Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
378 results · page 6 of 8
Jan 30, 2023Posts List Designer by Category: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4749 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Posts List Designer by Category WordPress plugin before 3.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Posts List Designer by Category
- Fixed in
- 3.2
- What to do
- Update Posts List Designer by Category to 3.2 or newer.
Jan 26, 2023Qlik NPrinting Designer through 21.14.3.0 creates a Temporary File in a Directory with Insecure Permissions.CVE-2021-41988 · Other software · Qlik · reported by MITREHigh 7.8
Qlik NPrinting Designer through 21.14.3.0 creates a Temporary File in a Directory with Insecure Permissions.
- Product
- Nprinting Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2023Visual Email Designer for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3860 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author.
- Product
- Visual Email Designer for WooCommerce
- Fixed in
- 1.7.2
- What to do
- Update Visual Email Designer for WooCommerce to 1.7.2 or newer.
Nov 24, 2022Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions fromCVE-2022-29829 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpMedium 6.8
Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C, Motion Control Setting(GX Works3 related software) versions from 1.035M to 1.042U, and MT Works2 versions from 1.100E to 1.200J allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally.
- Product
- GX Works3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2022Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C tCVE-2022-29825 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpMedium 5.6
Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C, and MT Works2 versions from 1.100E to 1.200J allows an unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally.
- Product
- GX Works3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.CVE-2022-38201 · Other software · Esri · reported by psirt@esri.comMedium 6.1
An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker can potentially induce an unsuspecting authenticated user to access an an attacker controlled domain.
- Product
- ArcGIS Quickcapture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022Kadence WooCommerce Email Designer: Unserialises the content of an imported fileCVE-2022-3335 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Kadence WooCommerce Email Designer
- Fixed in
- 1.5.7
- What to do
- Update Kadence WooCommerce Email Designer to 1.5.7 or newer.
Oct 13, 2022Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu.CVE-2022-24697 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.
- Product
- Apache Kylin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Aug 31, 2022FATEK FvDesigner version 1.5.103 and prior is vulnerable to an out-of-bounds write while processing project files.CVE-2022-2866 · Other software · FATEK Automation · reported by ics-cert@hq.dhs.govHigh 7.8
FATEK FvDesigner version 1.5.103 and prior is vulnerable to an out-of-bounds write while processing project files. If a valid user is tricked into using maliciously crafted project files, an attacker could achieve arbitrary code execution.
- Product
- FvDesigner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including 1.11.0 allows an attCVE-2022-27580 · Other software · Sick · reported by psirt@sick.deHigh 7.8
A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including 1.11.0 allows an attacker to craft malicious project files. Opening/importing such a malicious project file would execute arbitrary code with the privileges of the current user when opened or imported by the Safety Designer. This compromises confidentiality integrity and availability. For the attack to succeed a user must manually open a malicious project file.
- Product
- Safety Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and including 1.9.4 SP1 allCVE-2022-27579 · Other software · Sick · reported by psirt@sick.deHigh 7.8
A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and including 1.9.4 SP1 allows an attacker to craft malicious project files. Opening/importing such a malicious project file would execute arbitrary code with the privileges of the current user when opened or imported by the Flexi Soft Designer. This compromises confidentiality integrity and availability. For the attack to succeed a user must manually open a malicious project file.
- Product
- Flexi Soft Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022SAP PowerDesigner Proxy - version 16.7, allows an attacker with low privileges and has local access, with the ability to work around system’s root disk access rCVE-2022-31590 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
SAP PowerDesigner Proxy - version 16.7, allows an attacker with low privileges and has local access, with the ability to work around system’s root disk access restrictions to Write/Create a program file on system disk root path, which could then be executed with elevated privileges of the application during application start up or reboot, potentially compromising Confidentiality, Integrity and Availability of the system.
