Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
215 results · page 5 of 5
Mar 21, 2019Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution.CVE-2015-6457 · Other software · Moxa · reported by ics-cert@hq.dhs.govHigh 8.8
Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on June 1, 2015, to address the vulnerability.
- Product
- SoftCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Dec 25, 2018Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% stCVE-2018-20465 · Other software · Craftcms · reported by MITREHigh 7.2
Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2018index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.CVE-2018-20418 · Other software · Craftcms · reported by MITREMedium 4.8
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2018A SQL Injection issue was discovered in Moxa SoftCMS Live Viewer through 1.6.CVE-2017-12729 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
A SQL Injection issue was discovered in Moxa SoftCMS Live Viewer through 1.6. An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability has been identified. Attackers can exploit this vulnerability to access SoftCMS without knowing the user's password.
- Product
- Softcms Lab View
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Jan 1, 2018Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because thCVE-2018-3814 · Other software · Craftcms · reported by MITREHigh 8.8
Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2017Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.CVE-2017-9516 · Other software · Craftcms · reported by MITREMedium 5.4
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.compacketstormsecurity.com
May 1, 2017Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.CVE-2017-8385 · Other software · Craftcms · reported by MITREMedium 5.3
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comtwitter.com
May 1, 2017Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based.CVE-2017-8384 · Other software · Craftcms · reported by MITREMedium 6.1
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comtwitter.com
May 1, 2017Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.CVE-2017-8383 · Other software · Craftcms · reported by MITREMedium 5.3
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comtwitter.com
Apr 21, 2017Craft CMS before 2.6.2974 allows XSS attacks.CVE-2017-8052 · Other software · Craftcms · reported by MITREMedium 6.1
Craft CMS before 2.6.2974 allows XSS attacks.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comtwitter.com
Feb 13, 2017An issue was discovered in Moxa SoftCMS versions prior to Version 1.6.CVE-2016-9333 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. The SoftCMS Application does not properly sanitize input that may allow a remote attacker access to SoftCMS with administrator's privilege through specially crafted input (SQL INJECTION).
- Product
- Softcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Feb 13, 2017An issue was discovered in Moxa SoftCMS versions prior to Version 1.6.CVE-2016-9332 · Other software · Moxa · reported by ics-cert@hq.dhs.govHigh 7.5
An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. Moxa SoftCMS Webserver does not properly validate input. An attacker could provide unexpected values and cause the program to crash or excessive consumption of resources could result in a denial-of-service condition.
- Product
- Softcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Feb 13, 2017An issue was discovered in Moxa SoftCMS versions prior to Version 1.6.CVE-2016-8360 · Other software · Moxa · reported by ics-cert@hq.dhs.govHigh 8.1
An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. A specially crafted URL request sent to the SoftCMS ASP Webserver can cause a double free condition on the server allowing an attacker to modify memory locations and possibly cause a denial of service or the execution of arbitrary code.
- Product
- Softcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Aug 7, 2016SQL injection vulnerability in Moxa SoftCMS before 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified fields.CVE-2016-5792 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
SQL injection vulnerability in Moxa SoftCMS before 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified fields.
- Product
- Softcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comzerodayinitiative.com
Jun 5, 2015Stack-based buffer overflow in the OpenForIPCamTest method in the RTSPVIDEO.rtspvideoCtrl.1 (aka SStreamVideo) ActiveX control in Moxa SoftCMS before 1.3 allowsCVE-2015-1000 · Other software · Moxa · reported by ics-cert@hq.dhs.govMedium 6.8
Stack-based buffer overflow in the OpenForIPCamTest method in the RTSPVIDEO.rtspvideoCtrl.1 (aka SStreamVideo) ActiveX control in Moxa SoftCMS before 1.3 allows remote attackers to execute arbitrary code via the StrRtspPath parameter.
- Product
- Softcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comzerodayinitiative.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.