Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,438 results · page 55 of 69
Sep 25, 2018Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerabilCVE-2018-15958 · Websites & servers · Adobe · reported by AdobeCritical 9.8
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
- Product
- ColdFusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Sep 25, 2018Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerabilCVE-2018-15957 · Websites & servers · Adobe · reported by AdobeCritical 9.8
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
- Product
- ColdFusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Sep 12, 2018A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affecCVE-2018-8449 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.3
A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.
- Product
- Windows Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Sep 12, 2018A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input, aka ".NET Framework Remote Code Execution Vulnerability." CVE-2018-8421 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input, aka ".NET Framework Remote Code Execution Vulnerability." This affects Microsoft .NET Framework 4.6, Microsoft .NET Framework 3.5, Microsoft .NET Framework 4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 4.7.2, Microsoft .NET Framework 2.0.
- Product
- Microsoft .NET Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Sep 7, 2018Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc.CVE-2018-0649 · Other software · Canon IT Solutions Inc. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The installers of multiple Canon IT Solutions Inc. software programs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpeset-support.canon-its.jp
Sep 7, 2018Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges via a Trojan horse CVE-2018-0648 · Other software · ChatWork Co,. LTD. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Installer of ChatWork Desktop App for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2018Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkoku 17 Ver.23.1.1 and CVE-2018-0624 · Other software · Yayoi Co., Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkoku 17 Ver.23.1.1 and earlier, Yayoi Kyuuyo 17 Ver.20.1.4 and earlier, Yayoi Kyuuyo Keisan 17 Ver.20.1.4 and earlier, Yayoi Hanbai 17 Series Ver.20.0.2 and earlier, and Yayoi Kokyaku Kanri 17 Ver.11.0.2 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This flaw exists within the handling of ykkapi.dll loaded by the vulnerable products.
- Product
- Multiple Yayoi 17 Series products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2018Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkoku 17 Ver.23.1.1 and CVE-2018-0623 · Other software · Yayoi Co., Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkoku 17 Ver.23.1.1 and earlier, Yayoi Kyuuyo 17 Ver.20.1.4 and earlier, Yayoi Kyuuyo Keisan 17 Ver.20.1.4 and earlier, Yayoi Hanbai 17 Series Ver. 20.0.2 and earlier, and Yayoi Kokyaku Kanri 17 Ver.11.0.2 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This flaw exists within the handling of msjet49.dll loaded by the vulnerable products.
- Product
- Multiple Yayoi 17 Series products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2018sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fCVE-2018-1000671 · Other software · Sympa · reported by MITREMedium 6.1
sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available.
- Product
- Sympa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Sep 4, 2018Untrusted search path vulnerability in The installer of Digital Paper App version 1.4.0.16050 and earlier allows an attacker to gain privileges via a Trojan horCVE-2018-0656 · Other software · Sony Corporation · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in The installer of Digital Paper App version 1.4.0.16050 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The installer of Digital Paper App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpesupport.sony.com
Aug 30, 2018A Deserialization of Untrusted Data Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to escalateCVE-2018-10513 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.8
A Deserialization of Untrusted Data Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit the vulnerability.
- Product
- Trend Micro Security (Consumer)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordesupport.trendmicro.comzerodayinitiative.com
Aug 29, 2018Adobe Acrobat and Reader versions 2018.011.20055 and earlier, 2017.011.30096 and earlier, and 2015.006.30434 and earlier have an untrusted pointer dereference vCVE-2018-12799 · Email & office · Adobe · reported by AdobeHigh 8.8
Adobe Acrobat and Reader versions 2018.011.20055 and earlier, 2017.011.30096 and earlier, and 2015.006.30434 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution.
- Product
- Acrobat DC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Aug 9, 2018Laravel Deserialization of Untrusted Data VulnerabilityCVE-2018-15133 · Other software · Laravel · reported by MITREExploitedHigh 8.1
Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable).
- Product
- Laravel Framework
- On CISA’s list since
- Jan 16, 2024 (federal fix deadline Feb 6, 2024)
- What to do
- Attackers are using this now. Install Laravel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comlaravel.com
Aug 9, 2018It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources.CVE-2018-10908 · Other software · [UNKNOWN] · reported by Red HatMedium 6.5
It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host.
