Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

348 results · page 5 of 7

Nov 9, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303).CVE-2021-31883 · Other software · Siemens · reported by productcert@siemens.comHigh 7.1
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). When processing a DHCP ACK message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0013)
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Nov 9, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303).CVE-2021-31882 · Other software · Siemens · reported by productcert@siemens.comMedium 6.5
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). The DHCP client application does not validate the length of the Domain Name Server IP option(s) (0x06) when processing DHCP ACK packets. This may lead to Denial-of-Service conditions. (FSMD-2021-0011)
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Nov 9, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303).CVE-2021-31881 · Other software · Siemens · reported by productcert@siemens.comHigh 7.1
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). When processing a DHCP OFFER message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0008)
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Nov 9, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROCVE-2021-31346 · Other software · Siemens · reported by productcert@siemens.comHigh 8.2
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). The total length of an ICMP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0007)
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Nov 9, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROCVE-2021-31345 · Other software · Siemens · reported by productcert@siemens.comHigh 7.5
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions). The total length of an UDP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on a user-defined applications that runs on top of the UDP protocol. (FSMD-2021-0006)
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Nov 9, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROCVE-2021-31344 · Other software · Siemens · reported by productcert@siemens.comMedium 6.9
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). ICMP echo packets with fake IP options allow sending ICMP echo reply messages to arbitrary hosts on the network. (FSMD-2021-0004)
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Oct 27, 2021Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause deCVE-2021-22101 · Other software · Cloudfoundry · reported by security@vmware.comHigh 7.5
Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause denial of service by using REST HTTP requests with label_selectors on multiple V3 endpoints by generating an enormous SQL query.
Product
Capi-release
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cloudfoundry.org cloudfoundry.org
Sep 6, 2021Email Encoder – Protect Email Addresses: Has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the dataCVE-2021-24599 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the data.
Product
Email Encoder – Protect Email Addresses
Fixed in
2.1.2
What to do
Update Email Encoder – Protect Email Addresses to 2.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 13, 2021openBaraza HCM 3.1.6 does not properly neutralize user-controllable input: an unauthenticated remote attacker can conduct a stored cross-site scripting (XSS) atCVE-2021-38619 · Other software · Openbaraza · reported by MITREMedium 6.1
openBaraza HCM 3.1.6 does not properly neutralize user-controllable input: an unauthenticated remote attacker can conduct a stored cross-site scripting (XSS) attack against an administrative user from hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view=).
Product
Openbaraza Human Capital Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com openbaraza.org
Aug 13, 2021openBaraza HCM 3.1.6 does not properly neutralize user-controllable input, which allows reflected cross-site scripting (XSS) on multiple pages: hr/subscription.CVE-2021-38583 · Other software · Openbaraza · reported by MITREMedium 6.1
openBaraza HCM 3.1.6 does not properly neutralize user-controllable input, which allows reflected cross-site scripting (XSS) on multiple pages: hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view= and data=).
Product
Openbaraza Human Capital Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com openbaraza.org
Aug 11, 2021@asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream (SCSt) microservice.CVE-2021-37694 · Other software · asyncapi · reported by GitHubHigh 8.7
@asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream (SCSt) microservice. In versions prior to 0.7.0 arbitrary code injection was possible when an attacker controls the AsyncAPI document. An example is provided in GHSA-xj6r-2jpm-qvxp. There are no mitigations available and all users are advised to update.
Product
java-spring-cloud-stream-template
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 12, 2021The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request.CVE-2021-24385 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request. This is a major vulnerability as the user input is not escaped and passed directly to the get_col function and it allows SQL injection. The Rest API endpoint which invokes this function also does not have any required permissions/authentication and can be accessed by an anonymous user.
Affected
4.7.3 to 4.7.3
What to do
Affects 4.7.3 to 4.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record 10up.com wpscan.com
Jun 24, 2021Lack of escaping allowed HTML injection when a webpage was viewed in Reader View.CVE-2021-29944 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. While a Content Security Policy prevents direct code execution, HTML injection is still possible. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 88.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 11, 2021Improper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator to alter the configuration of Controllers and other hardware iCVE-2021-23205 · Other software · Gallagher · reported by disclosures@gallagher.comHigh 8.1
Improper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator to alter the configuration of Controllers and other hardware items beyond their privilege. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 (MR3); 8.30 versions prior to 8.30.1359 (MR3); 8.20 versions prior to 8.20.1259 (MR5); version 8.10 and prior versions.
