Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
316 results · page 5 of 7
Jun 17, 2022ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity (XXE).CVE-2021-45024 · Other software · Rocketsoftware · reported by MITRECritical 9.8
ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity (XXE).
- Product
- Ags-zena
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rocketsoftware.comdocs.rocketsoftware.com
Jun 2, 2022Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=result&searchfor=bycompany.CVE-2022-32016 · Other software · Complete Online JOB Search System Project · reported by MITREHigh 7.2
Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=result&searchfor=bycompany.
- Product
- Complete Online JOB Search System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/company/index.php?view=edit&id=.CVE-2022-32007 · Other software · Complete Online JOB Search System Project · reported by MITREHigh 7.2
Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/company/index.php?view=edit&id=.
- Product
- Complete Online JOB Search System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress.CVE-2022-29447 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress.
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress.CVE-2022-29448 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress.
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 19, 2022Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress.CVE-2022-29446 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress.
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 18, 2022Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.CVE-2022-29445 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 5, 2022Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-1411 · Other software · yetiforcecompany · reported by security@huntr.devMedium 6.1
Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaCVE-2022-27961 · Other software · Ofcms Project · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment text box.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2022Microsoft Intune Portal for iOS Security Feature Bypass VulnerabilityCVE-2022-24465 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.3
Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability
- Product
- Intune Company Portal for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 24, 2022Cross-Site Request Forgery (CSRF) in Packagist yetiforce/yetiforce-crm prior to 6.3.0.CVE-2022-0269 · Other software · yetiforcecompany · reported by security@huntr.devHigh 8
Cross-Site Request Forgery (CSRF) in Packagist yetiforce/yetiforce-crm prior to 6.3.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022WP Coder: Within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as wellCVE-2021-25053 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
- Product
- WP Coder
- Fixed in
- 2.5.2
- What to do
- Update WP Coder to 2.5.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 10, 2022Button Generator: Within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as wellCVE-2021-25052 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
- Product
- Button Generator
- Fixed in
- 2.3.3
- What to do
- Update Button Generator to 2.3.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 10, 2022Modal Window: Within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as wellCVE-2021-25051 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
- Product
- Modal Window
- Fixed in
- 5.2.2
- What to do
- Update Modal Window to 5.2.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 16, 2021yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4121 · Other software · yetiforcecompany · reported by security@huntr.devMedium 6.1
yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021yetiforcecrm is vulnerable to Business Logic ErrorsCVE-2021-4117 · Other software · yetiforcecompany · reported by security@huntr.devMedium 4.3
yetiforcecrm is vulnerable to Business Logic Errors
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4116 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021yetiforcecrm is vulnerable to Business Logic ErrorsCVE-2021-4111 · Other software · yetiforcecompany · reported by security@huntr.devMedium 4.3
yetiforcecrm is vulnerable to Business Logic Errors
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4107 · Other software · yetiforcecompany · reported by security@huntr.devMedium 6.1
yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2021yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-4092 · Other software · yetiforcecompany · reported by security@huntr.devMedium 4.3
yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021The Company's Recruitment Management System in id=2 of the parameter from view_vacancy app on-page appears to be vulnerable to SQL injection.CVE-2021-41931 · Other software · Recruitment Management System Project · reported by MITRECritical 9.8
The Company's Recruitment Management System in id=2 of the parameter from view_vacancy app on-page appears to be vulnerable to SQL injection. The payloads 19424269' or '1309'='1309 and 39476597' or '2917'='2923 were each submitted in the id parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
- Product
- Recruitment Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2021Perfex CRM v2.4.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component ./clients/client via the company name parameter.CVE-2020-28961 · Other software · Perfexcrm · reported by MITREMedium 5.4
Perfex CRM v2.4.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component ./clients/client via the company name parameter.
- Product
- Perfex CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Aug 17, 2021Cross Site Scripting (XSS) vulnerability exists in SeaCMS 12.6 via the (1) v_company and (2) v_tvs parameters in /admin_video.php,CVE-2021-29313 · Other software · Seacms · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability exists in SeaCMS 12.6 via the (1) v_company and (2) v_tvs parameters in /admin_video.php,
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php.CVE-2020-22212 · Other software · 74cms · reported by MITRECritical 9.8
SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php.
- Product
- 74cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2021OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a sCVE-2021-31934 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a smartphone.
