Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

578new WordPress flaws this week

391,397entries in the database

3,401 results · page 53 of 69

Aug 22, 2019The cforms2 plugin before 10.2 for WordPress has XSS.CVE-2014-10392 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 10.2 for WordPress has XSS.
Product
cforms2
Fixed in
10.2
What to do
Update cforms2 to 10.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.CVE-2018-20981 · WordPress plugins & themes · reported by MITRECritical 9.1
The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.
Product
ninja-forms
Fixed in
3.3.9
What to do
Update ninja-forms to 3.3.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.CVE-2018-20980 · WordPress plugins & themes · reported by MITREHigh 7.5
The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.
Product
ninja-forms
Fixed in
3.2.15
What to do
Update ninja-forms to 3.2.15 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.CVE-2017-18574 · WordPress plugins & themes · reported by MITREMedium 6.1
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
Product
ninja-forms
Fixed in
3.0.31
What to do
Update ninja-forms to 3.0.31 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.CVE-2017-18570 · WordPress plugins & themes · reported by MITRECritical 9.8
The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.
Product
cforms2
Fixed in
14.13
What to do
Update cforms2 to 14.13 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The cforms2 plugin before 14.6.10 for WordPress has SQL injection.CVE-2015-9333 · WordPress plugins & themes · reported by MITRECritical 9.8
The cforms2 plugin before 14.6.10 for WordPress has SQL injection.
Product
cforms2
Fixed in
14.6.10
What to do
Update cforms2 to 14.6.10 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logCVE-2019-5638 · Other software · Rapid7 · reported by cve@rapid7.comHigh 8.7
Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage.
Product
Nexpose
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.rapid7.com help.rapid7.com
Aug 21, 2019The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.CVE-2017-18559 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.
Product
cforms2
Fixed in
14.13.3
What to do
Update cforms2 to 14.13.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.CVE-2014-10377 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.
Product
cforms2
Fixed in
13.2
What to do
Update cforms2 to 13.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 21, 2019The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.CVE-2014-10380 · WordPress plugins & themes · reported by MITREMedium 6.1
The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.
Product
profile-builder
Fixed in
1.1.66
What to do
Update profile-builder to 1.1.66 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.CVE-2016-10903 · WordPress plugins & themes · reported by MITREHigh 8.8
The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.
Product
GoDaddy godaddy-email-marketing-sign-up-forms
Fixed in
1.1.3
What to do
Update GoDaddy godaddy-email-marketing-sign-up-forms to 1.1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new foCVE-2019-3968 · Other software · Open-emr · reported by vulnreport@tenable.comHigh 8.8
In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form.
Product
Openemr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
Aug 20, 2019The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.CVE-2019-15238 · WordPress plugins & themes · reported by MITREHigh 8.8
The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.
Product
cforms2
Fixed in
15.0.2
What to do
Update cforms2 to 15.0.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 16, 2019The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.CVE-2017-18547 · WordPress plugins & themes · reported by MITREHigh 8.8
The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.
Product
nelio-ab-testing
Fixed in
4.6.4
What to do
Update nelio-ab-testing to 4.6.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019Nessus 8.5.2 and earlier on Windows platforms were found to contain an issue where certain system files could be overwritten arbitrarily, potentially creating aCVE-2019-3974 · Other software · Tenable · reported by vulnreport@tenable.comHigh 8.1
Nessus 8.5.2 and earlier on Windows platforms were found to contain an issue where certain system files could be overwritten arbitrarily, potentially creating a denial of service condition.
Product
Nessus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
Aug 14, 2019The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.CVE-2019-15025 · WordPress plugins & themes · reported by MITRECritical 9.8
The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.
Product
ninja-forms
Fixed in
3.3.21.2
What to do
Update ninja-forms to 3.3.21.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019In Joomla! before 3.9.11, inadequate checks in com_contact could allow mail submission in disabled forms.CVE-2019-15028 · Websites & servers · Joomla · reported by MITREMedium 5.3
In Joomla! before 3.9.11, inadequate checks in com_contact could allow mail submission in disabled forms.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Aug 13, 2019The liveforms plugin before 3.4.0 for WordPress has XSS.CVE-2017-18497 · WordPress plugins & themes · reported by MITREMedium 6.1
The liveforms plugin before 3.4.0 for WordPress has XSS.
