Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,689 results · page 57 of 114
Jan 10, 2022Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page.CVE-2021-46166 · Email & office · Zohocorp · reported by MITREMedium 6.5
Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jan 10, 2022Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly CVE-2021-46165 · Email & office · Zohocorp · reported by MITREHigh 7.8
Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly defined.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jan 10, 2022Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Reports module.CVE-2021-46164 · Email & office · Zohocorp · reported by MITREHigh 8.8
Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Reports module.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jan 4, 2022Latte is an open source template engine for PHP.CVE-2022-21648 · Other software · nette · reported by GitHubHigh 8.2
Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.
- Product
- latte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2022ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on tCVE-2021-20148 · Email & office · Zohocorp · reported by vulnreport@tenable.comMedium 4.3
ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another domain by authenticating to the service and then sending a request specifying the password policy file of the other domain.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 3, 2022ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI.CVE-2021-20147 · Email & office · Zohocorp · reported by vulnreport@tenable.comMedium 5.3
ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 3, 2022WP Travel Engine: Does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pagesCVE-2021-24680 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed
- Product
- WP Travel Engine
- Fixed in
- 5.3.1
- What to do
- Update WP Travel Engine to 5.3.1 or newer.
Dec 26, 2021An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5.CVE-2021-44078 · Other software · Unicorn-engine · reported by MITREHigh 8.1
An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5. It allows local attackers to escape the sandbox. An attacker must first obtain the ability to execute crafted code in the target sandbox in order to exploit this vulnerability. The specific flaw exists within the virtual memory manager. The issue results from the faulty comparison of GVA and GPA while calling uc_mem_map_ptr to free part of a claimed memory block. An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code on the host machine.
- Product
- Unicorn Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 23, 2021Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations.CVE-2021-44526 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Dec 23, 2021e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine.CVE-2021-44273 · Other software · E2bn · reported by MITREHigh 7.4
e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transparent proxy), with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers that it connected to, and thus was itself vulnerable to MITM attacks.
- Product
- E2guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Dec 22, 2021A vulnerability affecting F-Secure antivirus engine was discovered whereby scanning MS outlook .pst files can lead to denial-of-service.CVE-2021-40836 · Other software · F-Secure · reported by cve-notifications-us@f-secure.comMedium 4.6
A vulnerability affecting F-Secure antivirus engine was discovered whereby scanning MS outlook .pst files can lead to denial-of-service. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine.
- Product
- F-Secure endpoint protection products on Windows and Mac. F-Secure Linux Security (32-bit) F-Secure Linux Security 64 F-Secure Atlant & F-Secure Internet Gate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordf-secure.comf-secure.com
Dec 20, 2021In sourcecodetester Engineers Online Portal as of 10-21-21, an attacker can manipulate the Host header as seen by the web application and cause the application CVE-2021-43437 · Other software · Engineers Online Portal Project · reported by MITREHigh 8.8
In sourcecodetester Engineers Online Portal as of 10-21-21, an attacker can manipulate the Host header as seen by the web application and cause the application to behave in unexpected ways. Very often multiple websites are hosted on the same IP address. This is where the Host Header comes in. This header specifies which website should process the HTTP request. The web server uses the value of this header to dispatch the request to the specified website. Each website hosted on the same IP address is called a virtual host. And It's possible to send requests with arbitrary Host Headers to the first virtual host.
- Product
- Engineers Online Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comportswigger.net
Dec 20, 2021Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is nCVE-2021-44525 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is not required.
- Product
- Manageengine Pam360
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.compitstop.manageengine.com
Dec 20, 2021Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements (e.g., access control details) and modify a few aspects of the appliCVE-2021-44676 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements (e.g., access control details) and modify a few aspects of the application state.
- Product
- Manageengine Access Manager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.commanageengine.com
Dec 20, 2021Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authenticaCVE-2021-44675 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentication is not required.
- Product
- Manageengine Servicedesk Plus MSP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.compitstop.manageengine.com
Dec 17, 2021SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the command line arguments to pass in any value to the Emulator executable.CVE-2021-32499 · Other software · Sick · reported by psirt@sick.deHigh 7.5
SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the command line arguments to pass in any value to the Emulator executable.