- Product
- Open-xchange Appsuite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Apr 22, 2021Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Advanced Global Intercompany).CVE-2021-2236 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1
Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Advanced Global Intercompany). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials Common Modules. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financials Common Modules accessible data as well as unauthorized access to critical data or complete access to all Oracle Financials Common Modules accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
- Product
- Financials Common Modules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2021An issue was discovered in New Media Smarty before 9.10.CVE-2020-10375 · Other software · Newmediacompany · reported by MITREMedium 5.5
An issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in an obfuscated format that can be easily reversed. The file data.mdb contains these obfuscated passwords in the second column. NOTE: this is unrelated to the popular Smarty template engine product.
- Product
- Smarty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsmarty-online.dex41-dsec.de
Feb 5, 2021In Electric Coin Company Zcashd before 2.1.1-1, the time offset between messages could be leveraged to obtain sensitive information about the relationship betweCVE-2020-8807 · Other software · Electriccoin · reported by MITREMedium 5.3
In Electric Coin Company Zcashd before 2.1.1-1, the time offset between messages could be leveraged to obtain sensitive information about the relationship between a suspected victim's address and an IP address, aka a timing side channel.
- Product
- Zcashd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordelectriccoin.coelectriccoin.co
Feb 5, 2021Electric Coin Company Zcashd before 2.1.1-1 allows attackers to trigger consensus failure and double spending.CVE-2020-8806 · Other software · Electriccoin · reported by MITREHigh 7.5
Electric Coin Company Zcashd before 2.1.1-1 allows attackers to trigger consensus failure and double spending. A valid chain could be incorrectly rejected because timestamp requirements on block headers were not properly enforced.
- Product
- Zcashd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordelectriccoin.coelectriccoin.co
Jan 26, 2021Rostelecom CS-C2SHW 5.0.082.1 is affected by: Bash command injection.CVE-2020-27542 · Other software · Company · reported by MITREMedium 6.8
Rostelecom CS-C2SHW 5.0.082.1 is affected by: Bash command injection. The camera reads configuration from QR code (including network settings). The static IP configuration from QR code is copied to the file /config/ip-static and after reboot data from this file is inserted into bash command (without any escaping). So bash injection is possible. Camera doesn't parse QR codes if it's already successfully configured. Camera is always rebooted after successful configuration via QR code.
- Product
- Cs-c2shw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddil4rd.medium.comdil4rd.medium.com
Jan 26, 2021Denial of Service vulnerability in Rostelecom CS-C2SHW 5.0.082.1.CVE-2020-27541 · Other software · Company · reported by MITREHigh 7.5
Denial of Service vulnerability in Rostelecom CS-C2SHW 5.0.082.1. AgentGreen service has a bug in parsing broadcast discovery UDP packet. Sending a packet of too small size will lead to an attempt of allocating buffer of negative size. As the result service AgentGreen will be terminated and started again later.
- Product
- Cs-c2shw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddil4rd.medium.comdil4rd.medium.com
Jan 26, 2021Bash injection vulnerability and bypass of signature verification in Rostelecom CS-C2SHW 5.0.082.1.CVE-2020-27540 · Other software · Company · reported by MITRECritical 9.8
Bash injection vulnerability and bypass of signature verification in Rostelecom CS-C2SHW 5.0.082.1. The camera reads firmware update configuration from SD card file vc\version.json. fw-sign parameter and from this configuration is directly inserted into a bash command. Firmware update is run automatically if there is special file on the inserted SD card.
- Product
- Cs-c2shw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddil4rd.medium.comdil4rd.medium.com
Jan 26, 2021Heap overflow with full parsing of HTTP respose in Rostelecom CS-C2SHW 5.0.082.1.CVE-2020-27539 · Other software · Company · reported by MITRECritical 9.8
Heap overflow with full parsing of HTTP respose in Rostelecom CS-C2SHW 5.0.082.1. AgentUpdater service has a self-written HTTP parser and builder. HTTP parser has a heap buffer overflow (OOB write). In default configuration camera parses responses only from HTTPS URLs from config file, so vulnerable code is unreachable and one more bug required to reach it.
- Product
- Cs-c2shw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddil4rd.medium.comdil4rd.medium.com
Jan 5, 2021CA Service Catalog 17.2 and 17.3 contain a vulnerability in the default configuration of the Setup Utility that may allow a remote attacker to cause a denial ofCVE-2020-29478 · Other software · CA Technologies, A Broadcom Company · reported by vuln@ca.comHigh 7.5
CA Service Catalog 17.2 and 17.3 contain a vulnerability in the default configuration of the Setup Utility that may allow a remote attacker to cause a denial of service condition.
- Product
- CA Service Catalog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comsupport.broadcom.com
Dec 25, 2020Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.CVE-2020-35707 · Other software · Daybydaycrm · reported by MITREMedium 5.4
Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.
