Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,934 results · page 46 of 59
Jan 23, 2020Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.CVE-2020-7940 · Other software · Plone · reported by MITREHigh 7.5
Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2020The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms.CVE-2020-7228 · WordPress plugins & themes · reported by MITREMedium 5.4
The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an authenticated user.
- Product
- Calculated Fields Form
- Affected
- up to 1.0.353
- What to do
- Affects up to 1.0.353. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordspider-security.co.ukwordpress.org
Jan 21, 2020WhatsApp Cross-Site Scripting VulnerabilityCVE-2019-18426 · Other software · Meta Platforms · reported by cve-assign@fb.comExploitedHigh 8.2
A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.
- Product
- On CISA’s list since
- May 23, 2022 (federal fix deadline Jun 13, 2022)
- What to do
- Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comfacebook.com
Jan 21, 2020The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS.CVE-2020-6849 · WordPress plugins & themes · reported by MITREHigh 8.8
The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS.
- Product
- marketo-forms-and-tracking
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update marketo-forms-and-tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Jan 21, 2020The device may enter into error state when some tool or application gets failure at 1st buffer map all and performs 2nd buffer map which happens to be at same pCVE-2019-14010 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
The device may enter into error state when some tool or application gets failure at 1st buffer map all and performs 2nd buffer map which happens to be at same physical address in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, Nicobar, Rennell, SA6155P, SDM660, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
- Product
- Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jan 17, 2020A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms.CVE-2019-17127 · Other software · Solarwinds · reported by MITREMedium 6.1
A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation.
- Product
- Orion Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.solarwinds.comsupport.solarwinds.com
Jan 17, 2020A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms.CVE-2019-17125 · Other software · Solarwinds · reported by MITREMedium 6.1
A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS.
- Product
- Orion Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.solarwinds.comsupport.solarwinds.com
Jan 14, 2020On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications to specific system components.CVE-2020-5851 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 4.6
On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications to specific system components. This issue only impacts specific engineering hotfixes and platforms. NOTE: This vulnerability does not affect any of the BIG-IP major, minor or maintenance releases you obtained from downloads.f5.com. The affected Engineering Hotfix builds are as follows: Hotfix-BIGIP-14.1.0.2.0.45.4-ENG Hotfix-BIGIP-14.1.0.2.0.62.4-ENG
- Product
- Big-ip Local Traffic Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Dec 27, 2019Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6CVE-2014-4536 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3) campaignId parameter.
- Fixed in
- 1.5.6
- What to do
- Update the plugin to 1.5.6 or newer.
Full record and what to do →NVD recordcodevigilant.comwordpress.org
Dec 15, 2019CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registrationCVE-2014-3536 · Other software · CFME (CloudForms Management Engine) · reported by Red HatMedium 5.5
CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration
- Product
- CFME (CloudForms Management Engine)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 27, 2019On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, and 13.1.0-13.1.3.1, when bad-actor detection is configured on a wildcard virtual server on platforms with hardware-CVE-2019-6672 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, and 13.1.0-13.1.3.1, when bad-actor detection is configured on a wildcard virtual server on platforms with hardware-based sPVA, the performance of the BIG-IP AFM system is degraded.
- Product
- BIG-IP AFM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Nov 25, 2019quagga (ospf6d) 0.99.21 has a DoS flaw in the way the ospf6d daemon performs routes removalCVE-2012-5521 · Other software · quagga · reported by Red HatMedium 6.5
quagga (ospf6d) 0.99.21 has a DoS flaw in the way the ospf6d daemon performs routes removal
- Product
- quagga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Nov 22, 2019cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting.CVE-2018-10854 · Other software · Red Hat · reported by Red HatMedium 5.4
cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field.
- Product
- cloudforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Nov 21, 2019Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resultCVE-2019-16545 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure.
- Product
- Jenkins QMetry for JIRA - Test Management Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Nov 12, 2019Systematic IRIS WebForms 5.4 and its functionalities can be accessed and used without any form of authentication.CVE-2019-18925 · Other software · Systematic · reported by MITRECritical 9.8
Systematic IRIS WebForms 5.4 and its functionalities can be accessed and used without any form of authentication.
- Product
- Iris Webforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2019Systematic IRIS WebForms 5.4 is vulnerable to directory traversal.CVE-2019-18924 · Other software · Systematic · reported by MITREMedium 5.3
Systematic IRIS WebForms 5.4 is vulnerable to directory traversal. By manipulating variables that reference files with ../ (and variations), it is possible to list all the directories and check if a particular file exists.
- Product
- Iris Webforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2019A wrong type is used for a return value from strlen in WebKit in Google Chrome before Blink M12 on 64-bit platforms.CVE-2011-2337 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.8
A wrong type is used for a return value from strlen in WebKit in Google Chrome before Blink M12 on 64-bit platforms.
