7.8
Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforced, which results in a search in the search path until a binary can be identified. This makes the installer/uninstaller vulnerable to Path Interception by Search Order Hijacking, potentially allowing an attacker to plant a malicious reg.exe command so it takes precedence over the system command. The vulnerability only affects Windows installers.
Product
Installbuilder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.installbuilder.com blog.installbuilder.com
Oct 28, 2021There is a Register tampering vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow the register value to be modified.CVE-2021-37001 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a Register tampering vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow the register value to be modified.
Product
EMUI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Oct 22, 2021Some API functions allow interaction with the registry, which includes reading values as well as data modification.CVE-2021-38453 · Other software · AUVESY · reported by ics-cert@hq.dhs.govCritical 9.1
Some API functions allow interaction with the registry, which includes reading values as well as data modification.
Product
Versiondog
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Oct 19, 2021InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements tCVE-2021-38486 · Other software · InHand Networks · reported by ics-cert@hq.dhs.govHigh 8
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements to create an account, which may allow an attacker to have full control over the product and execute code within the internal network to which the product is connected.
Product
IR615 Router
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Oct 12, 2021The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enableCVE-2021-38178 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the established quality gates. By this vulnerability malicious code can reach quality and production, and can compromise the confidentiality, integrity, and availability of the system and its data.
Product
SAP NetWeaver AS ABAP and ABAP Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Oct 4, 2021User Registration: Does not properly sanitise the user_registration_profile_pic_url valueCVE-2021-24654 · WordPress plugins & themes · reported by WPScanMedium 5.4
The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url value when submitted directly via the user_registration_update_profile_details AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attacks when their profile is viewed
Product
User Registration
Fixed in
2.0.2
What to do
Update User Registration to 2.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 30, 2021A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pCVE-2021-33626 · Other software · Siemens · reported by MITREHigh 7.8
A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer(QWORD values for CommBuffer). This can be used by an attacker to corrupt data in SMRAM memory and even lead to arbitrary code execution.
Product
RUGGEDCOM APE1808 - BIOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com security.netapp.com
Sep 30, 2021FlameCMS 3.3.5 contains a time-based blind SQL injection vulnerability in /account/register.php.CVE-2020-20797 · Other software · Flamecms Project · reported by MITRECritical 9.8
FlameCMS 3.3.5 contains a time-based blind SQL injection vulnerability in /account/register.php.
Product
Flamecms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 24, 2021Shopkit v2.7 contains a reflective cross-site scripting (XSS) vulnerability in the /account/register component, which allows attackers to hijack user credentialCVE-2020-20508 · Other software · Shopkit Project · reported by MITREMedium 6.1
Shopkit v2.7 contains a reflective cross-site scripting (XSS) vulnerability in the /account/register component, which allows attackers to hijack user credentials via a crafted payload in the E-Mail text field.
Product
Shopkit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 15, 2021WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus CVE-2021-37909 · Other software · CHANGING Inc. · reported by twcert@cert.org.twCritical 9.8
WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code.
Product
TSSServiSignAdapter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Sep 8, 2021scheme/webauthn.c in Glewlwyd SSO server through 2.5.3 has a buffer overflow during FIDO2 signature validation in webauthn registration.CVE-2021-40818 · Other software · Glewlwyd SSO Server Project · reported by MITRECritical 9.8
scheme/webauthn.c in Glewlwyd SSO server through 2.5.3 has a buffer overflow during FIDO2 signature validation in webauthn registration.
Product
Glewlwyd SSO Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org github.com
Sep 7, 2021HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.CVE-2021-38698 · Other software · Hashicorp · reported by MITREMedium 6.5
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.
Product
Consul
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.hashicorp.com security.gentoo.org
Sep 7, 2021api/account/register in the TH Wildau COVID-19 Contact Tracing application through 2021-09-01 has Incorrect Access Control.CVE-2021-33831 · Other software · Th-wildau · reported by MITREMedium 6.5
api/account/register in the TH Wildau COVID-19 Contact Tracing application through 2021-09-01 has Incorrect Access Control. An attacker can interfere with tracing of infection chains by creating 500 random users within 2500 seconds.
