Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
525 results · page 6 of 11
Apr 12, 2018Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name of aCVE-2018-9155 · Other software · Open-audit · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the Admin->Logs section (with a logs?logs.type= URI) and the Manage->Attributes section (via the "Name (display)" field to the attributes/create URI).
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comexploit-db.com
Apr 10, 2018The Video Downloader professional extension before 2018-04-05 for Chrome has Universal XSS (UXSS) via vectors related to a link64_msgAddLinks event.CVE-2018-10000 · Other software · Videodownloaderultimate · reported by MITREMedium 6.1
The Video Downloader professional extension before 2018-04-05 for Chrome has Universal XSS (UXSS) via vectors related to a link64_msgAddLinks event.
- Product
- Video Downloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugs.chromium.org
Mar 26, 2018An issue was discovered in Open-AudIT Professional 2.1.CVE-2018-8937 · Other software · Open-audit · reported by MITREMedium 6.1
An issue was discovered in Open-AudIT Professional 2.1. It is possible to inject a malicious payload in the redirect_url parameter to the /login URI to trigger an open redirect. A "data:text/html;base64," payload can be used with JavaScript code.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnileshsapariya.blogspot.aenileshsapariya.blogspot.ae
Mar 25, 2018Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the credentials URI.CVE-2018-8979 · Other software · Open-audit · reported by MITREHigh 8.8
Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the credentials URI.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnileshsapariya.blogspot.aeexploit-db.com
Mar 25, 2018Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI.CVE-2018-8978 · Other software · Open-audit · reported by MITREMedium 5.4
Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnileshsapariya.blogspot.aenileshsapariya.blogspot.ae
Mar 22, 2018Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.CVE-2018-8903 · Other software · Open-audit · reported by MITREMedium 5.4
Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnileshsapariya.blogspot.aeexploit-db.com
Mar 19, 2018Seafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet handling user accountCVE-2014-5443 · Other software · Seafile · reported by MITREHigh 7.8
Seafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet handling user accounts.
- Product
- Seafile Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Mar 9, 2018A buffer overflow vulnerability exist in the web-based GUI of Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which coulCVE-2018-7238 · Other software · Schneider Electric SE · reported by cybersecurity@se.comCritical 9.8
A buffer overflow vulnerability exist in the web-based GUI of Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to execute arbitrary code.
- Product
- Pelco Sarix Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
Mar 9, 2018A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remote attacker to delete CVE-2018-7237 · Other software · Schneider Electric SE · reported by cybersecurity@se.comCritical 9.1
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remote attacker to delete arbitrary system file due to lack of validation of the /login/bin/set_param to the file name with the value of 'system.delete.sd_file'
- Product
- Pelco Sarix Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
Mar 9, 2018A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH service due to lack of CVE-2018-7236 · Other software · Schneider Electric SE · reported by cybersecurity@se.comHigh 8.1
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH service due to lack of authentication for /login/bin/set_param could enable SSH service.
- Product
- Pelco Sarix Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
Mar 9, 2018A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file downloCVE-2018-7235 · Other software · Schneider Electric SE · reported by cybersecurity@se.comHigh 7.5
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file download due to lack of validation of the shell meta characters with the value of 'system.download.sd_file'
- Product
- Pelco Sarix Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
Mar 9, 2018A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file downloCVE-2018-7234 · Other software · Schneider Electric SE · reported by cybersecurity@se.comHigh 7.5
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file download due to lack of validation of SSL certificate.
- Product
- Pelco Sarix Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
Mar 9, 2018A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due toCVE-2018-7233 · Other software · Schneider Electric SE · reported by cybersecurity@se.comCritical 9.8
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'model_name' or 'mac_address'.
- Product
- Pelco Sarix Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
Mar 9, 2018A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due toCVE-2018-7232 · Other software · Schneider Electric SE · reported by cybersecurity@se.comCritical 9.8
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'network.ieee8021x.delete_certs'.