Product
liveforms
Fixed in
3.4.0
What to do
Update liveforms to 3.4.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.CVE-2017-18495 · WordPress plugins & themes · reported by MITREMedium 6.1
The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.
Product
gravity-forms-sms-notifications
Fixed in
2.4.0
What to do
Update gravity-forms-sms-notifications to 2.4.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The liveforms plugin before 3.2.0 for WordPress has SQL injection.CVE-2015-9301 · WordPress plugins & themes · reported by MITRECritical 9.8
The liveforms plugin before 3.2.0 for WordPress has SQL injection.
Product
liveforms
Fixed in
3.2.0
What to do
Update liveforms to 3.2.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 5, 2019Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability.CVE-2019-3717 · Other software · Dell · reported by security_alert@emc.comMedium 6.8
Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability. An unauthenticated attacker with physical access to the system could potentially bypass intended Secure Boot restrictions to run unsigned and untrusted code on expansion cards installed in the system during platform boot. Refer to https://www.dell.com/support/article/us/en/04/sln317683/dsa-2019-043-dell-client-improper-access-control-vulnerability?lang=en for versions affected by this vulnerability.
Product
Dell Client Commercial and Consumer platforms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Aug 2, 2019OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.CVE-2019-14529 · Other software · Open-emr · reported by MITRECritical 9.8
OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.
Product
Openemr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 30, 2019cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366).CVE-2018-20862 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 18, 2019A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9.CVE-2019-13575 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/evf-entry-functions.php
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fortiguard.com github.com
Jul 10, 2019CSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an attacker to submit POST requests to any forms in the web applicatioCVE-2019-13071 · Other software · Cyberpowersystems · reported by MITREHigh 8.8
CSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an attacker to submit POST requests to any forms in the web application. This can be exploited by tricking an authenticated user into visiting an attacker controlled web page.
Product
Powerpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jul 4, 2019Stormshield Network Security 2.0.0 through 2.13.0 and 3.0.0 through 3.7.1 has self-XSS in the command line interface of the SNS web server.CVE-2018-20850 · Other software · Stormshield · reported by MITREHigh 8.2
Stormshield Network Security 2.0.0 through 2.13.0 and 3.0.0 through 3.7.1 has self-XSS in the command line interface of the SNS web server.
Product
Stormshield Network Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.stormshield.eu advisories.stormshield.eu
Jun 27, 2019A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly CVE-2019-10177 · Other software · Red Hat · reported by Red HatMedium 6.5
A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.
Product
CloudForms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugzilla.redhat.com
Jun 19, 2019A vulnerability in the internal packet-processing functionality of the Cisco StarOS operating system running on virtual platforms could allow an unauthenticatedCVE-2019-1869 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in the internal packet-processing functionality of the Cisco StarOS operating system running on virtual platforms could allow an unauthenticated, remote attacker to cause an affected device to stop processing traffic, resulting in a denial of service (DoS) condition. The vulnerability is due to a logic error that may occur under specific traffic conditions. An attacker could exploit this vulnerability by sending a series of crafted packets to an affected device. A successful exploit could allow the attacker to prevent the targeted service interface from receiving any traffic, which would lead to a DoS condition on the affected interface. The device may have to be manually reloaded to recover from exploitation of this vulnerability.
Product
Cisco ASR 5000 Series Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com tools.cisco.com
Jun 12, 2019A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only.CVE-2017-15123 · Other software · redhat · reported by Red HatMedium 5.3
A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines.