- Product
- Sopas Engineering Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2021SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the pathname of the emulator and use path traversal to run an arbitrary executable located on CVE-2021-32498 · Other software · Sick · reported by psirt@sick.deHigh 8.6
SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the pathname of the emulator and use path traversal to run an arbitrary executable located on the host system. When the user starts the emulator from SOPAS ET the corresponding executable will be started instead of the emulator
- Product
- Sopas Engineering Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2021SICK SOPAS ET before version 4.8.0 allows attackers to wrap any executable file into an SDD and provide this to a SOPAS ET user.CVE-2021-32497 · Other software · Sick · reported by psirt@sick.deHigh 8.6
SICK SOPAS ET before version 4.8.0 allows attackers to wrap any executable file into an SDD and provide this to a SOPAS ET user. When a user starts the emulator the executable is run without further checks.
- Product
- Sopas Engineering Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2021A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance granCVE-2021-36780 · Other software · SUSE · reported by meissner@suse.deHigh 8.1
A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance granting it the ability to read and write data to and from a replica that they should not have access to. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3v.
- Product
- Longhorn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Dec 16, 2021The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requires social engineerCVE-2021-45099 · Other software · SSH & Web Terminal Project · reported by MITREHigh 8.8
The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against complex social engineering situations
- Product
- SSH & Web Terminal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 15, 2021In WT_Interpolate of eas_wtengine.c, there is a possible out of bounds read due to a missing bounds check.CVE-2021-1002 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In WT_Interpolate of eas_wtengine.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-194533433
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 15, 2021In WT_InterpolateNoLoop of eas_wtengine.c, there is a possible out of bounds read due to an incorrect bounds check.CVE-2021-0650 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.5
In WT_InterpolateNoLoop of eas_wtengine.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-190286685
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 15, 2021Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege VulnerabilityCVE-2021-42293 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege Vulnerability
- Product
- Microsoft Office LTSC 2021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Dec 15, 2021Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data.CVE-2021-41844 · Other software · Crocoblock · reported by MITRECritical 9.8
Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data.
- Product
- Jetengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcrocoblock.comcrocoblock.com
Dec 13, 2021Sourcegraph is a code search and navigation engine.CVE-2021-43823 · Other software · sourcegraph · reported by GitHubMedium 6.5
Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.33.2 is vulnerable to a side-channel attack where strings in private source code could be guessed by an authenticated but unauthorized actor. This issue affects the Saved Searches and Code Monitoring features. A successful attack would require an authenticated bad actor to create many Saved Searches or Code Monitors to receive confirmation that a specific string exists. This could allow an attacker to guess formatted tokens in source code, such as API keys. This issue was patched in version 3.33.2 and any future versions of Sourcegraph. We strongly encourage upgrading to secure versions. If you are unable to, you may disable Saved Searches and Code Monitors.
- Product
- sourcegraph
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2021Rizin is a UNIX-like reverse engineering framework and command-line toolset.CVE-2021-43814 · Other software · rizinorg · reported by GitHubHigh 7.7
Rizin is a UNIX-like reverse engineering framework and command-line toolset. In versions up to and including 0.3.1 there is a heap-based out of bounds write in parse_die() when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF binary is opened by a victim user, Rizin may crash or execute unintended actions. No workaround are known and users are advised to upgrade.
- Product
- rizin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2021There is a memory leak vulnerability in CloudEngine 12800 V200R019C00SPC800, CloudEngine 5800 V200R019C00SPC800, CloudEngine 6800 V200R019C00SPC800 and CloudEngCVE-2021-40008 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a memory leak vulnerability in CloudEngine 12800 V200R019C00SPC800, CloudEngine 5800 V200R019C00SPC800, CloudEngine 6800 V200R019C00SPC800 and CloudEngine 7800 V200R019C00SPC800. The software does not sufficiently track and release allocated memory while parse a series of crafted binary messages, which could consume remaining memory. Successful exploit could cause memory exhaust.
- Product
- Cloudengine 7800 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2021Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or CVE-2021-36911 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or higher role.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Dec 9, 2021OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories.CVE-2021-44514 · Email & office · Zohocorp · reported by MITRECritical 9.8
OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories.
- Product
- Manageengine Opmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Dec 8, 2021A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve the key by reverse engineering.CVE-2021-26108 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.5
A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve the key by reverse engineering.
- Product
- Fortinet FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Nov 30, 2021Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality.CVE-2021-43319 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality.