Product
Command Centre
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.gallagher.com security.gallagher.com
May 24, 2021Autoptimize: Was missing proper escaping and sanitisation in some of its settingsCVE-2021-24332 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues
Product
Autoptimize
Fixed in
2.8.4
What to do
Update Autoptimize to 2.8.4 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
May 4, 2021Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements.CVE-2021-31164 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements.
Product
Apache Unomi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record unomi.apache.org unomi.apache.org
Apr 22, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Nucleus NECVE-2021-25664 · Other software · Siemens · reported by productcert@siemens.comHigh 8.7
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (All versions including affected IPv6 stack). The function that processes the Hop-by-Hop extension header in IPv6 packets and its options lacks any checks against the length field of the header, allowing attackers to put the function into an infinite loop by supplying arbitrary length values.
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Apr 22, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Nucleus NECVE-2021-25663 · Other software · Siemens · reported by productcert@siemens.comHigh 8.7
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (All versions including affected IPv6 stack). The function that processes IPv6 headers does not check the lengths of extension header options, allowing attackers to put this function into an infinite loop with crafted length values.
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Apr 8, 2021Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed.CVE-2021-22115 · Other software · Cloudfoundry · reported by security@vmware.comMedium 6.5
Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed. CAPI database logs service broker password in plain text whenever a job to clean up orphaned items is run by Cloud Controller.
Product
Capi-release
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cloudfoundry.org cloudfoundry.org
Mar 12, 2021In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.CVE-2021-28162 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgMedium 6.1
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.
Product
Eclipse Theia
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 12, 2021In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.CVE-2021-28161 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgMedium 6.1
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.
Product
Eclipse Theia
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 25, 2021The DOMParser API did not properly process '<noscript>' elements for escaping.CVE-2021-23974 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
The DOMParser API did not properly process '<noscript>' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox < 86.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org security.gentoo.org
Feb 16, 2021Improper Encoding or Escaping of Output from CSV Report Generator of Secomea GateManager allows an authenticated administrator to generate a CSV file that may rCVE-2020-29023 · Other software · Secomea · reported by VulnerabilityReporting@secomea.comLow 3.5
Improper Encoding or Escaping of Output from CSV Report Generator of Secomea GateManager allows an authenticated administrator to generate a CSV file that may run arbitrary commands on a victim's computer when opened in a spreadsheet program (like Excel). This issue affects: Secomea GateManager all versions prior to 9.3.
Product
GateManager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secomea.com secomea.com
Jan 29, 2021Foris before 101.1.1, as used in Turris OS, lacks certain HTML escaping in the login template.CVE-2021-3346 · Other software · NIC · reported by MITRECritical 9.8
Foris before 101.1.1, as used in Turris OS, lacks certain HTML escaping in the login template.
Product
Foris
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.nic.cz gitlab.nic.cz
Jan 28, 2021It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of search queries.CVE-2021-20183 · Other software · Moodle · reported by Red HatMedium 5.4
It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of search queries.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record moodle.org moodle.org
Jan 6, 2021The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.CVE-2020-36173 · WordPress plugins & themes · reported by MITREMedium 5.3
The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.
Product
Ninja Forms
Fixed in
3.4.28
What to do
Update Ninja Forms to 3.4.28 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jan 6, 2021The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.CVE-2020-36172 · WordPress plugins & themes · reported by MITREMedium 6.1
The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.
Product
Advanced Custom Fields
Fixed in
5.8.12
What to do
Update Advanced Custom Fields to 5.8.12 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Dec 30, 2020XWiki Platform before 12.8 mishandles escaping in the property displayer.CVE-2020-13654 · Other software · xwiki · reported by MITREHigh 7.5
XWiki Platform before 12.8 mishandles escaping in the property displayer.
Product
xwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cve.nstsec.com github.com
Dec 1, 2020CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send speciallyCVE-2020-5423 · Other software · Cloud Foundry · reported by security@pivotal.ioHigh 7.5
CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send specially-crafted YAML files to certain endpoints, causing the YAML parser to consume excessive CPU and RAM.
Product
CAPI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cloudfoundry.org cloudfoundry.org
Nov 12, 2020A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import previeCVE-2020-25706 · Other software · The Cacti Group, Inc. · reported by Red HatMedium 5.4
A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import preview in the xml_path field
Product
cacti
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com github.com
Oct 27, 2020The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data.CVE-2020-27957 · Other software · Mediawiki · reported by MITREMedium 5.4
The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data. When certain varieties of games were created within MediaWiki, their names or titles could be manipulated to generate stored XSS within the RandomGameUnit extension.
