Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
241 results · page 5 of 5
Aug 22, 2022Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in wpshopmart Testimonial Builder plugin <= 1.6.1 at WordPress.CVE-2021-36857 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in wpshopmart Testimonial Builder plugin <= 1.6.1 at WordPress.
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 28, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.CVE-2022-35882 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.
- Affected
- up to 1.9.5
- What to do
- Affects up to 1.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 22, 2022Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testimonials plugin <= 3.0.1 at WordPress.CVE-2022-33191 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testimonials plugin <= 3.0.1 at WordPress.
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 11, 2022Image optimization & Lazy Load by Optimole: Does not sanitise and escape its "Lazyload background images for selectors" settingsCVE-2022-0969 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Image optimization & Lazy Load by Optimole
- Fixed in
- 3.3.2
- What to do
- Update Image optimization & Lazy Load by Optimole to 3.3.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 4, 2022Web-Settler Testimonial Slider – Free Testimonials Slider: Authenticated (editor or higher user role) Cross-Site Scripting (XSS)CVE-2021-36851 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated (editor or higher user role) Cross-Site Scripting (XSS) vulnerability in Web-Settler Testimonial Slider – Free Testimonials Slider Plugin (WordPress plugin) via parameters mpsp_posts_bg_color, mpsp_posts_description_color, mpsp_slide_nav_button_color.
- Product
- Web-Settler Testimonial Slider – Free Testimonials Slider
- Affected
- up to 3.5.8.3
- What to do
- Affects up to 3.5.8.3. Update Web-Settler Testimonial Slider – Free Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Feb 28, 2022Testimonial: Does not sanitise and escape the id parameter before outputting it back in an attributeCVE-2022-23912 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting
- Product
- Testimonial
- Fixed in
- 1.4.7
- What to do
- Update Testimonial to 1.4.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022Testimonial: Does not validate and escape the id parameter before using it in a SQL statementCVE-2022-23911 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection
- Product
- Testimonial
- Fixed in
- 1.4.7
- What to do
- Update Testimonial to 1.4.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 25, 2022A cross-site scripting (XSS) vulnerability in PaquitoSoftware Notimoo v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted title or messCVE-2021-42244 · Other software · Notimoo Project · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in PaquitoSoftware Notimoo v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted title or message in a notification.
- Product
- Notimoo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Testimonial: Does not escape some testimonial fieldsCVE-2021-24598 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Testimonial WordPress plugin before 1.6.0 does not escape some testimonial fields which could allow high privilege users to perform Cross Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Testimonial
- Fixed in
- 1.6.0
- What to do
- Update Testimonial to 1.6.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Sep 6, 2021An id GET parameter of the Easy Testimonial Manager WordPress plugin through 1.2.0 is not sanitised, escaped or validated before inserting to a SQL statement, lCVE-2021-24394 · WordPress plugins & themes · reported by WPScanHigh 7.2
An id GET parameter of the Easy Testimonial Manager WordPress plugin through 1.2.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection
- Product
- Easy Testimonial Manager
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Easy Testimonial Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 2, 2021The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does nCVE-2021-24492 · WordPress plugins & themes · reported by WPScanHigh 8.8
The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does not sanitise, validate or escape the hndtst_previewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue.
- Product
- Handsome Testimonials & Reviews
- Fixed in
- 2.1.1
- What to do
- Update Handsome Testimonials & Reviews to 2.1.1 or newer.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Apr 5, 2021Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML wiCVE-2021-24156 · WordPress plugins & themes · reported by WPScanMedium 5.4
Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML without approval. This could lead to privilege escalation
- Affected
- 3.0.3 to 3.0.3
- What to do
- Affects 3.0.3 to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2021Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabCVE-2021-24136 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location - Company - Email - URL
- Product
- Testimonials Widget
- Fixed in
- 4.0.0
- What to do
- Update Testimonials Widget to 4.0.0 or newer.
Oct 16, 2020Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php.CVE-2020-26672 · WordPress plugins & themes · reported by MITREMedium 5.4
Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user intercepts a request and inserts a payload in "cite" parameter, the payload will be stored in the database.