- Product
- SAP PowerDesigner Proxy 16.7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jun 14, 2022A vulnerability has been identified in Xpedition Designer VX.2.10 (All versions < VX.2.10 Update 13), Xpedition Designer VX.2.11 (All versions < VX.2.11 Update CVE-2022-31465 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Xpedition Designer VX.2.10 (All versions < VX.2.10 Update 13), Xpedition Designer VX.2.11 (All versions < VX.2.11 Update 11), Xpedition Designer VX.2.12 (All versions < VX.2.12 Update 5), Xpedition Designer VX.2.13 (All versions < VX.2.13 Update 1). The affected application assigns improper access rights to the service executable. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.
- Product
- Xpedition Designer VX.2.10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Apr 19, 2022Fancy Product Designer: Cross-Site Request ForgeryCVE-2021-4096 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5.
- Product
- Fancy Product Designer
- Affected
- up to 4.7.5
- What to do
- Affects up to 4.7.5. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsupport.fancyproductdesigner.comwordfence.com
Apr 1, 2022Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstation running Studio CVE-2022-1159 · Other software · Rockwell Automation · reported by ics-cert@hq.dhs.govHigh 7.7
Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstation running Studio 5000 Logix Designer could inject controller code undetectable to a user.
- Product
- Studio 5000 Logix Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2022The affected product is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary codeCVE-2022-25170 · Other software · FATEK Automation · reported by ics-cert@hq.dhs.govHigh 7.8
The affected product is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code
- Product
- FvDesigner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2022The affected product is vulnerable to an out-of-bounds write while processing project files, which allows an attacker to craft a project file that would allow aCVE-2022-23985 · Other software · FATEK Automation · reported by ics-cert@hq.dhs.govHigh 7.8
The affected product is vulnerable to an out-of-bounds write while processing project files, which allows an attacker to craft a project file that would allow arbitrary code execution.
- Product
- FvDesigner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govzerodayinitiative.com
Feb 25, 2022The affected product is vulnerable to an out-of-bounds read while processing project files, which allows an attacker to craft a project file that would allow arCVE-2022-21209 · Other software · FATEK Automation · reported by ics-cert@hq.dhs.govHigh 7.8
The affected product is vulnerable to an out-of-bounds read while processing project files, which allows an attacker to craft a project file that would allow arbitrary code execution.
- Product
- FvDesigner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govzerodayinitiative.com
Feb 16, 2022Fancy Product Designer: SQL InjectionCVE-2021-4134 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~/inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 4.7.4.
- Product
- Fancy Product Designer
- Affected
- up to 4.7.4
- What to do
- Affects up to 4.7.4. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsupport.fancyproductdesigner.comwordfence.com
Nov 19, 2021mySCADA myDESIGNER Versions 8.20.0 and prior fails to properly validate contents of an imported project file, which may make the product vulnerable to a path trCVE-2021-43555 · Other software · mySCADA · reported by ics-cert@hq.dhs.govHigh 7.3
mySCADA myDESIGNER Versions 8.20.0 and prior fails to properly validate contents of an imported project file, which may make the product vulnerable to a path traversal payload. This vulnerability may allow an attacker to plant files on the file system in arbitrary locations or overwrite existing files, resulting in remote code execution.
- Product
- myDESIGNER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Nov 15, 2021This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user toCVE-2021-42703 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5.4
This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action.
- Product
- HMI Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Nov 15, 2021This vulnerability could allow an attacker to disclose information and execute arbitrary code on affected installations of WebAccess/MHI DesignerCVE-2021-42706 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.8
This vulnerability could allow an attacker to disclose information and execute arbitrary code on affected installations of WebAccess/MHI Designer
- Product
- HMI Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Nov 2, 2021IBM InfoSphere Data Flow Designer (IBM InfoSphere Information Server 11.7 ) is vulnerable to server-side request forgery (SSRF).CVE-2021-29738 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM InfoSphere Data Flow Designer (IBM InfoSphere Information Server 11.7 ) is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 201302.
