Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,633 results · page 47 of 73
Apr 15, 2020Matrix42 Workspace Management 9.1.2.2765 and below allows stored XSS via unfiltered description parameters, as demonstrated by the comment field of a special orCVE-2019-19500 · Other software · Matrix42 · reported by MITREMedium 5.4
Matrix42 Workspace Management 9.1.2.2765 and below allows stored XSS via unfiltered description parameters, as demonstrated by the comment field of a special order for individual software.
- Product
- Workspace Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Apr 12, 2020Open Upload through 0.4.3 allows XSS via index.php?action=u and the filename field.CVE-2020-11712 · Other software · Open Upload Project · reported by MITREMedium 6.1
Open Upload through 0.4.3 allows XSS via index.php?action=u and the filename field.
- Product
- Open Upload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Apr 2, 2020codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields.CVE-2019-20635 · Other software · Intland · reported by MITREMedium 6.1
codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields.
- Product
- Codebeamer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodebeamer.comcodebeamer.com
Apr 1, 2020Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field.CVE-2020-5391 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field.
- Product
- Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0
- Fixed in
- 4.0.0
- What to do
- Update Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 to 4.0.0 or newer.
Mar 31, 2020phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error pagCVE-2020-11441 · Websites & servers · Phpmyadmin · reported by MITREMedium 6.1
phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable.
- Product
- Phpmyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2020In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at leaCVE-2020-5289 · Other software · yahoo · reported by GitHubMedium 6.8
In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. Resolved in Elide 4.5.14 and greater.
- Product
- elide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2020In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue.CVE-2020-1769 · Other software · OTRS AG · reported by security@otrs.comLow 3.5
In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
- Product
- ((OTRS)) Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Mar 24, 2020In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stCVE-2020-10942 · Computers, phones & browsers · Linux · reported by MITREMedium 5.3
In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgopenwall.com
Mar 22, 2020Artica Proxy 4.26 allows remote command execution for an authenticated user via shell metacharacters in the "Modify the hostname" field.CVE-2020-10818 · Other software · Articatech · reported by MITREHigh 7.2
Artica Proxy 4.26 allows remote command execution for an authenticated user via shell metacharacters in the "Modify the hostname" field.
- Product
- Artica Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Mar 19, 2020In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed.CVE-2019-15124 · Other software · Mediawiki · reported by MITREMedium 6.1
In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This affects REL1_31, REL1_32, and REL1_33.
- Product
- Mobilefrontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphabricator.wikimedia.orgphabricator.wikimedia.org
Mar 16, 2020Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page.CVE-2020-6586 · Other software · Nagios · reported by MITREMedium 5.4
Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered.
- Product
- Nagios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.nagios.commedium.com
Mar 12, 2020CSRF in admin/add-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to create a custom field via a crafted request.CVE-2020-10484 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/add-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to create a custom field via a crafted request.
- Product
- Phpkb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordantoniocannito.itantoniocannito.it
Mar 12, 2020Reflected XSS in admin/manage-fields.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameterCVE-2020-10470 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/manage-fields.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
- Product
- Phpkb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordantoniocannito.itantoniocannito.it
Mar 12, 2020Reflected XSS in admin/edit-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.CVE-2020-10462 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/edit-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
- Product
- Phpkb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordantoniocannito.itantoniocannito.it
Mar 10, 2020Ramp AltitudeCDN Altimeter before 2.4.0 allows authenticated Stored XSS via the vdms/ipmapping.jsp location field to the dms/rest/services/datastore/createOrEdiCVE-2020-10372 · Other software · Ramp · reported by MITREMedium 5.4
Ramp AltitudeCDN Altimeter before 2.4.0 allows authenticated Stored XSS via the vdms/ipmapping.jsp location field to the dms/rest/services/datastore/createOrEditValueForKey URI.
- Product
- Altimeter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.f-secure.comlabs.f-secure.com
Mar 9, 2020JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.CVE-2015-7342 · Other software · Joobi · reported by MITREHigh 7.2
JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.
- Product
- Jnews
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.integrity.ptlabs.integrity.pt
Mar 9, 2020Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflectCVE-2020-2152 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.
- Product
- Jenkins Subversion Release Manager Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 9, 2020Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scrCVE-2020-2140 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.
- Product
- Jenkins Audit Trail Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 9, 2020Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored croCVE-2020-2136 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability.
