Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,633 results · page 44 of 73
Feb 25, 2021Stored cross-site scripting (XSS) in form field in robust.systems product Custom Global Variables v 1.0.5 allows a remote attacker to inject arbitrary code via CVE-2021-3124 · Other software · Newtarget · reported by MITREMedium 5.4
Stored cross-site scripting (XSS) in form field in robust.systems product Custom Global Variables v 1.0.5 allows a remote attacker to inject arbitrary code via the vars[0][name] field.
- Product
- Custom Global Variables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddb.threatpress.comexploit-db.com
Feb 24, 2021A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords.CVE-2021-3355 · Other software · Lightcms Project · reported by MITREMedium 5.4
A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords.
- Product
- Lightcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgist.github.com
Feb 22, 2021The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field.CVE-2021-27559 · Other software · Monicahq · reported by MITREMedium 5.4
The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2021The Contact page in Monica 2.19.1 allows stored XSS via the Description field.CVE-2021-27371 · Other software · Monicahq · reported by MITREMedium 5.4
The Contact page in Monica 2.19.1 allows stored XSS via the Description field.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2021The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field.CVE-2021-27370 · Other software · Monicahq · reported by MITREMedium 5.4
The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 22, 2021The Contact page in Monica 2.19.1 allows stored XSS via the Middle Name field.CVE-2021-27369 · Other software · Monicahq · reported by MITREMedium 5.4
The Contact page in Monica 2.19.1 allows stored XSS via the Middle Name field.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2021The Contact page in Monica 2.19.1 allows stored XSS via the First Name field.CVE-2021-27368 · Other software · Monicahq · reported by MITREMedium 5.4
The Contact page in Monica 2.19.1 allows stored XSS via the First Name field.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2021The admin panel in BlackCat CMS 1.3.6 allows stored XSS (by an admin) via the Display Name field to backend/preferences/ajax_save.php.CVE-2021-27237 · Other software · Blackcat-cms · reported by MITREMedium 4.8
The admin panel in BlackCat CMS 1.3.6 allows stored XSS (by an admin) via the Display Name field to backend/preferences/ajax_save.php.
- Product
- Blackcat CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2021Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Users tab.CVE-2020-35734 · Other software · Batflat · reported by MITREHigh 7.2
Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user's data (username, displayed name, etc.). NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- Batflat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.combatflat.org
Feb 14, 2021Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulCVE-2020-36237 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.3
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulnerability in the /rest/api/2/customFieldOption/ endpoint. The affected versions are before version 8.15.0.
- Product
- Jira Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comjira.atlassian.com
Feb 14, 2021Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information DCVE-2020-36235 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.3
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information Disclosure vulnerability in the mobile site view. The affected versions are before version 8.13.2, and from version 8.14.0 before 8.14.1.
- Product
- Jira Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comjira.atlassian.com
Feb 9, 2021Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code execution via the plugin name input field in the CVE-2020-22841 · Other software · B2evolution · reported by MITREMedium 4.8
Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code execution via the plugin name input field in the plugin module.
- Product
- B2evolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 9, 2021The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields.CVE-2021-23327 · Other software · Fusioncharts · reported by report@snyk.ioMedium 6.3
The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields.
- Product
- Apexcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2021A vulnerability in web UI input field of GateManager allows authenticated attacker to enter script tags that could cause XSS.CVE-2020-29021 · Other software · Secomea · reported by VulnerabilityReporting@secomea.comLow 3.5
A vulnerability in web UI input field of GateManager allows authenticated attacker to enter script tags that could cause XSS. This issue affects: GateManager all versions prior to 9.3.
- Product
- GateManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecomea.comsecomea.com
Feb 8, 2021Article Bcc fields and agent personal information are shown when customer prints the ticket (PDF) via external interface.CVE-2021-21435 · Other software · OTRS AG · reported by security@otrs.comMedium 5.7
Article Bcc fields and agent personal information are shown when customer prints the ticket (PDF) via external interface. This issue affects: OTRS AG OTRS 7.0.x version 7.0.23 and prior versions; 8.0.x version 8.0.10 and prior versions.
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2021Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes codeCVE-2020-18724 · Other software · Altn · reported by MITREMedium 5.4
Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list.
- Product
- Mdaemon Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkailashbohara.com.nppacketstormsecurity.com
Feb 3, 2021Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarCVE-2020-18723 · Other software · Altn · reported by MITREMedium 5.4
Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities.