- Product
- vdsm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.nongnu.orgaccess.redhat.com
Jul 26, 2018Untrusted search path vulnerability in LOGICOOL CONNECTION UTILITY SOFTWARE versions before 2.30.9 allows an attacker to gain privileges via a Trojan horse DLL CVE-2018-0621 · Other software · Logicool Co Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in LOGICOOL CONNECTION UTILITY SOFTWARE versions before 2.30.9 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- the installer of LOGICOOL CONNECTION UTILITY SOFTWARE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2018Untrusted search path vulnerability in LOGICOOL Game Software versions before 8.87.116 allows an attacker to gain privileges via a Trojan horse DLL in an unspecCVE-2018-0620 · Other software · Logicool Co Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in LOGICOOL Game Software versions before 8.87.116 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- the installer of LOGICOOL Game Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2018Untrusted search path vulnerability in the installer of Glarysoft Glary Utilities (Glary Utilities 5.99 and earlier and Glary Utilities Pro 5.99 and earlier) alCVE-2018-0619 · Other software · Glarysoft Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installer of Glarysoft Glary Utilities (Glary Utilities 5.99 and earlier and Glary Utilities Pro 5.99 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Installer of Glary Utilities
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2018MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted JavaCVE-2018-1999024 · Other software · Mathjax · reported by MITREMedium 5.4
MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax. This vulnerability appears to have been fixed in 2.7.4 and later.
- Product
- Mathjax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.bentkowski.infogithub.com
Jul 20, 2018Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Untrusted pointer dereference vCVE-2018-5030 · Email & office · Adobe · reported by AdobeHigh 8.8
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
- Product
- Acrobat DC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jul 20, 2018Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Untrusted pointer dereference vCVE-2018-5012 · Email & office · Adobe · reported by AdobeHigh 8.8
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
- Product
- Acrobat DC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jul 14, 2018ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue vaCVE-2018-14055 · Other software · ZNC · reported by MITREMedium 6.5
ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf.
- Product
- ZNC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2018The PHP form code generated by PHP FormMail Generator deserializes untrusted input as part of the phpfmg_filman_download() function.CVE-2016-9483 · Websites & servers · PHP FormMail · reported by cret@cert.orgCritical 9.8
The PHP form code generated by PHP FormMail Generator deserializes untrusted input as part of the phpfmg_filman_download() function. A remote unauthenticated attacker may be able to use this vulnerability to inject PHP code, or along with CVE-2016-9484 to perform local file inclusion attacks and obtain files from the server.
- Product
- Generator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comkb.cert.org
Jul 10, 2018IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5 and 11.1 binaries load shared libraries from an untrusted path potentially givCVE-2018-1487 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.4
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5 and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege users full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 140972.
- Product
- DB2 for Linux, UNIX and Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecuritytracker.com
Jul 9, 2018Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Untrusted pointer dereference vCVE-2018-4987 · Email & office · Adobe · reported by AdobeCritical 9.8
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
- Product
- Acrobat DC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jun 27, 2018In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data.CVE-2017-18342 · Other software · Pyyaml · reported by MITRECritical 9.8
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
- Product
- Pyyaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018Untrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified dirCVE-2018-0609 · Other software · Linecorp · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018Untrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.CVE-2018-0601 · Other software · Yasutaka ATARASHI · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- axpdfium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an attacker to gain privileges via a Trojan CVE-2018-0600 · Other software · Sony Corporation · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- the installer of PlayMemories Home for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsupport.d-imaging.sony.co.jp
Jun 26, 2018Untrusted search path vulnerability in the installer of Visual C++ Redistributable allows an attacker to gain privileges via a Trojan horse DLL in an unspecifieCVE-2018-0599 · Computers, phones & browsers · Microsoft · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installer of Visual C++ Redistributable allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The installer of Visual C++ Redistributable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpblogs.technet.microsoft.com
Jun 26, 2018Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker to gain privileges viCVE-2018-0598 · Computers, phones & browsers · Microsoft · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Self-extracting archive files created by IExpress bundled with Microsoft Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpblogs.technet.microsoft.com
Jun 26, 2018Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directCVE-2018-0597 · Computers, phones & browsers · Microsoft · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The installer of Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Jun 26, 2018Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLL in an unspecified dCVE-2018-0596 · Computers, phones & browsers · Microsoft · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The installer of Visual Studio Community