- Product
- Pelco Sarix Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
Mar 9, 2018A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due toCVE-2018-7231 · Other software · Schneider Electric SE · reported by cybersecurity@se.comCritical 9.8
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'system.opkg.remove'.
- Product
- Pelco Sarix Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
Mar 9, 2018A XML external entity (XXE) vulnerability exists in the import.cgi of the web interface component of the Schneider Electric's Pelco Sarix Professional in all fiCVE-2018-7230 · Other software · Schneider Electric SE · reported by cybersecurity@se.comHigh 8.8
A XML external entity (XXE) vulnerability exists in the import.cgi of the web interface component of the Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67.
- Product
- Pelco Sarix Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
Mar 9, 2018A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote aCVE-2018-7229 · Other software · Schneider Electric SE · reported by cybersecurity@se.comCritical 9.8
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to bypass authentication and gain administrator privileges because the use of hardcoded credentials.
- Product
- Pelco Sarix Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
Mar 9, 2018A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote aCVE-2018-7228 · Other software · Schneider Electric SE · reported by cybersecurity@se.comCritical 9.8
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to bypass authentication and get the administrator privileges.
- Product
- Pelco Sarix Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
Mar 9, 2018A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow retrieving of specially crafCVE-2018-7227 · Other software · Schneider Electric SE · reported by cybersecurity@se.comMedium 5.3
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow retrieving of specially crafted URLs without authentication that can reveal sensitive information to an attacker.
- Product
- Pelco Sarix Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
Feb 27, 2018IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5 and 5.0 is vulnerable to cross-site scripting.CVE-2018-1399 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138435.
- Product
- Daeja ViewONE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Feb 5, 2018Absolute path traversal vulnerability in eFront CMS 3.6.15.4 and earlier allows remote Professor users to obtain sensitive information via a full pathname in thCVE-2015-4461 · Other software · Efrontlearning · reported by MITREMedium 6.5
Absolute path traversal vulnerability in eFront CMS 3.6.15.4 and earlier allows remote Professor users to obtain sensitive information via a full pathname in the other parameter.
- Product
- Efront
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.efrontlearning.netmohankallepalli.blogspot.in
Jan 31, 2018In SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\SYSTEM because of not validating input valuCVE-2018-6476 · Other software · Superantispyware · reported by MITRECritical 9.8
In SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\SYSTEM because of not validating input values from IOCtl 0x9C402114 or 0x9C402124 or 0x9C40207c.
- Product
- Superantispyware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2018In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Privileges.CVE-2018-6475 · Other software · Superantispyware · reported by MITREHigh 7.8
In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Privileges.
- Product
- Superantispyware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2018In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecifCVE-2018-6474 · Other software · Superantispyware · reported by MITREHigh 7.8
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402148.
- Product
- Superantispyware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2018In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecifCVE-2018-6473 · Other software · Superantispyware · reported by MITREHigh 7.8
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402080.
- Product
- Superantispyware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2018In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecifCVE-2018-6472 · Other software · Superantispyware · reported by MITREHigh 7.8
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C40204c.
- Product
- Superantispyware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2018In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecifCVE-2018-6471 · Other software · Superantispyware · reported by MITREHigh 7.8
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402078.
- Product
- Superantispyware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2018SQL Injection exists in Professional Local Directory Script 1.0 via the sellers_subcategories.php IndustryID parameter, or the suppliers.php IndustryID or CategCVE-2018-5973 · Other software · Eihitech · reported by MITRECritical 9.8
SQL Injection exists in Professional Local Directory Script 1.0 via the sellers_subcategories.php IndustryID parameter, or the suppliers.php IndustryID or CategoryID parameter.
- Product
- Professional Local Directory Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Jan 19, 2018OXID eShop Professional Edition before 4.7.13 and 4.8.x before 4.8.7, Enterprise Edition before 5.0.13 and 5.1.x before 5.1.7, and Community Edition before 4.7.CVE-2014-4919 · Other software · Oxid-esales · reported by MITREMedium 5.4
OXID eShop Professional Edition before 4.7.13 and 4.8.x before 4.8.7, Enterprise Edition before 5.0.13 and 5.1.x before 5.1.7, and Community Edition before 4.7.13 and 4.8.x before 4.8.7 allow remote attackers to assign users to arbitrary dynamical user groups.