- Fixed in
- 3.0.3
- What to do
- Update the plugin to 3.0.3 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Jun 21, 2020Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the wp-aCVE-2020-14959 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the wp-admin/post.php Client Name, Position, Web Address, Other, Location Reviewed, Product Reviewed, Item Reviewed, or Rating parameter.
- Product
- Multiple XSS vulnerabilities in the Easy Testimonials
- Fixed in
- 3.6
- What to do
- Update Multiple XSS vulnerabilities in the Easy Testimonials to 3.6 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Feb 3, 2020Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.CVE-2020-8549 · WordPress plugins & themes · reported by MITREMedium 6.1
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.
- Product
- Stored XSS in the Strong Testimonials
- Fixed in
- 2.40.1
- What to do
- Update Stored XSS in the Strong Testimonials to 2.40.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 30, 2020Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web scCVE-2013-4241 · WordPress plugins & themes · reported by Red HatMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format parameter to the Settings - Default form (hms-testimonials-settings page); (6) name parameter in a Save action to the Settings - Custom Fields form (hms-testimonials-settings-fields page); or (7) name parameter in a Save action to the Settings - Template form (hms-testimonials-templates-new page).
- Product
- Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials
- Fixed in
- 2.0.11
- What to do
- Update Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials to 2.0.11 or newer.
Full record and what to do →NVD recordseclists.orgseclists.org
Sep 25, 2019The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.CVE-2015-9417 · WordPress plugins & themes · reported by MITREMedium 6.5
The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.
- Product
- testimonial-slider
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update testimonial-slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 21, 2019The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.CVE-2017-18558 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.
- Product
- bws-testimonials
- Fixed in
- 0.1.9
- What to do
- Update bws-testimonials to 0.1.9 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Nov 26, 2018Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress.CVE-2018-19564 · WordPress plugins & themes · reported by MITREMedium 6.1
Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters (_ikcf_client and _ikcf_position and _ikcf_other) have Cross-Site Scripting.
- Product
- Easy Testimonials
- Affected
- 3.2 to 3.2
- What to do
- Affects 3.2 to 3.2. Update Easy Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Sep 21, 2018A stack-based buffer overflow was discovered in the xtimor NMEA library (aka nmealib) 0.5.3.CVE-2018-17174 · Other software · Nmealib Project · reported by MITRECritical 9.8
A stack-based buffer overflow was discovered in the xtimor NMEA library (aka nmealib) 0.5.3. nmea_parse() in parser.c allows an attacker to trigger denial of service (even arbitrary code execution in a certain context) in a product using this library via malformed data.
- Product
- Nmealib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcnblogs.comcnblogs.com
Jan 12, 2018The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).CVE-2018-5372 · WordPress plugins & themes · reported by MITREHigh 8.8
The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).
- Product
- Testimonial Slider
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddefensecode.comdefensecode.com
Aug 1, 2017The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More TCVE-2017-12131 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More Testimonials Link, and Testimonial Excerpt Options screens.
- Affected
- 3.0.4 to 3.0.4
- What to do
- Affects 3.0.4 to 3.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 12, 2017SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid paraCVE-2017-9418 · WordPress plugins & themes · reported by MITREHigh 8.8
SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php.
- Product
- WP-Testimonials
- Affected
- 3.4.1 to 3.4.1
- What to do
- Affects 3.4.1 to 3.4.1. Update WP-Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comexploit-db.com
Apr 2, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the autheCVE-2013-4240 · WordPress plugins & themes · reported by Red HatMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add new testimonials via the hms-testimonials-addnew page, (2) add new groups via the hms-testimonials-addnewgroup page, (3) change default settings via the hms-testimonials-settings page, (4) change advanced settings via the hms-testimonials-settings-advanced page, (5) change custom fields settings via the hms-testimonials-settings-fields page, or (6) change template settings via the hms-testimonials-templates-new page to wp-admin/admin.php.
- Product
- Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials
- Fixed in
- 2.0.11
- What to do
- Update Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials to 2.0.11 or newer.