- Product
- Mdaemon Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkailashbohara.com.nppacketstormsecurity.com
Feb 3, 2021Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUsCVE-2019-16268 · Email & office · Zohocorp · reported by MITREMedium 4.8
Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen.
- Product
- Manageengine Remote Access Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordesecforte.commanageengine.com
Feb 1, 2021Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2.CVE-2020-28194 · Other software · Accel-ppp · reported by MITRECritical 9.8
Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution.
- Product
- Accel-ppp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2021Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to be stored in the reCVE-2021-25647 · Other software · Testes-codigo · reported by MITREMedium 5.4
Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to be stored in the remote database and leading to its execution on client devices when loading the "feedback list", either by accessing the website directly or using the mobile application.
- Product
- Testes DE Codigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2021Stored XSS vulnerability in BDTASK Multi-Store Inventory Management System 1.0 allows a local admin to inject arbitrary code via the Customer Name Field.CVE-2020-36012 · Other software · Bdtask · reported by MITREMedium 4.8
Stored XSS vulnerability in BDTASK Multi-Store Inventory Management System 1.0 allows a local admin to inject arbitrary code via the Customer Name Field.
- Product
- Multi-store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkislay00.medium.comkislay00.medium.com
Jan 21, 2021Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to thCVE-2020-8554 · Other software · Kubernetes · reported by jordan@liggitt.netMedium 6.3
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.
- Product
- Kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Jan 21, 2021Out of bound reads might occur in while processing Service descriptor due to improper validation of length of fields in Snapdragon Auto, Snapdragon Compute, SnaCVE-2020-11213 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Out of bound reads might occur in while processing Service descriptor due to improper validation of length of fields in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jan 21, 2021Out of bounds reads while parsing NAN beacons attributes and OUIs due to improper length of field check in Snapdragon Auto, Snapdragon Compute, Snapdragon ConneCVE-2020-11212 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Out of bounds reads while parsing NAN beacons attributes and OUIs due to improper length of field check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jan 12, 2021JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user accCVE-2020-36191 · Other software · Jupyter · reported by MITREMedium 4.5
JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).
- Product
- Jupyterhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2021Opera Mini for Android below 53.1 displays URL left-aligned in the address field.CVE-2021-23253 · Computers, phones & browsers · Opera · reported by security@opera.comMedium 5.3
Opera Mini for Android below 53.1 displays URL left-aligned in the address field. This allows a malicious attacker to craft a URL with a long domain name, e.g. www.safe.opera.com.attacker.com. With the URL being left-aligned, the user will only see the front part (e.g. www.safe.opera.com…) The exact amount depends on the phone screen size but the attacker can craft a number of different domains and target different phones. Starting with version 53.1 Opera Mini displays long URLs with the top-level domain label aligned to the right of the address field which mitigates the issue.
- Product
- Opera Mini
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.opera.comsecurity.opera.com
Jan 10, 2021Stored XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to store malicious code in multiple fields (first name, last name, and logon name) when cCVE-2020-35720 · Other software · Quest · reported by MITREMedium 5.4
Stored XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to store malicious code in multiple fields (first name, last name, and logon name) when creating or modifying a user via the submitUser.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- Policy Authority For Unified Communications
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclandestinelabs.ioun4gi.io
Jan 8, 2021The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI.CVE-2021-3111 · Other software · Concretecms · reported by MITREMedium 4.8
The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jan 6, 2021Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fieldCVE-2020-8287 · Other software · NodeJS · reported by support@hackerone.comMedium 6.5
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.
- Product
- Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comhackerone.com
Jan 6, 2021The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.CVE-2020-36175 · WordPress plugins & themes · reported by MITREMedium 5.3
The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.
- Product
- Ninja Forms
- Fixed in
- 3.4.27.1
- What to do
- Update Ninja Forms to 3.4.27.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jan 6, 2021The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.CVE-2020-36173 · WordPress plugins & themes · reported by MITREMedium 5.3
The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.
- Product
- Ninja Forms
- Fixed in
- 3.4.28
- What to do
- Update Ninja Forms to 3.4.28 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jan 6, 2021The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.CVE-2020-36172 · WordPress plugins & themes · reported by MITREMedium 6.1
The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.
- Product
- Advanced Custom Fields
- Fixed in
- 5.8.12
- What to do
- Update Advanced Custom Fields to 5.8.12 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jan 6, 2021The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms.CVE-2020-36170 · WordPress plugins & themes · reported by MITREMedium 5.3
The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms.
