Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

460 results · page 6 of 10

Nov 7, 2022Local privilege escalation due to improper soft link handling.CVE-2022-44747 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Nov 7, 2022Sensitive information disclosure due to insecure folder permissions.CVE-2022-44746 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Nov 7, 2022Sensitive information leak through log files.CVE-2022-44745 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Nov 7, 2022Local privilege escalation due to DLL hijacking vulnerability.CVE-2022-44744 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Nov 7, 2022Local privilege escalation due to insecure folder permissions.CVE-2022-44733 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39900.
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Nov 7, 2022Local privilege escalation due to insecure folder permissions.CVE-2022-44732 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39900.
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 26, 2022Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards.CVE-2022-39355 · Other software · discourse · reported by GitHubCritical 9.1
Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerability could be used to take control of a victim's forum account. This vulnerability is patched in commit number 846d012151514b35ce42a1636c7d70f6dcee879e of the discourse-patreon plugin. Out of an abundance of caution, any Discourse accounts which have logged in with an unverified-email Patreon account will be logged out and asked to verify their email address on their next login. As a workaround, disable the patreon integration and log out all users with associated Patreon accounts.
Product
discourse-patreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 14, 2022Cross site scripting (XSS) vulnerability in ouqiang gocron through 1.5.3, allows attackers to execute arbitrary code via scope.row.hostname in web/vue/src/pagesCVE-2022-40365 · Other software · Gocron Project · reported by MITREMedium 6.1
Cross site scripting (XSS) vulnerability in ouqiang gocron through 1.5.3, allows attackers to execute arbitrary code via scope.row.hostname in web/vue/src/pages/taskLog/list.vue.
Product
Gocron
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 5, 2022The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href fCVE-2022-21186 · Other software · Acrontum · reported by report@snyk.ioCritical 9.8
The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input.
Product
Filesystem-template
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com security.snyk.io
Jun 30, 2022In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file.CVE-2013-4561 · Other software · Redhat · reported by Red HatCritical 9.1
In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to loss of confidentiality and integrity.
Product
Openshift
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com github.com
May 18, 2022Cleartext transmission of sensitive information.CVE-2022-30994 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 29240
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
May 18, 2022Cleartext transmission of sensitive information.CVE-2022-30993 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
May 18, 2022Open redirect via user-controlled query parameter.CVE-2022-30992 · Other software · Acronis · reported by security@acronis.comMedium 6.1
Open redirect via user-controlled query parameter. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
May 18, 2022HTML injection via report name.CVE-2022-30991 · Other software · Acronis · reported by security@acronis.comMedium 6.1
HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
May 18, 2022Sensitive information disclosure due to insecure folder permissions.CVE-2022-30990 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 15 (Linux) before build 29240, Acronis Agent (Linux) before build 28037
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
May 16, 2022Local privilege escalation due to insecure folder permissions.CVE-2022-30697 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 3640
Product
Acronis Snap Deploy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
May 16, 2022Local privilege escalation due to a DLL hijacking vulnerability.CVE-2022-30696 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3640
Product
Acronis Snap Deploy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
May 16, 2022Local privilege escalation due to excessive permissions assigned to child processes.CVE-2022-30695 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Snap Deploy (Windows) before build 3640
Product
Acronis Snap Deploy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Apr 11, 2022A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.CVE-2021-32157 · Other software · Webmin · reported by MITRECritical 9.6
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
Product
Webmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 11, 2022A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.CVE-2021-32156 · Other software · Webmin · reported by MITREHigh 8.8
A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
Product
Webmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 19, 2022A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel.CVE-2022-27226 · Other software · IRZ · reported by MITREHigh 8.8
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat actor to gain filesystem access. In addition, if the router's default credentials aren't rotated or a threat actor discovers valid credentials, remote code execution can be achieved without user interaction.
Product
Ru21 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com en.irz.ru
Feb 26, 2022KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session.CVE-2022-24986 · Other software · KDE · reported by MITREHigh 7.8
KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watching it be created the first time could potentially intercept the file the following time, enabling that person to run unauthorized commands.