Product
CloudForms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugzilla.redhat.com
Jun 10, 2019A vulnerability exists in Rancher before 2.2.4 in the login component, where the errorMsg parameter can be tampered to display arbitrary content, filtering tagsCVE-2019-11881 · Other software · Suse · reported by MITREMedium 4.7
A vulnerability exists in Rancher before 2.2.4 in the login component, where the errorMsg parameter can be tampered to display arbitrary content, filtering tags but not special characters or symbols. There's no other limitation of the message, allowing malicious users to lure legitimate users to visit phishing sites with scare tactics, e.g., displaying a "This version of Rancher is outdated, please visit https://malicious.rancher.site/upgrading" message.
Product
Rancher
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 3, 2019An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel through 5.1.6.CVE-2019-12614 · Computers, phones & browsers · Linux · reported by MITREMedium 4.1
An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
May 29, 2019Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability.CVE-2019-7129 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
Product
Adobe Experience Manager Forms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com helpx.adobe.com
May 14, 2019WhatsApp VOIP Stack Buffer Overflow VulnerabilityCVE-2019-3568 · Other software · Meta Platforms · reported by cve-assign@fb.comExploitedCritical 9.8
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.
Product
WhatsApp
On CISA’s list since
Apr 19, 2022 (federal fix deadline May 10, 2022)
What to do
Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com facebook.com
May 7, 2019Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated).CVE-2019-10869 · WordPress plugins & themes · reported by MITREHigh 8.1
Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.
Product
Path Traversal and Unrestricted File Upload exists in the Ninja Forms
Fixed in
3.0.23
What to do
Update Path Traversal and Unrestricted File Upload exists in the Ninja Forms to 3.0.23 or newer.
Full record and what to do →NVD record wpscan.com wpvulndb.com
Apr 23, 2019Vulnerability in the PeopleSoft Enterprise HRMS component of Oracle PeopleSoft Products (subcomponent: Candidate Gateway).CVE-2019-2591 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the PeopleSoft Enterprise HRMS component of Oracle PeopleSoft Products (subcomponent: Candidate Gateway). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise HRMS. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise HRMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HRMS accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise HRMS accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Product
PeopleSoft Enterprise HCM Candidate Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Apr 22, 2019All versions of unity-scope-gdrive logs search terms to syslog.CVE-2015-1343 · Other software · Ubuntu · reported by security@ubuntu.comLow 2
All versions of unity-scope-gdrive logs search terms to syslog.
Product
unity-scope-gdrive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.launchpad.net bugs.launchpad.net
Apr 10, 2019When configuring a stateless firewall filter in Junos OS, terms named using the format "internal-n" (e.g.CVE-2019-0036 · Network & remote access · Juniper Networks · reported by sirt@juniper.netCritical 9.8
When configuring a stateless firewall filter in Junos OS, terms named using the format "internal-n" (e.g. "internal-1", "internal-2", etc.) are silently ignored. No warning is issued during configuration, and the config is committed without error, but the filter criteria will match all packets leading to unexpected results. Affected releases are Juniper Networks Junos OS: All versions prior to and including 12.3; 14.1X53 versions prior to 14.1X53-D130, 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S4; 15.1X49 versions prior to 15.1X49-D161, 15.1X49-D170; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D496, 15.1X53-D69; 16.1 versions prior to 16.1R7-S4, 16.1R7-S5; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S4; 17.4 versions prior to 17.4R1-S7, 17.4R2-S3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S4; 18.2 versions prior to 18.2R1-S5, 18.2R2-S1; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3; 18.4 versions prior to 18.4R1-S1, 18.4R1-S2.
Product
Junos OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.juniper.net kb.juniper.net
Mar 25, 2019A Reflected Cross Site Scripting (XSS) vulnerability exists in Adrenalin HRMS 5.4.0.CVE-2018-12653 · Other software · Myadrenalin · reported by MITREMedium 6.1
A Reflected Cross Site Scripting (XSS) vulnerability exists in Adrenalin HRMS 5.4.0. An attacker can input malicious JavaScript code in /RPT/SSRSDynamicEditReports.aspx via 'ReportId' parameter.