- Product
- Ultimate Member
- Fixed in
- 2.1.13
- What to do
- Update Ultimate Member to 2.1.13 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jan 4, 2021SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field.CVE-2019-16960 · Other software · Solarwinds · reported by MITREMedium 5.4
SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field.
- Product
- Web Help Desk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.solarwinds.comesecforte.com
Dec 31, 2020The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033.CVE-2016-20004 · Other software · Rest/json Project · reported by MITRECritical 9.8
The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.
- Product
- Rest/json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dcim/sites/add/ commenCVE-2019-25011 · Other software · Netbox · reported by MITREMedium 5.4
NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dcim/sites/add/ comments.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2020Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field.CVE-2020-29477 · Other software · Invisioncommunity · reported by MITREMedium 4.8
Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allow an attacker to inject the XSS payload in Field Name and each time any user will open that, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.
- Product
- Community
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Dec 29, 2020OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail.CVE-2020-29470 · Other software · Opencart · reported by MITREMedium 4.8
OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject the XSS payload in the Subject field of the mail and each time any user will open that mail of the website, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.
- Product
- Opencart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Dec 29, 2020nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field.CVE-2020-29475 · Other software · Nopcommerce · reported by MITREMedium 4.8
nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. This vulnerability can allow an attacker to inject the XSS payload in Schedule tasks and each time any user will go to that page of the website, the XSS triggers and attacker can able to steal the cookie according to the crafted payload.
- Product
- Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Dec 27, 2020CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php.CVE-2020-29250 · Other software · Cxuu · reported by MITREMedium 6.1
CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php.
- Product
- Cxuucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2020Savsoft Quiz 5 is affected by: Cross Site Scripting (XSS) via field_title (aka a title on the custom fields page).CVE-2020-35349 · Other software · Techkshetrainfo · reported by MITREMedium 4.8
Savsoft Quiz 5 is affected by: Cross Site Scripting (XSS) via field_title (aka a title on the custom fields page).
- Product
- Savsoft Quiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Dec 25, 2020A Cross Site Scripting (XSS) vulnerability in Savsoft Quiz v5.0 allows remote attackers to inject arbitrary web script or HTML via the Skype ID field.CVE-2020-27515 · Other software · Techkshetrainfo · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) vulnerability in Savsoft Quiz v5.0 allows remote attackers to inject arbitrary web script or HTML via the Skype ID field.
- Product
- Savsoft Quiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsavsoftquiz.com
Dec 23, 2020BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to createCVE-2020-35677 · Other software · Bigprof · reported by MITREMedium 4.8
BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to create a new group, resulting in Stored XSS. The caveat here is that an attacker would need administrative privileges in order to create the payload. One might think this completely mitigates the privilege-escalation impact as there is only one high-privileged role. However, it was discovered that the endpoint responsible for creating the group lacks CSRF protection.
- Product
- Online Invoicing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.ingredous.comlabs.ingredous.com
Dec 18, 2020SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account.CVE-2019-16957 · Other software · Solarwinds · reported by MITREMedium 5.4
SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account.
- Product
- Webhelpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.solarwinds.comesecforte.com
Dec 15, 2020The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on the client side when receiving input fromCVE-2020-25195 · Other software · Hosteng · reported by ics-cert@hq.dhs.govHigh 7.5
The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on the client side when receiving input from the configuration web server, which may allow an attacker to bypass the check and send input to crash the device.
- Product
- H0-ecom100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Dec 14, 2020In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry.CVE-2020-0444 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-150693166References: Upstream kernel
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 14, 2020GateOne allows remote attackers to execute arbitrary commands via shell metacharacters in the port field when attempting an SSH connection.CVE-2020-20184 · Other software · Liftoffsoftware · reported by MITRECritical 9.8
GateOne allows remote attackers to execute arbitrary commands via shell metacharacters in the port field when attempting an SSH connection.
- Product
- Gateone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2020SQL Injection in Classbooking before 2.4.1 via the username field of a CSV file when adding a new user.CVE-2020-35382 · Other software · Classroombookings · reported by MITREHigh 7.2
SQL Injection in Classbooking before 2.4.1 via the username field of a CSV file when adding a new user.
- Product
- Classroombookings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password.CVE-2020-26965 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their password and used that feature, the type of the password field was changed, resulting in a keyboard layout change and the possibility for the software keyboard to remember the typed password. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 8, 2020The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk.CVE-2020-25627 · Other software · Moodle · reported by Red HatMedium 6.1
The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.