Sep 10, 2013SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands viCVE-2013-5673 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the custom_query parameter in a testimonial_add action to wp-admin/admin-ajax.php.
- Product
- IndiaNIC Testimonial
- What to do
- Update IndiaNIC Testimonial to the newest version.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Sep 10, 2013Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow remote attackers to hijack the authenticatCVE-2013-5672 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add a testimonial via an iNIC_testimonial_save action; (2) add a listing template via an iNIC_testimonial_save_listing_template action; (3) add a widget template via an iNIC_testimonial_save_widget action; insert cross-site scripting (XSS) sequences via the (4) project_name, (5) project_url, (6) client_name, (7) client_city, (8) client_state, (9) description, (10) tags, (11) video_url, or (12) is_featured, (13) title, (14) widget_title, (15) no_of_testimonials, (16) filter_by_country, (17) filter_by_tags, or (18) widget_template parameter to wp-admin/admin-ajax.php.
- Product
- IndiaNIC Testimonial
- What to do
- Update IndiaNIC Testimonial to the newest version.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Nov 1, 2011SQL injection vulnerability in the AutarTimonial (com_autartimonial) component 1.0.8 for Joomla! allows remote attackers to execute arbitrary SQL commands via tCVE-2010-5003 · Other software · Autartica · reported by MITREHigh 7.5
SQL injection vulnerability in the AutarTimonial (com_autartimonial) component 1.0.8 for Joomla! allows remote attackers to execute arbitrary SQL commands via the limit parameter in an autartimonial action to index.php. NOTE: some of these details are obtained from third party information.
- Product
- COM Autartimonial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org
May 27, 2010Buffer overflow in Webby Webserver 1.01 allows remote attackers to execute arbitrary code via a long HTTP GET request.CVE-2010-2102 · Other software · Timo Gaik · reported by MITREHigh 10
Buffer overflow in Webby Webserver 1.01 allows remote attackers to execute arbitrary code via a long HTTP GET request.
- Product
- Webby Webserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsecurityfocus.com
Feb 14, 2008The fortimon.sys device driver in Fortinet FortiClient Host Security 3.0 MR5 Patch 3 and earlier does not properly initialize its DeviceExtension, which allows CVE-2008-0779 · Network & remote access · Fortinet · reported by MITREHigh 7.2
The fortimon.sys device driver in Fortinet FortiClient Host Security 3.0 MR5 Patch 3 and earlier does not properly initialize its DeviceExtension, which allows local users to access kernel memory and execute arbitrary code via a crafted request.
- Product
- Forticlient Host Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkc.forticare.comsecunia.com
Feb 11, 2008SQL injection vulnerability in customer_testimonials.php in the Customer Testimonials 3 and 3.1 Addon for osCommerce Online Merchant 2.2 allows remote attackersCVE-2008-0719 · Other software · Oscommerce · reported by MITREHigh 7.5
SQL injection vulnerability in customer_testimonials.php in the Customer Testimonials 3 and 3.1 Addon for osCommerce Online Merchant 2.2 allows remote attackers to execute arbitrary SQL commands via the testimonial_id parameter.
- Product
- Customer Testimonials
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Nov 20, 2006Off-by-one buffer overflow in Dovecot 1.0test53 through 1.0.rc14, and possibly other versions, when index files are used and mmap_disable is set to "yes," allowCVE-2006-5973 · Other software · Timo Sirainen · reported by MITREMedium 5
Off-by-one buffer overflow in Dovecot 1.0test53 through 1.0.rc14, and possibly other versions, when index files are used and mmap_disable is set to "yes," allows remote authenticated IMAP or POP3 users to cause a denial of service (crash) via unspecified vectors involving the cache file.
- Product
- Dovecot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddovecot.orgdovecot.org
Oct 25, 2006Multiple cross-site scripting (XSS) vulnerabilities in Timothy Claason KnowledgeBank 1.01 allow remote attackers to inject arbitrary web script or HTML via unspCVE-2006-5496 · Other software · Timothy Claason · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Timothy Claason KnowledgeBank 1.01 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) index.php, (2) addknowledge.php, and (3) addscreenshot.php.