- Product
- InfoSphere Information Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Nov 2, 2021IBM InfoSphere Data Flow Designer Engine (IBM InfoSphere Information Server 11.7 ) component has improper validation of the REST API server certificate.CVE-2021-29737 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM InfoSphere Data Flow Designer Engine (IBM InfoSphere Information Server 11.7 ) component has improper validation of the REST API server certificate. IBM X-Force ID: 201301.
- Product
- InfoSphere Information Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 4, 2021mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files.CVE-2021-41578 · Other software · Myscada · reported by MITREHigh 7.8
mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files. If an attacker can trick a victim into importing a malicious mep file, then they gain the ability to write arbitrary files to OS locations where the user has permission. This would typically lead to code execution.
- Product
- Mydesigner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021UReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the designer page.CVE-2020-21124 · Other software · Ureport Project · reported by MITRECritical 9.8
UReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the designer page.
- Product
- Ureport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.CVE-2020-21122 · Other software · Ureport Project · reported by MITREMedium 5.3
UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.
- Product
- Ureport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2021A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prCVE-2021-22704 · Other software · Schneider-electric · reported by cybersecurity@se.comCritical 9.1
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP.
- Product
- Vijeo Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Aug 11, 2021FATEK Automation FvDesigner, Versions 1.5.88 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.CVE-2021-32947 · Other software · Fatek · reported by ics-cert@hq.dhs.govHigh 7.8
FATEK Automation FvDesigner, Versions 1.5.88 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.
- Product
- Fvdesigner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govzerodayinitiative.com
Aug 11, 2021FATEK Automation FvDesigner, Versions 1.5.88 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to craft a pCVE-2021-32939 · Other software · Fatek · reported by ics-cert@hq.dhs.govHigh 7.8
FATEK Automation FvDesigner, Versions 1.5.88 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to craft a project file that may permit arbitrary code execution.
- Product
- Fvdesigner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govzerodayinitiative.com
Aug 11, 2021An uninitialized pointer in FATEK Automation FvDesigner, Versions 1.5.88 and prior may be exploited while the application is processing project files, allowing CVE-2021-32931 · Other software · Fatek · reported by ics-cert@hq.dhs.govHigh 7.8
An uninitialized pointer in FATEK Automation FvDesigner, Versions 1.5.88 and prior may be exploited while the application is processing project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
- Product
- Fvdesigner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govzerodayinitiative.com
Jul 7, 2021WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8: Cross-site request forgery (CSRF)CVE-2021-20779 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- Product
- WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8
- Fixed in
- 3.0.8
- What to do
- Update WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 to 3.0.8 or newer.
Jun 24, 2021The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied files, which may allow an attacker to executCVE-2021-33004 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.8
The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied files, which may allow an attacker to execute arbitrary code. User interaction is required on the WebAccess HMI Designer (versions 2.1.9.95 and prior).
- Product
- Webaccess/hmi Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Jun 24, 2021Opening a maliciously crafted project file may cause an out-of-bounds write, which may allow an attacker to execute arbitrary code.CVE-2021-33002 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.8
Opening a maliciously crafted project file may cause an out-of-bounds write, which may allow an attacker to execute arbitrary code. User interaction is require on the WebAccess HMI Designer (versions 2.1.9.95 and prior).
- Product
- Webaccess/hmi Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Jun 24, 2021Parsing a maliciously crafted project file may cause a heap-based buffer overflow, which may allow an attacker to perform arbitrary code execution.CVE-2021-33000 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.8
Parsing a maliciously crafted project file may cause a heap-based buffer overflow, which may allow an attacker to perform arbitrary code execution. User interaction is required on the WebAccess HMI Designer (versions 2.1.9.95 and prior).
- Product
- Webaccess/hmi Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Jun 21, 2021Fancy Product Designer: Allows unauthenticated attackers to upload arbitrary filesCVE-2021-24370 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
- Product
- Fancy Product Designer
- Fixed in
- 4.6.9
- What to do
- Update Fancy Product Designer to 4.6.9 or newer.