Product
Covid-19 Contact Tracing
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com th-wildau.de
Sep 2, 2021The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `incluCVE-2021-38314 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.
Product
Gutenberg Template Library & Redux Framework
Affected
up to 4.2.11
What to do
Affects up to 4.2.11. Update Gutenberg Template Library & Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Sep 2, 2021The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered underCVE-2021-38312 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the “redux/v1/templates/” REST Route in “redux-templates/classes/class-api.php”. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts.
Product
Gutenberg Template Library & Redux Framework
Affected
up to 4.2.11
What to do
Affects up to 4.2.11. Update Gutenberg Template Library & Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 17, 2021An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that would lead to a potCVE-2021-29981 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that would lead to a potentially exploitable crash. This vulnerability affects Firefox < 91 and Thunderbird < 91.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org security.gentoo.org
Aug 16, 2021User Registration & User Profile – Profile Builder: Has a bug allowing any user to reset the password of the admin of the blogCVE-2021-24527 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.
Product
User Registration & User Profile – Profile Builder
Fixed in
3.4.9
What to do
Update User Registration & User Profile – Profile Builder to 3.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 13, 2021The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows Information Disclosure of application registration data.CVE-2021-36791 · Other software · Dated News Project · reported by MITREMedium 5.3
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows Information Disclosure of application registration data.
Product
Dated News
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org typo3.org
Aug 13, 2021The RISC-V Instruction Set Manual contains a documented ambiguity for the Machine Trap Vector Base Address (MTVEC) register that may lead to a vulnerability dueCVE-2021-1104 · Other software · RISCV.org · reported by psirt@nvidia.comCritical 9.8
The RISC-V Instruction Set Manual contains a documented ambiguity for the Machine Trap Vector Base Address (MTVEC) register that may lead to a vulnerability due to the initial state of the register not being defined, potentially leading to information disclosure, data tampering and denial of service.
Product
Machine Trap Base Address (MTVEC) Register
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record riscv.org riscv.org
Aug 12, 2021PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache).CVE-2021-37704 · Websites & servers · PHPSocialNetwork · reported by GitHubMedium 5.4
PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc). Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5. Older versions such as v5, v4 are not longer supported and will **NOT** be patched. As a workaround, protect the `/vendor` directory from public access.
Product
phpfastcache
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 12, 2021Windows Digital TV Tuner device registration application Elevation of Privilege VulnerabilityCVE-2021-36927 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Digital TV Tuner device registration application Elevation of Privilege Vulnerability
Product
Windows 7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com portal.msrc.microsoft.com
Aug 11, 2021In SapphireIMS 4097_1, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login fCVE-2017-16629 · Network & remote access · Sapphireims · reported by MITREHigh 7.5
In SapphireIMS 4097_1, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login form. For "Incorrect User" - it gives an error "The application failed to identify the user. Please contact administrator for help." For "Correct User and Incorrect Password" - it gives an error "Authentication failed. Please login again."
Product
Sapphireims
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuln.shellcoder.party vuln.shellcoder.party
Aug 9, 2021The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/registCVE-2021-24522 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could be used in an XSS attack which could lead to wp-admin access. Further, the plugin in several places assigned $_POST as $_GET which meant that in some cases this could be replicated with just $_GET parameters and no need for $_POST values.
Product
User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar)
Fixed in
3.1.11
What to do
Update User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) to 3.1.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 8, 2021arch/powerpc/perf/core-book3s.c in the Linux kernel before 5.12.13, on systems with perf_event_paranoid=-1 and no specific PMU driver support registered, allowsCVE-2021-38200 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
arch/powerpc/perf/core-book3s.c in the Linux kernel before 5.12.13, on systems with perf_event_paranoid=-1 and no specific PMU driver support registered, allows local users to cause a denial of service (perf_instruction_pointer NULL pointer dereference and OOPS) via a "perf record" command.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cdn.kernel.org github.com
Aug 2, 2021User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar): Did not sanitise or escape some of its settings before saving them and outputting them back in the pageCVE-2021-24450 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Product
User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar)
Fixed in
3.1.8
What to do
Update User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) to 3.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.