Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

3,633 results · page 50 of 73

Sep 13, 2019The Headway theme before 3.8.9 for WordPress has XSS via the license key field.CVE-2016-10953 · WordPress plugins & themes · reported by MITREMedium 5.4
The Headway theme before 3.8.9 for WordPress has XSS via the license key field.
Product
Headway
Fixed in
3.8.9
What to do
Update Headway to 3.8.9 or newer.
Full record and what to do →NVD record wptavern.com wpvulndb.com
Sep 11, 2019An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field.CVE-2019-10074 · Websites & servers · Apache · reported by security@apache.orgCritical 9.8
An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533
Product
OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org s.apache.org
Sep 10, 2019The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter.CVE-2017-18611 · WordPress plugins & themes · reported by MITREMedium 6.1
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter.
Product
magic-fields
Fixed in
1.7.2
What to do
Update magic-fields to 1.7.2 or newer.
Full record and what to do →NVD record sumofpwn.nl wordpress.org
Sep 10, 2019The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter.CVE-2017-18610 · WordPress plugins & themes · reported by MITREMedium 6.1
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter.
Product
magic-fields
Fixed in
1.7.2
What to do
Update magic-fields to 1.7.2 or newer.
Full record and what to do →NVD record sumofpwn.nl wordpress.org
Sep 10, 2019The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.CVE-2017-18609 · WordPress plugins & themes · reported by MITREMedium 6.1
The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.
Product
magic-fields
Fixed in
1.7.2
What to do
Update magic-fields to 1.7.2 or newer.
Full record and what to do →NVD record sumofpwn.nl wordpress.org
Sep 10, 2019The examapp plugin 1.0 for WordPress has XSS via exam input text fields.CVE-2017-18601 · WordPress plugins & themes · reported by MITREMedium 5.4
The examapp plugin 1.0 for WordPress has XSS via exam input text fields.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 10, 2019The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.CVE-2017-18600 · WordPress plugins & themes · reported by MITREMedium 5.4
The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.
Product
formcraft3
Fixed in
3.4
What to do
Update formcraft3 to 3.4 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 9, 2019In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field,CVE-2019-16168 · Other software · Siemens · reported by MITREMedium 6.5
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
Product
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Sep 8, 2019YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.CVE-2019-16130 · Other software · Hgw168cc · reported by MITREMedium 6.1
YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.
Product
Yii-cms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record iwantacve.cn github.com
Sep 5, 2019Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length field is directly used for a memcpy.CVE-2019-15938 · Other software · Pengutronix · reported by MITRECritical 9.8
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length field is directly used for a memcpy.
Product
Barebox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.pengutronix.de git.pengutronix.de
Sep 5, 2019Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length field is directly used for a memcpy.CVE-2019-15937 · Other software · Pengutronix · reported by MITRECritical 9.8
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length field is directly used for a memcpy.
Product
Barebox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.pengutronix.de git.pengutronix.de
Sep 3, 2019The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.CVE-2019-15870 · WordPress plugins & themes · reported by MITREMedium 5.4
The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.
Product
CarSpot
Fixed in
2.1.7
What to do
Update CarSpot to 2.1.7 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.CVE-2019-15826 · WordPress plugins & themes · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.
Product
wps-hide-login
Fixed in
1.5.3
What to do
Update wps-hide-login to 1.5.3 or newer.
Full record and what to do →NVD record secupress.me wordpress.org
Aug 28, 2019In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page.CVE-2019-13189 · Other software · ENG · reported by MITREMedium 6.1
In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page.
Product
Knowage
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.contentsecurity.com.au blog.contentsecurity.com.au
Aug 23, 2019Bolt before 3.6.10 has XSS via an image's alt or title field.CVE-2019-15484 · Other software · Boltcms · reported by MITREMedium 6.1
Bolt before 3.6.10 has XSS via an image's alt or title field.
Product
Bolt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 23, 2019selectize-plugin-a11y before 1.1.0 has XSS via the msg field.CVE-2019-15482 · Other software · Selectize-plugin-a11y Project · reported by MITREMedium 6.1
selectize-plugin-a11y before 1.1.0 has XSS via the msg field.
Product
Selectize-plugin-a11y
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com npmjs.com
Aug 22, 2019The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.CVE-2018-20986 · WordPress plugins & themes · reported by MITREMedium 5.4
The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.