- Product
- Daybyday
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtufangungor.github.io
Apr 1, 2020In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability exists in the kiosk mCVE-2020-10598 · Other software · Becton, Dickinson and Company (BD) · reported by ics-cert@hq.dhs.govMedium 6.1
In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability exists in the kiosk mode functionality of affected devices. Specially crafted inputs could allow the user to escape the restricted environment, resulting in access to sensitive data.
- Product
- Pyxis MedStation ES System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Feb 17, 2020CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (controller) componentCVE-2020-8012 · Other software · CA Technologies - A Broadcom Company · reported by vuln@ca.comCritical 9.8
CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (controller) component. A remote attacker can execute arbitrary code.
- Product
- CA Unified Infrastructure Management (Nimsoft/UIM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Feb 17, 2020CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a null pointer dereference vulnerability in the robot (controller) CVE-2020-8011 · Other software · CA Technologies - A Broadcom Company · reported by vuln@ca.comHigh 7.5
CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a null pointer dereference vulnerability in the robot (controller) component. A remote attacker can crash the Controller service.
- Product
- CA Unified Infrastructure Management (Nimsoft/UIM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comtechdocs.broadcom.com
Feb 17, 2020CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) coCVE-2020-8010 · Other software · CA Technologies - A Broadcom Company · reported by vuln@ca.comCritical 9.8
CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote attacker can execute commands, read from, or write to the target system.
- Product
- CA Unified Infrastructure Management (Nimsoft/UIM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsupport.broadcom.com
Feb 6, 2020Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in VtigeCVE-2015-6000 · Other software · Vtiger · reported by cret@cert.orgHigh 8.8
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in test/logo/.
- Product
- Vtiger CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordb.fl7.desecurityfocus.com
Jan 15, 2020Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Company Dir / Org Chart Viewer).CVE-2020-2561 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Company Dir / Org Chart Viewer). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
- Product
- PeopleSoft Enterprise HCM Human Resources
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2019Open redirect vulnerability in Library Information Management System LIMEDIO all versions allows remote attackers to redirect users to arbitrary web sites and cCVE-2019-6021 · Other software · RICOH COMPANY, LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in Library Information Management System LIMEDIO all versions allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL.
- Product
- Library Information Management System LIMEDIO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2019An insecure file access vulnerability exists in CA Client Automation 14.0, 14.1, 14.2, and 14.3 Agent for Windows that can allow a local attacker to gain escalaCVE-2019-19231 · Other software · CA Technologies, Broadcom Company · reported by vuln@ca.comHigh 7.3
An insecure file access vulnerability exists in CA Client Automation 14.0, 14.1, 14.2, and 14.3 Agent for Windows that can allow a local attacker to gain escalated privileges.
- Product
- CA Client Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 9, 2019An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remote attacker to executCVE-2019-19230 · Other software · CA Technologies, A Broadcom Company · reported by vuln@ca.comCritical 9.8
An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remote attacker to execute arbitrary code.
- Product
- CA Release Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 17, 2019CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute CVE-2019-13657 · Other software · CA Technologies, A Broadcom Company · reported by vuln@ca.comCritical 9.8
CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security.
- Product
- CA Performance Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 2, 2019CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise syCVE-2019-13658 · Other software · CA Technologies, a Broadcom Company · reported by vuln@ca.comCritical 9.8
CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security.
- Product
- CA Network Flow Analysis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 13, 2019admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter.CVE-2019-13364 · Other software · Piwigo · reported by MITRECritical 9.6
admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter. This is exploitable via CSRF.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
May 28, 2019A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA RCVE-2019-7394 · Other software · CA Technologies, A Broadcom Company · reported by vuln@ca.comHigh 8.8
A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where an account has customized and limited privileges.
- Product
- CA Strong Authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
May 28, 2019A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk AuthenCVE-2019-7393 · Other software · CA Technologies, A Broadcom Company · reported by vuln@ca.comMedium 4.3
A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x may allow a remote attacker to gain sensitive information in some cases.
- Product
- CA Strong Authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
May 17, 2019JR East Japan train operation information push notification App for Android version 1.2.4 and earlier allows remote attackers to bypass access restriction to obCVE-2019-5954 · Other software · East Japan Railway Company · reported by vultures@jpcert.or.jpCritical 9.1
JR East Japan train operation information push notification App for Android version 1.2.4 and earlier allows remote attackers to bypass access restriction to obtain or alter the user's registered information via unspecified vectors.
- Product
- JR East Japan train operation information push notification App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.