- Product
- Manageengine Network Configuration Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Nov 30, 2021Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor.CVE-2021-43296 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor.
- Product
- Manageengine Supportcenter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Nov 30, 2021Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module.CVE-2021-43295 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module.
- Product
- Manageengine Supportcenter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Nov 30, 2021Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module.CVE-2021-43294 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module.
- Product
- Manageengine Supportcenter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Nov 30, 2021Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution.CVE-2021-42099 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution.
- Product
- Manageengine M365 Manager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Nov 28, 2021Zoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityCVE-2021-44077 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution
- Product
- ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
- On CISA’s list since
- Dec 1, 2021 (federal fix deadline Dec 15, 2021)
- What to do
- Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compitstop.manageengine.com
Nov 26, 2021A vulnerability affecting F-Secure antivirus engine was discovered whereby unpacking UPX file can lead to denial-of-service.CVE-2021-40833 · Other software · F-Secure · reported by cve-notifications-us@f-secure.comMedium 5.5
A vulnerability affecting F-Secure antivirus engine was discovered whereby unpacking UPX file can lead to denial-of-service. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine.
- Product
- F-Secure endpoint protection products on Windows and Mac. F-Secure Linux Security (32-bit) F-Secure Linux Security 64 F-Secure Internet Gatekeeper & F-Secure A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordf-secure.comf-secure.com
Nov 23, 2021There is a privilege escalation vulnerability in CloudEngine 5800 V200R020C00SPC600.CVE-2021-39976 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
There is a privilege escalation vulnerability in CloudEngine 5800 V200R020C00SPC600. Due to lack of privilege restrictions, an authenticated local attacker can perform specific operation to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege.
- Product
- Cloudengine 5800 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Improper authentication in the installer for the Intel(R) NUC M15 Laptop Kit Management Engine driver pack before version 15.0.10.1508 may allow an authenticateCVE-2021-33087 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper authentication in the installer for the Intel(R) NUC M15 Laptop Kit Management Engine driver pack before version 15.0.10.1508 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- NUC M15 Laptop KIT Management Engine Driver Pack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability.CVE-2021-42955 · Email & office · Zohocorp · reported by MITREHigh 7.3
Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because of the designed password reset mechanism, any non-admin Windows user can reset the password of the Remote Access Plus Server Admin account.
- Product
- Manageengine Remote Access Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control.CVE-2021-42954 · Email & office · Zohocorp · reported by MITREHigh 7.8
Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group (non-admin or any guest users), thereby allowing privilege escalation, unauthorized password reset, stealing of sensitive data, access to credentials in plaintext, access to registry values, tampering with configuration files, etc.
- Product
- Manageengine Remote Access Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability.CVE-2021-42956 · Email & office · Zoho · reported by MITREHigh 7.8
Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. Due to improper privilege management, the process launches as the logged in user, so memory dump can be done by non-admin also. Remotely, an attacker can dump all sensitive information including DB Connection string, entire IT infrastructure details, commands executed by IT admin including credentials, secrets, private keys and more.
- Product
- Manageengine Remote Access Plus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2021The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP codeCVE-2020-16152 · Other software · Extremenetworks · reported by MITRECritical 9.8
The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file.
- Product
- Aerohive Netconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgtacknowledge.extremenetworks.com
Nov 11, 2021Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.CVE-2021-42847 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.
- Product
- Manageengine Adaudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compitstop.manageengine.com
Nov 11, 2021Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution.CVE-2021-42002 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Nov 11, 2021Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution.CVE-2021-41833 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution.
- Product
- Manageengine Patch Connect Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.commanageengine.com
Nov 11, 2021Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search.CVE-2021-41081 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search.
- Product
- Manageengine Network Configuration Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Nov 11, 2021Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a hardware details search.CVE-2021-41080 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a hardware details search.
- Product
- Manageengine Network Configuration Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Nov 9, 2021Microsoft Defender Remote Code Execution VulnerabilityCVE-2021-42298 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Defender Remote Code Execution Vulnerability
- Product
- Microsoft Malware Protection Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 9, 2021Chakra Scripting Engine Memory Corruption VulnerabilityCVE-2021-42279 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.2
Chakra Scripting Engine Memory Corruption Vulnerability
- Product
- ChakraCore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.