Product
advanced-custom-fields (aka Elliot Condon Advanced Custom Fields)
Fixed in
5.7.8
What to do
Update advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) to 5.7.8 or newer.
Full record and what to do →NVD record wordpress.org advancedcustomfields.com
Aug 22, 2019The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.CVE-2019-15318 · WordPress plugins & themes · reported by MITRECritical 9.8
The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.
Product
yikes-inc-easy-mailchimp-extender
Fixed in
6.5.3
What to do
Update yikes-inc-easy-mailchimp-extender to 6.5.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.CVE-2013-7479 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
Product
events-manager
Fixed in
5.3.9
What to do
Update events-manager to 5.3.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.CVE-2017-18563 · WordPress plugins & themes · reported by MITREMedium 6.1
The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.
Product
rsvp
Fixed in
2.3.8
What to do
Update rsvp to 2.3.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.CVE-2019-15238 · WordPress plugins & themes · reported by MITREHigh 8.8
The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.
Product
cforms2
Fixed in
15.0.2
What to do
Update cforms2 to 15.0.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 17, 2019In GIFLIB before 2019-02-16, a malformed GIF file triggers a divide-by-zero exception in the decoder function DGifSlurp in dgif_lib.c if the height field of theCVE-2019-15133 · Other software · Giflib Project · reported by MITREMedium 6.5
In GIFLIB before 2019-02-16, a malformed GIF file triggers a divide-by-zero exception in the decoder function DGifSlurp in dgif_lib.c if the height field of the ImageSize data structure is equal to zero.
Product
Giflib
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.chromium.org lists.debian.org
Aug 16, 2019EyesOfNetwork 5.1 allows Remote Command Execution via shell metacharacters in the module/tool_all/ host field.CVE-2019-14923 · Other software · Eyesofnetwork · reported by MITREHigh 8.8
EyesOfNetwork 5.1 allows Remote Command Execution via shell metacharacters in the module/tool_all/ host field.
Product
Eyesofnetwork
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com eyesofnetwork.com
Aug 15, 2019In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross ProtocoCVE-2018-14668 · Other software · Clickhouse · reported by browser-security@yandex-team.ruHigh 8.8
In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery Attacks.
Product
Clickhouse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record clickhouse.yandex clickhouse.yandex
Aug 15, 2019CMS Clipper 1.3.3 has XSS in the Security tab search, User Groups, Resource Groups, and User/Resource Group Links fields.CVE-2018-12101 · Other software · Clippercms · reported by MITREMedium 5.4
CMS Clipper 1.3.3 has XSS in the Security tab search, User Groups, Resource Groups, and User/Resource Group Links fields.
Product
Clippercms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 14, 2019The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.CVE-2013-7476 · WordPress plugins & themes · reported by MITREHigh 8.8
The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.
Product
simple-fields
Fixed in
1.2
What to do
Update simple-fields to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The simple-fields plugin before 1.4.11 for WordPress has XSS.CVE-2015-9302 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-fields plugin before 1.4.11 for WordPress has XSS.
Product
simple-fields
Fixed in
1.4.11
What to do
Update simple-fields to 1.4.11 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 13, 2019Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked.CVE-2019-13419 · Other software · floragunn · reported by security@search-guard.comHigh 7.5
Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked.
Product
Search Guard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.search-guard.com search-guard.com
Aug 12, 2019Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user wCVE-2019-13417 · Other software · floragunn · reported by security@search-guard.comMedium 5.3
Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user when field level security (FLS) is activated.
Product
Search Guard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.search-guard.com search-guard.com
Aug 9, 2019In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/specials/MobileSpecialPageFeed.php.CVE-2019-14807 · Other software · Mediawiki · reported by MITREMedium 6.1
In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/specials/MobileSpecialPageFeed.php.
Product
Mobilefrontend
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gerrit.wikimedia.org phabricator.wikimedia.org
Aug 9, 2019studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing.CVE-2019-14805 · Other software · UNA · reported by MITREMedium 4.8
studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing.
Product
UNA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com pastebin.com
Aug 9, 2019studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing.CVE-2019-14804 · Other software · UNA · reported by MITREMedium 4.8
studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing.