- Product
- Knowledgebank
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecuritytracker.com
May 16, 2006Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mCVE-2006-2414 · Other software · Timo Sirainen · reported by MITREMedium 5
Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command.
- Product
- Dovecot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddovecot.orgsecunia.com
May 9, 2006Directory traversal vulnerability in Dynamic Galerie 1.0 allows remote attackers to access arbitrary files via an absolute path in the pfad parameter to (1) indCVE-2006-2295 · Other software · Timobraun · reported by MITREHigh 7.5
Directory traversal vulnerability in Dynamic Galerie 1.0 allows remote attackers to access arbitrary files via an absolute path in the pfad parameter to (1) index.php and (2) galerie.php.
- Product
- Dynamic Galerie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordd4igoro.blogspot.comsecunia.com
May 9, 2006Cross-site scripting (XSS) vulnerability in Dynamic Galerie 1.0 allows remote attackers to inject arbitrary web script or HTML via the pfad parameter in (1) indCVE-2006-2294 · Other software · Timobraun · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in Dynamic Galerie 1.0 allows remote attackers to inject arbitrary web script or HTML via the pfad parameter in (1) index.php and (2) galerie.php. NOTE: this issue might be resultant from directory traversal.
- Product
- Dynamic Galerie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordd4igoro.blogspot.comsecunia.com
Feb 16, 2006Multiple unspecified vulnerabilities in Dovecot before 1.0beta3 allow remote attackers to cause a denial of service (application crash or hang) via unspecified CVE-2006-0730 · Other software · Timo Sirainen · reported by MITREMedium 5
Multiple unspecified vulnerabilities in Dovecot before 1.0beta3 allow remote attackers to cause a denial of service (application crash or hang) via unspecified vectors involving (1) "potential hangs" in the APPEND command and "potential crashes" in (2) dovecot-auth and (3) imap/pop3-login. NOTE: vector 2 might be related to a double free vulnerability.
- Product
- Dovecot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comdovecot.org
May 20, 2005Stack-based buffer overflow in the error directive in picasm 1.12b and earlier allows attackers to execute arbitrary code via a long error message.CVE-2005-1679 · Other software · Timo Rossi · reported by MITREMedium 5.1
Stack-based buffer overflow in the error directive in picasm 1.12b and earlier allows attackers to execute arbitrary code via a long error message.
- Product
- Picasm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2001Baltimore Technologies WEBsweeper 4.02, when used to manage URL blacklists, allows remote attackers to bypass blacklist restrictions and connect to unauthorizedCVE-2001-1152 · Other software · Baltimore Technologies · reported by MITREHigh 7.5
Baltimore Technologies WEBsweeper 4.02, when used to manage URL blacklists, allows remote attackers to bypass blacklist restrictions and connect to unauthorized web servers by modifying the requested URL, including (1) a // (double slash), (2) a /SUBDIR/.. where the desired file is in the parentdir, (3) a /./, or (4) URL-encoded characters.
- Product
- Websweeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmimesweeper.comsecurityfocus.com
Aug 12, 2001Baltimore Technologies WEBsweeper 4.0 and 4.02 does not properly filter Javascript from HTML pages, which could allow remote attackers to bypass the filtering vCVE-2001-1157 · Other software · Baltimore Technologies · reported by MITREHigh 7.5
Baltimore Technologies WEBsweeper 4.0 and 4.02 does not properly filter Javascript from HTML pages, which could allow remote attackers to bypass the filtering via (1) an extra leading < and one or more characters before the SCRIPT tag, or (2) tags using Unicode.
- Product
- Websweeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Jun 27, 2001Websweeper 4.0 does not limit the length of certain HTTP headers, which allows remote attackers to cause a denial of service (memory exhaustion) via an extremelCVE-2001-0460 · Other software · Baltimore Technologies · reported by MITREMedium 5
Websweeper 4.0 does not limit the length of certain HTTP headers, which allows remote attackers to cause a denial of service (memory exhaustion) via an extremely large HTTP Referrer: header.
- Product
- Websweeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.