- Product
- Jenkins Git Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 5, 2020The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive.CVE-2020-10180 · Other software · Eset · reported by MITRECritical 9.8
The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro (macOS), Cyber Security (macOS), Mobile Security for Android, Smart TV Security, and NOD32 Antivirus 4 for Linux Desktop.
- Product
- Cyber Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zoller.lublog.zoller.lu
Mar 4, 2020The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formCVE-2020-9372 · WordPress plugins & themes · reported by MITREHigh 7.8
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.
- Product
- Appointment Booking Calendar
- Fixed in
- 1.3.35
- What to do
- Update Appointment Booking Calendar to 1.3.35 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comdrive.google.com
Mar 4, 2020By adding some special fields to the uri ofrouter app function, the user could abuse background app cgi functions withoutauthentication.CVE-2019-3404 · Other software · 360 Security Technology, Inc. · reported by security@360.cnHigh 7.5
By adding some special fields to the uri ofrouter app function, the user could abuse background app cgi functions withoutauthentication. This affects 360 router P0 and F5C.
- Product
- 360 Router F5C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.360.cnsecurity.360.cn
Feb 28, 2020Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server_ip field in JSON data in an api/internaCVE-2020-9463 · Other software · Centreon · reported by MITREHigh 8.8
Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server_ip field in JSON data in an api/internal.php?object=centreon_configuration_remote request.
- Product
- Centreon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Feb 26, 2020Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the Source or Destination field of the Configuration Manager (Configuration ParaCVE-2020-8951 · Other software · Fiserv · reported by MITREMedium 5.4
Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the Source or Destination field of the Configuration Manager (Configuration Parameter Translation) page.
- Product
- Accurate Reconciliation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2020In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname field, an attacker may execute stored XSS atCVE-2019-12513 · Network & remote access · Netgear · reported by MITREMedium 6.1
In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname field, an attacker may execute stored XSS attacks against this device. When the malicious DHCP request is received, the device will generate a log entry containing the malicious hostname. This log entry may then be viewed at Advanced settings->Administration->Logs to trigger the exploit. Although this value is inserted into a textarea tag, converted to all-caps, and limited in length, attacks are still possible.
- Product
- Nighthawk X10-r9000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2020SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field.CVE-2020-9338 · Other software · Soplanning · reported by MITREMedium 5.4
SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2020fauzantrif eLection 2.0 has XSS via the Admin Dashboard -> Settings -> Election -> "message if election is closed" field.CVE-2020-9336 · Other software · Fauzantrif Election Project · reported by MITREMedium 5.4
fauzantrif eLection 2.0 has XSS via the Admin Dashboard -> Settings -> Election -> "message if election is closed" field.
- Product
- Fauzantrif Election
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2020Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtainCVE-2014-4660 · Other software · Redhat · reported by MITREMedium 5.5
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.
- Product
- Ansible
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2020The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to priCVE-2013-4228 · Other software · Organic Groups Project · reported by Red HatMedium 4.3
The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via unspecified vectors.
- Product
- Organic Groups
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Feb 18, 2020ESET Archive Support Module before 1296 allows virus-detection bypass via a crafted Compression Information Field in a ZIP archive.CVE-2020-9264 · Other software · Eset · reported by MITREMedium 5.5
ESET Archive Support Module before 1296 allows virus-detection bypass via a crafted Compression Information Field in a ZIP archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro (macOS), Cyber Security (macOS), Mobile Security for Android, Smart TV Security, and NOD32 Antivirus 4 for Linux Desktop.
- Product
- Cyber Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgblog.zoller.lu
Feb 16, 2020ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the TRACE field of the resource ping.cmd.CVE-2020-9027 · Other software · Eltex-co · reported by MITRECritical 9.8
ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the TRACE field of the resource ping.cmd. The NTP-2 device is also affected.
- Product
- Ntp-2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsku11army.blogspot.comsku11army.blogspot.com
Feb 16, 2020ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd.CVE-2020-9026 · Other software · Eltex-co · reported by MITRECritical 9.8
ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd. The NTP-2 device is also affected.
- Product
- Ntp-2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsku11army.blogspot.comsku11army.blogspot.com
Feb 16, 2020Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py CVE-2020-9025 · Other software · Iteris · reported by MITREMedium 6.1
Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script.