Product
UNA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Aug 8, 2019The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.CVE-2018-20962 · Other software · Backpackforlaravel · reported by MITREMedium 6.1
The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.
Product
Backpack\crud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 8, 2019A vulnerability in the web interface of Cisco IoT Field Network Director could allow an unauthenticated, remote attacker to trigger high CPU usage, resulting inCVE-2019-1957 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the web interface of Cisco IoT Field Network Director could allow an unauthenticated, remote attacker to trigger high CPU usage, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of Transport Layer Security (TLS) renegotiation requests. An attacker could exploit this vulnerability by sending renegotiation requests at a high rate. A successful exploit could increase the resource usage on the system, eventually leading to a DoS condition.
Product
Cisco IoT Field Network Director (IoT-FND)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Aug 7, 2019A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields rendCVE-2019-10374 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields rendered using the configured markup formatter to insert links with the javascript scheme into the Jenkins UI.
Product
Jenkins PegDown Formatter Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Aug 5, 2019Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field.CVE-2019-14672 · Other software · Firefly-iii · reported by MITREMedium 5.4
Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show page.
Product
Firefly III
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 5, 2019Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field.CVE-2019-14670 · Other software · Firefly-iii · reported by MITREMedium 5.4
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation.
Product
Firefly III
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 5, 2019Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field.CVE-2019-14668 · Other software · Firefly-iii · reported by MITREMedium 5.4
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during deletion of a transaction link.
Product
Firefly III
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 5, 2019Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and thCVE-2019-14667 · Other software · Firefly-iii · reported by MITREMedium 6.1
Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action.
Product
Firefly III
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 4, 2019In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated oCVE-2019-14654 · Websites & servers · Joomla · reported by MITREHigh 8.8
In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Aug 2, 2019A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2CVE-2019-7944 · Websites & servers · Magento · reported by AdobeMedium 5.4
A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the Return Product comments field can inject malicious javascript.
Product
Magento
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record magento.com magento.com
Aug 1, 2019GnuCOBOL 2.2 has a buffer overflow in cb_evaluate_expr in cobc/field.c via crafted COBOL source code.CVE-2019-14486 · Other software · Gnucobol Project · reported by MITREHigh 7.8
GnuCOBOL 2.2 has a buffer overflow in cb_evaluate_expr in cobc/field.c via crafted COBOL source code.
Product
Gnucobol
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sourceforge.net sourceforge.net
Aug 1, 2019On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP address field for the "CVE-2019-14259 · Other software · Polycom · reported by MITREHigh 8
On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP address field for the "Time Service Settings web" interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.
Product
Obihai Obi1022 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sit.fraunhofer.de sit.fraunhofer.de
Aug 1, 2019GnuCOBOL 2.2 has a buffer overflow in cb_push_op in cobc/field.c via crafted COBOL source code.CVE-2019-14468 · Other software · Gnucobol Project · reported by MITREHigh 7.8
GnuCOBOL 2.2 has a buffer overflow in cb_push_op in cobc/field.c via crafted COBOL source code.
Product
Gnucobol
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sourceforge.net sourceforge.net
Jul 30, 2019A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm CVE-2019-10153 · Other software · ClusterLabs · reported by Red HatMedium 5
A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm to exit with an exception. In cluster environments, this could lead to preventing automated recovery or otherwise denying service to clusters of which that VM is a member.
Product
fence-agents
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Jul 30, 2019cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).CVE-2018-20865 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 27, 2019Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Description(config) field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx.CVE-2019-14298 · Other software · Veeam · reported by MITREMedium 5.4
Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Description(config) field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx.
Product
ONE Reporter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jul 27, 2019Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx.CVE-2019-14297 · Other software · Veeam · reported by MITREMedium 5.4
Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx.
Product
ONE Reporter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jul 26, 2019In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and CVE-2019-14283 · Computers, phones & browsers · Linux · reported by MITREMedium 6.8
In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Jul 23, 2019Vulnerability in the Oracle Field Service component of Oracle E-Business Suite (subcomponent: Wireless).CVE-2019-2828 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.6
Vulnerability in the Oracle Field Service component of Oracle E-Business Suite (subcomponent: Wireless). Supported versions that are affected are 12.1.1 - 12.1.3 and 12.2.3 - 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Field Service. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Field Service, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Field Service. CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
Product
Field Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.