Product
Kcron
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com apps.kde.org
Feb 11, 2022Local privilege escalation due to insecure folder permissions.CVE-2022-0483 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis VSS Doctor (Windows) before build 53
Product
Acronis VSS Doctor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Feb 7, 2022Advanced Cron Manager: And Advanced Cron Manager Pro WordPress plugin before 2CVE-2021-25084 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisation checks in some of their AJAX actions, allowing any authenticated users, such as subscriber to call them and add or remove events as well as schedules for example
Product
Advanced Cron Manager
Fixed in
2.4.2
What to do
Update Advanced Cron Manager to 2.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 4, 2022Local privilege escalation due to unrestricted loading of unsigned libraries.CVE-2022-24115 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (macOS) before build 39605, Acronis True Image 2021 (macOS) before build 39287
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Feb 4, 2022Local privilege escalation due to race condition on application startup.CVE-2022-24114 · Other software · Acronis · reported by security@acronis.comHigh 7
Local privilege escalation due to race condition on application startup. The following products are affected: Acronis Cyber Protect Home Office (macOS) before build 39605, Acronis True Image 2021 (macOS) before build 39287
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Feb 4, 2022Local privilege escalation due to excessive permissions assigned to child processes.CVE-2022-24113 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27147, Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Feb 4, 2022Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service.CVE-2021-44206 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Feb 4, 2022Local privilege escalation due to DLL hijacking vulnerability.CVE-2021-44205 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Feb 4, 2022Local privilege escalation via named pipe due to improper access control checks.CVE-2021-44204 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation via named pipe due to improper access control checks. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27147, Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Jan 18, 2022Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language.CVE-2022-21700 · Other software · micronaut-projects · reported by GitHubMedium 5.3
Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language. In affected versions sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used in static state. ### Impact Sending an invalid Content Type header leads to memory leak in `DefaultArgumentConversionContext` as this type is erroneously used in static state. ### Patches The problem is patched in Micronaut 3.2.7 and above. ### Workarounds The default content type binder can be replaced in an existing Micronaut application to mitigate the issue: ```java package example; import java.util.List; import io.micronaut.context.annotation.Replaces; import io.micronaut.core.convert.ConversionService; import io.micronaut.http.MediaType; import io.micronaut.http.bind.DefaultRequestBinderRegistry; import io.micronaut.http.bind.binders.RequestArgumentBinder; import jakarta.inject.Singleton; @Singleton @Replaces(DefaultRequestBinderRegistry.class) class FixedRequestBinderRegistry extends DefaultRequestBinderRegistry { public FixedRequestBinderRegistry(ConversionService conversionServi
Product
micronaut-core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 21, 2021Cronos is a commercial implementation of a blockchain.CVE-2021-43839 · Other software · crypto-org-chain · reported by GitHubHigh 7.5
Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.
Product
cronos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 29, 2021Sensitive information could be logged.CVE-2021-34800 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information could be logged. The following products are affected: Acronis Agent (Windows, Linux, macOS) before build 27147
Product
Acronis Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Nov 29, 2021Stored cross-site scripting (XSS) was possible in protection plan details.CVE-2021-44203 · Other software · Acronis · reported by security@acronis.comMedium 5.4
Stored cross-site scripting (XSS) was possible in protection plan details. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Nov 29, 2021Stored cross-site scripting (XSS) was possible in activity details.CVE-2021-44202 · Other software · Acronis · reported by security@acronis.comMedium 5.4
Stored cross-site scripting (XSS) was possible in activity details. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Nov 29, 2021Cross-site scripting (XSS) was possible in notification pop-ups.CVE-2021-44201 · Other software · Acronis · reported by security@acronis.comMedium 6.1
Cross-site scripting (XSS) was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Nov 29, 2021Self cross-site scripting (XSS) was possible on devices page.CVE-2021-44200 · Other software · Acronis · reported by security@acronis.comMedium 5.4
Self cross-site scripting (XSS) was possible on devices page. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Nov 29, 2021DLL hijacking could lead to denial of service.CVE-2021-44199 · Other software · Acronis · reported by security@acronis.comMedium 5.5
DLL hijacking could lead to denial of service. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27305, Acronis Cyber Protect Home Office (Windows) before build 39612
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Nov 29, 2021DLL hijacking could lead to local privilege escalation.CVE-2021-44198 · Other software · Acronis · reported by security@acronis.comHigh 7.8
DLL hijacking could lead to local privilege escalation. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Nov 16, 2021Modern DRAM devices (PC-DDR4, LPDDR4X) are affected by a vulnerability in their internal Target Row Refresh (TRR) mitigation against Rowhammer attacks.CVE-2021-42114 · Other software · Micron · reported by vulnerability@ncsc.chCritical 9
Modern DRAM devices (PC-DDR4, LPDDR4X) are affected by a vulnerability in their internal Target Row Refresh (TRR) mitigation against Rowhammer attacks. Novel non-uniform Rowhammer access patterns, consisting of aggressors with different frequencies, phases, and amplitudes allow triggering bit flips on affected memory modules using our Blacksmith fuzzer. The patterns generated by Blacksmith were able to trigger bitflips on all 40 PC-DDR4 DRAM devices in our test pool, which cover the three major DRAM manufacturers: Samsung, SK Hynix, and Micron. This means that, even when chips advertised as Rowhammer-free are used, attackers may still be able to exploit Rowhammer. For example, this enables privilege-escalation attacks against the kernel or binaries such as the sudo binary, and also triggering bit flips in RSA-2048 keys (e.g., SSH keys) to gain cross-tenant virtual-machine access. We can confirm that DRAM devices acquired in July 2020 with DRAM chips from all three major DRAM vendors (Samsung, SK Hynix, Micron) are affected by this vulnerability. For more details, please refer to our publication.