- Product
- Vantage Velocity Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsku11army.blogspot.comsku11army.blogspot.com
Feb 16, 2020Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by crond) and /root/loadCVE-2020-9024 · Other software · Iteris · reported by MITRECritical 9.8
Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by crond) and /root/loadperl.sh (executed as root at boot time) scripts.
- Product
- Vantage Velocity Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsku11army.blogspot.comsku11army.blogspot.com
Feb 16, 2020Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords (User bluetooth, passwoCVE-2020-9023 · Other software · Iteris · reported by MITRECritical 9.8
Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords (User bluetooth, password bluetooth; User eclipse, password eclipse). Also, bluetooth is the root password.
- Product
- Vantage Velocity Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsku11army.blogspot.comsku11army.blogspot.com
Feb 16, 2020Post Oak AWAM Bluetooth Field Device 7400v2.08.21.2018, 7800SD.2015.1.16, 2011.3, 7400v2.02.01.2019, and 7800SD.2012.12.5 is vulnerable to injections of operatiCVE-2020-9021 · Other software · Postoaktraffic · reported by MITRECritical 9.8
Post Oak AWAM Bluetooth Field Device 7400v2.08.21.2018, 7800SD.2015.1.16, 2011.3, 7400v2.02.01.2019, and 7800SD.2012.12.5 is vulnerable to injections of operating system commands through timeconfig.py via shell metacharacters in the htmlNtpServer parameter.
- Product
- Awam Bluetooth Field Device Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsku11army.blogspot.comsku11army.blogspot.com
Feb 16, 2020Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the NCVE-2020-9020 · Other software · Iteris · reported by MITRECritical 9.8
Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the NTP Server field.
- Product
- Vantage Velocity Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsku11army.blogspot.comsku11army.blogspot.com
Feb 14, 2020In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard.CVE-2019-13966 · Other software · Combodo · reported by MITREMedium 6.1
In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard. This is similar to CVE-2015-6544 (which is only about the dashboard title).
- Product
- Itop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2020Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code.CVE-2012-1500 · Websites & servers · Atlassian · reported by MITREMedium 5.4
Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code.
- Product
- Greenhopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgexploit-db.com
Feb 13, 2020SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation.CVE-2020-8802 · Other software · Salesagility · reported by MITRECritical 9.8
SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Feb 13, 2020SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection.CVE-2020-8800 · Other software · Salesagility · reported by MITREHigh 8.8
SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Feb 12, 2020Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF_submask field.CVE-2020-8839 · Other software · Chiyu-t · reported by MITREMedium 6.1
Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF_submask field.
- Product
- Bf-430 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdrive.google.com
Feb 12, 2020Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored CVE-2020-2111 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability.
- Product
- Jenkins Subversion Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Feb 10, 2020Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.CVE-2020-8089 · Other software · Piwigo · reported by MITREMedium 5.4
Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2020Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder.CVE-2019-20174 · Other software · Auth0 · reported by MITREMedium 6.1
Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder.
- Product
- Lock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2020Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field.CVE-2020-7993 · Other software · Prototypejs · reported by MITREMedium 4.3
Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field.
- Product
- Prototype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2020A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message, BCVE-2020-8493 · Other software · Kronos · reported by MITREMedium 4.8
A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message, Banner Message, and Password Instructions) of the com.threeis.webta.H261configMenu servlet via an authenticated administrator.
- Product
- Web Time And Attendance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comnolanbkennedy.com
Jan 29, 2020Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.value field in enginemanager/server/serveCVE-2019-7655 · Other software · Wowza · reported by MITREMedium 5.4
Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.value field in enginemanager/server/serversetup/edit_adv.htm of the Server Setup configuration or the (2) host field in enginemanager/j_spring_security_check of the login form. This issue was resolved in Wowza Streaming Engine 4.8.5.
- Product
- Streaming Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Jan 28, 2020In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a peCVE-2020-7934 · Other software · Liferay · reported by MITREMedium 5.4
In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users (i.e., if a user with modified fields occurs in the search results). This issue was fixed in Liferay Portal CE version 7.3.0 GA1.
- Product
- Liferay Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 28, 2020ASUS WRT-AC66U 3 RT 3.0.0.4.372_67 devices allow XSS via the Client Name field to the Parental Control feature.CVE-2020-7997 · Network & remote access · Asus · reported by MITREMedium 6.1
ASUS WRT-AC66U 3 RT 3.0.0.4.372_67 devices allow XSS via the Client Name field to the Parental Control feature.
- Product
- Rt-ac66u Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.