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Jun 26, 2018Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directoCVE-2018-0595 · Computers, phones & browsers · Microsoft · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The installer of Skype for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Jun 26, 2018Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.CVE-2018-0594 · Computers, phones & browsers · Microsoft · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Skype for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Jun 26, 2018Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directCVE-2018-0593 · Computers, phones & browsers · Microsoft · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The installer of Microsoft OneDrive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Jun 26, 2018Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.CVE-2018-0592 · Computers, phones & browsers · Microsoft · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Microsoft OneDrive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Jun 26, 2018Untrusted search path vulnerability in the installer of FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.13.0 and earlier versions and FLET'S VIRUS CLEAR v6CVE-2018-0563 · Other software · NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installer of FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.13.0 and earlier versions and FLET'S VIRUS CLEAR v6 Easy Setup & Application Tool ver.13.0 and earlier versions allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- the installer of FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.13.0 and earlier versions and FLET'S VIRUS CLEAR v6 Easy Setup & Application Tool ver.13.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2018Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via include/ajax/update_manageCVE-2018-11221 · Other software · Artica · reported by MITRECritical 9.8
Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via include/ajax/update_manager.ajax in the update system.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.hackercat.ninjapandorafms.com
Jun 6, 2018The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.CVE-2017-16138 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
- Product
- mime node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
Jun 6, 2018The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter.CVE-2017-16137 · Other software · HackerOne · reported by support@hackerone.comMedium 5.3
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
- Product
- debug node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2018The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed.CVE-2017-16113 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed.
- Product
- parsejson node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
May 24, 2018In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circumstances CVE-2018-11412 · Computers, phones & browsers · Linux · reported by MITREMedium 5.9
In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated inode.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
May 19, 2018Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityCVE-2018-4939 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.
- Product
- ColdFusion
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsecurityfocus.comhelpx.adobe.com
May 19, 2018Adobe InDesign versions 13.0 and below have an exploitable Untrusted Search Path vulnerability.CVE-2018-4927 · Other software · Adobe · reported by AdobeHigh 7.8
Adobe InDesign versions 13.0 and below have an exploitable Untrusted Search Path vulnerability. Successful exploitation could lead to local privilege escalation.
- Product
- Indesign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comhelpx.adobe.com
May 14, 2018Untrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series (CLIP STUDIO PAINT (for Windows) EX/PRO/DEBUT Ver.1.7.3 and earlier, CLIP STUDIO ACTION (fCVE-2018-0580 · Other software · CELSYS, Inc. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series (CLIP STUDIO PAINT (for Windows) EX/PRO/DEBUT Ver.1.7.3 and earlier, CLIP STUDIO ACTION (for Windows) Ver.1.5.5 and earlier, with its timestamp prior to April 25, 2018, 12:11:31, and CLIP STUDIO MODELER (for Windows) Ver.1.6.3 and earlier, with its timestamp prior to April 25, 2018, 17:02:49) allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- CLIP STUDIO series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2018SAP Identity Management 7.2 and 8.0 do not sufficiently validate an XML document accepted from an untrusted source.CVE-2018-2416 · Network & remote access · SAP · reported by cna@sap.comMedium 5.4
SAP Identity Management 7.2 and 8.0 do not sufficiently validate an XML document accepted from an untrusted source.
- Product
- SAP Identity Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
May 9, 2018Microsoft COM for Windows Deserialization of Untrusted Data VulnerabilityCVE-2018-0824 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script.
- Product
- Windows
- On CISA’s list since
- Aug 5, 2024 (federal fix deadline Aug 26, 2024)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsecurityfocus.comsecuritytracker.com
Apr 16, 2018Untrusted search path vulnerability in Installer of SoundEngine Free ver.5.21 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unsCVE-2018-0562 · Other software · Coderium · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Installer of SoundEngine Free ver.5.21 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Installer of SoundEngine Free
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2018Untrusted search path vulnerability in The installer of PhishWall Client Internet Explorer edition Ver.CVE-2018-0561 · Other software · SecureBrain Corporation · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in The installer of PhishWall Client Internet Explorer edition Ver. 3.7.15 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The installer of PhishWall Client Internet Explorer edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurebrain.co.jp
Apr 13, 2018diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.CVE-2017-0359 · Other software · Debian · reported by security@debian.orgCritical 9.8
diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.
- Product
- diffoscope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgsecurity-tracker.debian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.