Product
Micron ddr4_sdram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record comsec.ethz.ch comsec.ethz.ch
Nov 15, 2021cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them.CVE-2021-41269 · Other software · jmrozanec · reported by GitHubCritical 10
cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected. The issue was patched and a new version was released. Please upgrade to version 9.1.6. There are no known workarounds known.
Product
cron-utils
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 19, 2021FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new version in.CVE-2011-1075 · Other software · Freebsd · reported by Red HatLow 3.7
FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new version in. In particular, it uses the MD5File() function, which takes a pathname as an argument, and is called with euid 0. A race condition in this process may lead to an arbitrary MD5 comparison regardless of the read permissions.
Product
Freebsd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info security.netapp.com
Oct 4, 2021Ballistix MOD Utility through 2.0.2.5 is vulnerable to privilege escalation in the MODAPI.sys driver component.CVE-2021-41285 · Other software · Micron · reported by MITREHigh 7.8
Ballistix MOD Utility through 2.0.2.5 is vulnerable to privilege escalation in the MODAPI.sys driver component. The vulnerability is triggered by sending a specific IOCTL request that allows low-privileged users to directly interact with physical memory via the MmMapIoSpace function call (mapping physical memory into a virtual address space). Attackers could exploit this issue to achieve local privilege escalation to NT AUTHORITY\SYSTEM.
Product
Ballistix Memory Overview Display Utility
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com voidsec.com
Aug 30, 2021A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job.CVE-2021-27557 · Other software · Easycorp · reported by MITREMedium 4.3
A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job.
Product
Zentao
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record privasec.com privasec.com
Aug 30, 2021The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers (who have admin access) to execute arbitrary code by setting the type parameter to System.CVE-2021-27556 · Other software · Easycorp · reported by MITREHigh 7.2
The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers (who have admin access) to execute arbitrary code by setting the type parameter to System.
Product
Zentao
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record privasec.com privasec.com
Aug 12, 2021Acronis Cyber Protect 15 for Windows prior to build 27009 allowed local privilege escalation via binary hijacking.CVE-2021-38088 · Other software · Acronis · reported by MITREHigh 7.8
Acronis Cyber Protect 15 for Windows prior to build 27009 allowed local privilege escalation via binary hijacking.
Product
Cyber Protect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.acronis.com kb.acronis.com
Aug 12, 2021Reflected cross-site scripting (XSS) was possible on the login page in Acronis Cyber Protect 15 prior to build 27009.CVE-2021-38087 · Other software · Acronis · reported by MITREMedium 6.1
Reflected cross-site scripting (XSS) was possible on the login page in Acronis Cyber Protect 15 prior to build 27009.
Product
Cyber Protect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.acronis.com kb.acronis.com
Aug 12, 2021Acronis Cyber Protect 15 for Windows prior to build 27009 and Acronis Agent for Windows prior to build 26226 allowed local privilege escalation via DLL hijackinCVE-2021-38086 · Other software · Acronis · reported by MITREHigh 7.8
Acronis Cyber Protect 15 for Windows prior to build 27009 and Acronis Agent for Windows prior to build 26226 allowed local privilege escalation via DLL hijacking.
Product
Cyber Protect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.acronis.com kb.acronis.com
Aug 5, 2021Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent prior to build 26653, Acronis Cyber ProtCVE-2021-32581 · Other software · Acronis · reported by MITREHigh 8.1
Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent prior to build 26653, Acronis Cyber Protect prior to build 27009 did not implement SSL certificate validation.
Product
Cyber Protect Cloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.acronis.com kb.acronis.com
Aug 5, 2021Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to DLL hijacking.CVE-2021-32580 · Other software · Acronis · reported by MITREHigh 7.8
Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to DLL hijacking.
Product
True Image
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.acronis.com kb.acronis.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.