Product
Adrenalin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com knowcybersec.com
Mar 25, 2019A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS Software.CVE-2018-12652 · Other software · Myadrenalin · reported by MITREMedium 6.1
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS Software. The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the LeaveEmployeeSearch.aspx prntFrmName or prntDDLCntrlName parameter.
Product
Adrenalin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record knowcybersec.com securethy.com
Mar 21, 2019BMC Remedy Mid-Tier 7.1.00 and 9.1.02.003 for BMC Remedy AR System has Incorrect Access Control in ITAM forms, as demonstrated by TLS%3APLR-Configuration+DetailCVE-2018-18862 · Other software · BMC · reported by MITREHigh 8.8
BMC Remedy Mid-Tier 7.1.00 and 9.1.02.003 for BMC Remedy AR System has Incorrect Access Control in ITAM forms, as demonstrated by TLS%3APLR-Configuration+Details/Default+Admin+View/, AST%3AARServerConnection/Default+Admin+View/, and AR+System+Administration%3A+Server+Information/Default+Admin+View/.
Product
Remedy Action Request System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Mar 21, 2019An issue was discovered in Repute ARForms 3.5.1 and prior.CVE-2018-15818 · Other software · Reputeinfosystems · reported by MITREHigh 7.5
An issue was discovered in Repute ARForms 3.5.1 and prior. An attacker is able to delete any file on the server with web server privileges by sending a malicious request to admin-ajax.php.
Product
Repute Arforms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Mar 12, 2019Smart Forms 2.6.15 and earlier: Cross-site request forgery (CSRF)CVE-2019-5924 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page.
Product
Smart Forms 2.6.15 and earlier
Affected
up to 2.6.15
What to do
Affects up to 2.6.15. Update Smart Forms 2.6.15 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Mar 12, 2019Banking services from SAP 9.0 (FSAPPL version 5) and SAP S/4HANA Financial Products Subledger (S4FPSL, version 1) performs an inadequate authorization check forCVE-2019-0276 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
Banking services from SAP 9.0 (FSAPPL version 5) and SAP S/4HANA Financial Products Subledger (S4FPSL, version 1) performs an inadequate authorization check for an authenticated user, potentially resulting in escalation of privileges.
Product
Banking services from SAP 9.0 (FSAPPL)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com launchpad.support.sap.com
Feb 25, 2019DLL hijacking is possible in Sublime Text 3 version 3.1.1 build 3176 on 32-bit Windows platforms because a Trojan horse api-ms-win-core-fibers-l1-1-1.dll or apiCVE-2019-9116 · Other software · Sublimetext · reported by MITREHigh 7.8
DLL hijacking is possible in Sublime Text 3 version 3.1.1 build 3176 on 32-bit Windows platforms because a Trojan horse api-ms-win-core-fibers-l1-1-1.dll or api-ms-win-core-localization-l1-2-1.dll file may be loaded if a victim uses sublime_text.exe to open a .txt file within an attacker's %LOCALAPPDATA%\Temp\sublime_text folder. NOTE: the vendor's position is "This does not appear to be a bug with Sublime Text, but rather one with Windows that has been patched.
Product
Sublime Text 3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 20, 2019A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with OveralCVE-2019-1003024 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Product
Jenkins Script Security Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com access.redhat.com
Feb 17, 2019ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter.CVE-2019-8429 · Other software · Zoneminder · reported by MITRECritical 9.8
ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter.
Product
Zoneminder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com seebug.org
Feb 17, 2019ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.CVE-2019-8423 · Other software · Zoneminder · reported by MITRECritical 9.8
ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.
Product
Zoneminder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com seebug.org
Feb 16, 2019Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages.CVE-2019-7399 · Other software · Amazon · reported by MITREHigh 7.4
Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages.
Product
Fire OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com wwws.nightwatchcybersecurity.com
Feb 1, 2019kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases oCVE-2019-7308 · Computers, phones & browsers · Linux · reported by MITREMedium 5.6
kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jan 28, 2019Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability.CVE-2018-19724 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
Product
Adobe Experience Manager Forms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com helpx.adobe.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.