- Product
- Chrome on 64-bit platforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrac.webkit.orgtrac.webkit.org
Nov 4, 2019CloudForms stores user passwords in recoverable formatCVE-2013-4423 · Other software · CloudForms · reported by Red HatMedium 5.5
CloudForms stores user passwords in recoverable format
- Product
- CloudForms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 24, 2019In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute forceCVE-2019-15929 · Other software · Craftcms · reported by MITRECritical 9.8
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 22, 2019Adobe Experience Manager Forms versions 6.3-6.5 have a reflected cross-site scripting vulnerability.CVE-2019-8089 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe Experience Manager Forms versions 6.3-6.5 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- Product
- Adobe Experience Manager Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Oct 21, 2019Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr databasCVE-2019-16404 · Other software · Open-emr · reported by MITREHigh 8.8
Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2019Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter.CVE-2019-17409 · Other software · Open-emr · reported by MITREMedium 6.1
Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2019Reflected XSS in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of a user's seCVE-2019-16862 · Other software · Open-emr · reported by MITREMedium 6.1
Reflected XSS in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of a user's session via the pid parameter.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2019An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD.CVE-2019-15901 · Other software · Doas Project · reported by MITREHigh 8.8
An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A setusercontext(3) call with flags to change the UID, primary GID, and secondary GIDs was replaced (on certain platforms: Linux and possibly NetBSD) with a single setuid(2) call. This resulted in neither changing the group id nor initializing secondary group ids.
- Product
- Doas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2019An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD.CVE-2019-15900 · Other software · Doas Project · reported by MITRECritical 9.8
An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The result was that, instead of reporting that the supplied username or group name did not exist, it would execute the command as root.
- Product
- Doas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2019Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Services).CVE-2019-2886 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Services). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Forms, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Forms accessible data as well as unauthorized read access to a subset of Oracle Forms accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2019NVIDIA Shield TV Experience prior to v8.0.1, NVIDIA Tegra bootloader contains a vulnerability where the software performs an incorrect bounds check, which may lCVE-2019-5699 · Other software · Nvidia · reported by psirt@nvidia.comHigh 7.8
NVIDIA Shield TV Experience prior to v8.0.1, NVIDIA Tegra bootloader contains a vulnerability where the software performs an incorrect bounds check, which may lead to buffer overflow resulting in escalation of privileges and code execution. escalation of privileges, and information disclosure, code execution, denial of service, or escalation of privileges.
- Product
- Shield Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Oct 9, 2019The Shack Forms Pro extension before 4.0.32 for Joomla! allows path traversal via a file attachment.CVE-2019-17399 · Websites & servers · Joomlashack · reported by MITRECritical 9.8
The Shack Forms Pro extension before 4.0.32 for Joomla! allows path traversal via a file attachment.
- Product
- Shack Forms Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjoomlashack.comjoomlashack.com
Oct 7, 2019The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter.CVE-2015-9452 · WordPress plugins & themes · reported by MITRECritical 9.8
The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter.
- Product
- nex-forms-express-wp-form-builder
- Fixed in
- 4.6.1
- What to do
- Update nex-forms-express-wp-form-builder to 4.6.1 or newer.
Oct 3, 2019rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easier for attackers to eCVE-2019-15162 · Other software · Tcpdump · reported by MITREMedium 5.3
rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easier for attackers to enumerate valid usernames.
- Product
- Libpcap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Oct 1, 2019Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.CVE-2019-10435 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.
- Product
- Jenkins SourceGear Vault Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Sep 27, 2019In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full paCVE-2019-16902 · WordPress plugins & themes · reported by MITREHigh 7.5
In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname.
- Product
- ARforms
- Affected
- 3.7.1 to 3.7.1
- What to do
- Affects 3.7.1 to 3.7.1. Update ARforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordalmorabea.netarformsplugin.com
Sep 25, 2019A vulnerability in the IOx application environment of multiple Cisco platforms could allow an unauthenticated, remote attacker to cause the IOx web server to stCVE-2019-12656 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the IOx application environment of multiple Cisco platforms could allow an unauthenticated, remote attacker to cause the IOx web server to stop processing HTTPS requests, resulting in a denial of service (DoS) condition. The vulnerability is due to a Transport Layer Security (TLS) implementation issue. An attacker could exploit this vulnerability by sending crafted TLS packets to the IOx web server on an affected device. A successful exploit could allow the attacker to cause the IOx web server to stop processing HTTPS requests, resulting in a DoS condition.