Product
Mediawiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gerrit.wikimedia.org phabricator.wikimedia.org
Sep 10, 2020Zulip Desktop before 5.4.3 allows XSS because string escaping is mishandled during composition of the HTML for the user interface.CVE-2020-24582 · Other software · Zulipchat · reported by MITREMedium 6.1
Zulip Desktop before 5.4.3 allows XSS because string escaping is mishandled during composition of the HTML for the user interface.
Product
Zulip Desktop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.zulip.com blog.zulip.com
Sep 2, 2020Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spacCVE-2020-5418 · Other software · Cloud Foundry · reported by security@pivotal.ioMedium 4.3
Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spaces, to list all droplets in all spaces (whereas they should see none).
Product
CAPI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cloudfoundry.org cloudfoundry.org
Aug 26, 2020Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping.CVE-2020-24315 · WordPress plugins & themes · reported by MITREHigh 7.5
Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database.
Affected
up to 36.0
What to do
Affects up to 36.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org zeroaptitude.com
Aug 21, 2020Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the dCVE-2020-5417 · Other software · Cloud Foundry · reported by security@pivotal.ioHigh 8.8
Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the default CF Deployment manifest), were vulnerable to developers maliciously or accidentally claiming certain sensitive routes, potentially resulting in the developer's app handling some requests that were expected to go to certain system components.
Product
CAPI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cloudfoundry.org cloudfoundry.org
Jun 8, 2020PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character.CVE-2020-13625 · Websites & servers · Phpmailer Project · reported by MITREHigh 7.5
PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.
Product
Phpmailer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Mar 17, 2020cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).CVE-2019-20493 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 10, 2020NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited.CVE-2020-5253 · Other software · NetHack · reported by GitHubLow 3.9
NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited. This bug is patched in NetHack 3.6.0.
Product
NetHack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 27, 2020Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information sCVE-2020-5400 · Other software · Cloud Foundry · reported by security@pivotal.ioMedium 6.5
Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.
Product
CAPI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cloudfoundry.org cloudfoundry.org
Feb 17, 2020The default configuration of the Jinja templating engine used in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not enable auto-escaping,CVE-2015-5215 · Other software · Ipsilon-project · reported by Red HatMedium 6.1
The default configuration of the Jinja templating engine used in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not enable auto-escaping, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via template variables. NOTE: This may be a duplicate of CVE-2015-5216. Moreover, the Jinja development team does not enable auto-escape by default for performance issues as explained in https://jinja.palletsprojects.com/en/master/faq/#why-is-autoescaping-not-the-default.
Product
Ipsilon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com bugzilla.redhat.com
Feb 4, 2020Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.CVE-2019-15618 · Other software · Nextcloud · reported by support@hackerone.comMedium 4.8
Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.
Product
Nextcloud Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com nextcloud.com
Jan 6, 2020The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability in files it serves.CVE-2019-15602 · Other software · Itwork · reported by support@hackerone.comMedium 6.1
The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability in files it serves.
Product
Fileview
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com hackerone.com
Jan 2, 2020There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers dataCVE-2019-14863 · Other software · Red Hat · reported by Red HatMedium 6.1
There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.
Product
angular:
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com snyk.io
Jan 2, 2020There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to itCVE-2019-14862 · Other software · Red Hat · reported by Red HatMedium 6.1
There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.
Product
knockout
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com snyk.io
Dec 19, 2019Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, CVE-2019-11294 · Other software · Cloud Foundry · reported by security@pivotal.ioMedium 4.3
Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only be accessible to admins.
Product
CAPI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cloudfoundry.org cloudfoundry.org
Dec 17, 2019Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output.CVE-2019-19714 · Other software · Contao · reported by MITREMedium 5.3
Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered.
Product
Contao
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record contao.org contao.org
Oct 30, 2019columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.CVE-2019-10762 · Other software · Medoo · reported by report@snyk.ioCritical 9.8
columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.
Product
Medoo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com snyk.io
Oct 17, 2019Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly CVE-2019-10752 · Other software · Sequelizejs · reported by report@snyk.ioCritical 9.8
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
Product
Sequelize
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 1, 2019JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS.CVE-2019-14961 · Other software · Jetbrains · reported by MITREMedium 6.1
JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS.
Product
Upsource
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.jetbrains.com blog.jetbrains.com
Sep 24, 2019In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.CVE-2019-16725 · Websites & servers · Joomla · reported by MITREMedium 6.1
In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.