Full record and what to do →NVD recordlists.openwall.netseclists.org
May 26, 2021Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service or unauthorized access to systemCVE-2021-22705 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service or unauthorized access to system information when interacting directly with a driver installed by Vijeo Designer or EcoStruxure Machine Expert
- Product
- Vijeo Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Apr 23, 2021An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker tCVE-2020-7035 · Other software · Avaya · reported by securityalerts@avaya.comHigh 8.1
An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Orchestration Designer includes all 7.x versions before 7.2.3.
- Product
- Aura Orchestration Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloads.avaya.comdownloads.avaya.com
Apr 23, 2021Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via CVE-2021-31410 · Other software · Vaadin · reported by security@vaadin.comHigh 8.6
Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via crafted HTTP request.
- Product
- Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2021Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to craft a special projecCVE-2021-22683 · Other software · Fatek · reported by ics-cert@hq.dhs.govHigh 7.8
Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
- Product
- Fvdesigner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Mar 3, 2021An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is processing project files, allowing an attacker tCVE-2021-22670 · Other software · Fatek · reported by ics-cert@hq.dhs.govHigh 7.8
An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is processing project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
- Product
- Fvdesigner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Mar 3, 2021Fatek FvDesigner Version 1.5.76 and prior is vulnerable to a stack-based buffer overflow while project files are being processed, allowing an attacker to craft CVE-2021-22666 · Other software · Fatek · reported by ics-cert@hq.dhs.govHigh 7.8
Fatek FvDesigner Version 1.5.76 and prior is vulnerable to a stack-based buffer overflow while project files are being processed, allowing an attacker to craft a special project file that may permit arbitrary code execution.
- Product
- Fvdesigner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Mar 3, 2021A use after free issue has been identified in Fatek FvDesigner Version 1.5.76 and prior in the way the application processes project files, allowing an attackerCVE-2021-22662 · Other software · Fatek · reported by ics-cert@hq.dhs.govHigh 7.8
A use after free issue has been identified in Fatek FvDesigner Version 1.5.76 and prior in the way the application processes project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
- Product
- Fvdesigner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Mar 3, 2021Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds read while processing project files, allowing an attacker to craft a special projectCVE-2021-22638 · Other software · Fatek · reported by ics-cert@hq.dhs.govHigh 7.8
Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds read while processing project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
- Product
- Fvdesigner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Feb 8, 2021IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 - Business Automation Application Designer Component stores potentially sensitive information in log files thaCVE-2021-20359 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 - Business Automation Application Designer Component stores potentially sensitive information in log files that could be obtained by an unauthorized user. IBM X-Force ID: 194966.
- Product
- Cloud Pak for Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 6, 2020Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior.CVE-2020-16229 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.8
Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause a type confusion condition, which may allow remote code execution, disclosure/modification of information, or cause the application to crash.
- Product
- Webaccess/hmi Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govzerodayinitiative.com
Aug 6, 2020Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior.CVE-2020-16217 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.8
Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. A double free vulnerability caused by processing specially crafted project files may allow remote code execution, disclosure/modification of information, or cause the application to crash.
- Product
- Webaccess/hmi Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govzerodayinitiative.com
Aug 6, 2020Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior.CVE-2020-16215 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.8
Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause a stack-based buffer overflow, which may allow remote code execution, disclosure/modification of information, or cause the application to crash.
- Product
- Webaccess/hmi Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govzerodayinitiative.com
Aug 6, 2020Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior.CVE-2020-16213 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.8
Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause the system to write outside the intended buffer area, which may allow remote code execution, disclosure/modification of information, or cause the application to crash.
- Product
- Webaccess/hmi Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govzerodayinitiative.com
Aug 6, 2020Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior.CVE-2020-16211 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5.5
Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. An out-of-bounds read vulnerability may be exploited by processing specially crafted project files, which may allow an attacker to read information.
- Product
- Webaccess/hmi Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govzerodayinitiative.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.