- Product
- Cisco Industrial Routers Operating System Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Sep 25, 2019On versions 13.0.0-13.1.0.1, 12.1.0-12.1.4.1, 11.6.1-11.6.4, and 11.5.1-11.5.9, BIG-IP platforms where AVR, ASM, APM, PEM, AFM, and/or AAM is provisioned may leCVE-2019-6655 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 5.3
On versions 13.0.0-13.1.0.1, 12.1.0-12.1.4.1, 11.6.1-11.6.4, and 11.5.1-11.5.9, BIG-IP platforms where AVR, ASM, APM, PEM, AFM, and/or AAM is provisioned may leak sensitive data.
- Product
- Big-ip Application Acceleration Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Sep 12, 2019Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the manCVE-2019-16261 · Other software · Tripplite · reported by MITRECritical 9.1
Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the manager or admin password, or shutting off power to an outlet. NOTE: the vendor's position is that a newer firmware version, fixing this vulnerability, had already been released before this vulnerability report about 12.04.0053.
- Product
- Pdumh15at Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.korelogic.comgist.github.com
Sep 12, 2019Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentiallyCVE-2019-10397 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comLow 3.1
Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure.
- Product
- Jenkins Aqua Security Serverless Scanner Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Sep 4, 2019The TikTok (formerly Musical.ly) application 12.2.0 for Android and iOS performs unencrypted transmission of images, videos, and likes.CVE-2019-14319 · Other software · Tiktok · reported by MITREMedium 6.5
The TikTok (formerly Musical.ly) application 12.2.0 for Android and iOS performs unencrypted transmission of images, videos, and likes. This allows an attacker to extract private sensitive information by sniffing network traffic.
- Product
- Tiktok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordp16.muscdn.comp16.muscdn.com
Aug 28, 2019Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentiallCVE-2019-10391 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure.
- Product
- Jenkins IBM Application Security on Cloud Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Aug 27, 2019The buddyforms plugin before 2.2.8 for WordPress has SQL injection.CVE-2018-21003 · WordPress plugins & themes · reported by MITRECritical 9.8
The buddyforms plugin before 2.2.8 for WordPress has SQL injection.
- Product
- buddyforms
- Fixed in
- 2.2.8
- What to do
- Update buddyforms to 2.2.8 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 22, 2019The cforms2 plugin before 10.5 for WordPress has XSS.CVE-2014-10393 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 10.5 for WordPress has XSS.
- Product
- cforms2
- Fixed in
- 10.5
- What to do
- Update cforms2 to 10.5 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The cforms2 plugin before 10.2 for WordPress has XSS.CVE-2014-10392 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 10.2 for WordPress has XSS.
- Product
- cforms2
- Fixed in
- 10.2
- What to do
- Update cforms2 to 10.2 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 22, 2019The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.CVE-2018-20981 · WordPress plugins & themes · reported by MITRECritical 9.1
The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.
- Product
- ninja-forms
- Fixed in
- 3.3.9
- What to do
- Update ninja-forms to 3.3.9 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.CVE-2018-20980 · WordPress plugins & themes · reported by MITREHigh 7.5
The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.
- Product
- ninja-forms
- Fixed in
- 3.2.15
- What to do
- Update ninja-forms to 3.2.15 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.CVE-2017-18574 · WordPress plugins & themes · reported by MITREMedium 6.1
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
- Product
- ninja-forms
- Fixed in
- 3.0.31
- What to do
- Update ninja-forms to 3.0.31 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.CVE-2017-18570 · WordPress plugins & themes · reported by MITRECritical 9.8
The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.
- Product
- cforms2
- Fixed in
- 14.13
- What to do
- Update cforms2 to 14.13 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The cforms2 plugin before 14.6.10 for WordPress has SQL injection.CVE-2015-9333 · WordPress plugins & themes · reported by MITRECritical 9.8
The cforms2 plugin before 14.6.10 for WordPress has SQL injection.
- Product
- cforms2
- Fixed in
- 14.6.10
- What to do
- Update cforms2 to 14.6.10 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 21, 2019Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logCVE-2019-5638 · Other software · Rapid7 · reported by cve@rapid7.comHigh 8.7
Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage.
- Product
- Nexpose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rapid7.comhelp.rapid7.com
Aug 21, 2019The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.CVE-2017-18559 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.
- Product
- cforms2
- Fixed in
- 14.13.3
- What to do
- Update cforms2 to 14.13.3 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 21, 2019The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.CVE-2014-10377 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.
- Product
- cforms2
- Fixed in
- 13.2
- What to do
- Update cforms2 to 13.2 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 21, 2019The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.CVE-2014-10380 · WordPress plugins & themes · reported by MITREMedium 6.1
The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.
- Product
- profile-builder
- Fixed in
- 1.1.66
- What to do
- Update profile-builder to 1.1.66 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.