- Product
- Eshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.oxid-esales.comoxidforge.org
Jan 18, 2018CRLF injection vulnerability in OXID eShop Professional Edition before 4.7.11 and 4.8.x before 4.8.4, Enterprise Edition before 5.0.11 and 5.1.x before 5.1.4, aCVE-2014-2017 · Other software · Oxidforge · reported by MITREMedium 6.1
CRLF injection vulnerability in OXID eShop Professional Edition before 4.7.11 and 4.8.x before 4.8.4, Enterprise Edition before 5.0.11 and 5.1.x before 5.1.4, and Community Edition before 4.7.11 and 4.8.x before 4.8.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
- Product
- Eshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.oxid-esales.comoxidforge.org
Dec 29, 2017The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtainCVE-2015-3302 · WordPress plugins & themes · reported by MITREHigh 7.5
The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication mechanism."
- Product
- TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin)
- Fixed in
- 1.3.9.3
- What to do
- Update TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) to 1.3.9.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Dec 27, 2017PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modifying a setting in the user panel.CVE-2017-17930 · Other software · Ordermanagementscript · reported by MITREHigh 8.8
PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modifying a setting in the user panel.
- Product
- Professional Service Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter.CVE-2017-17929 · Other software · Ordermanagementscript · reported by MITREMedium 4.8
PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter.
- Product
- Professional Service Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter.CVE-2017-17928 · Other software · Ordermanagementscript · reported by MITRECritical 9.8
PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter.
- Product
- Professional Service Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a crafted PATH_INFO to service-list/category/CVE-2017-17927 · Other software · Ordermanagementscript · reported by MITREMedium 5.3
PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a crafted PATH_INFO to service-list/category/.
- Product
- Professional Service Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofeCVE-2017-17926 · Other software · Ordermanagementscript · reported by MITREMedium 5.3
PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed e-mail address.
- Product
- Professional Service Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Professional Service Script has XSS via the admin/general_settingupd.php website_title parameter.CVE-2017-17925 · Other software · Ordermanagementscript · reported by MITREMedium 4.8
PHP Scripts Mall Professional Service Script has XSS via the admin/general_settingupd.php website_title parameter.
- Product
- Professional Service Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via the id parameter to admin/review_userwise.phpCVE-2017-17924 · Other software · Ordermanagementscript · reported by MITREMedium 5.3
PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via the id parameter to admin/review_userwise.php.
- Product
- Professional Service Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2017Professional Service Script 1.0 has SQL Injection via the service-list city parameter.CVE-2017-17625 · Other software · ON Demand Marketplace Script Project · reported by MITRECritical 9.8
Professional Service Script 1.0 has SQL Injection via the service-list city parameter.
- Product
- ON Demand Marketplace Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Nov 27, 2017IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 could allow an authenticated attacker to obtain information such as user perCVE-2017-1484 · Websites & servers · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 could allow an authenticated attacker to obtain information such as user personal data. IBM X-Force ID: 128622.
- Product
- WebSphere Commerce Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Nov 3, 2017Ipswitch WS_FTP Professional before 12.6.0.3 has buffer overflows in the local search field and the backup locations field, aka WSCLT-1729.CVE-2017-16513 · Other software · Ipswitch · reported by MITREHigh 7.8
Ipswitch WS_FTP Professional before 12.6.0.3 has buffer overflows in the local search field and the backup locations field, aka WSCLT-1729.
- Product
- WS FTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.ipswitch.com7elements.co.uk
Oct 24, 2017IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to a denial of service when viewing or opening a large file.CVE-2017-1212 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to a denial of service when viewing or opening a large file. IBM X-Force ID: 123852.
- Product
- Daeja ViewONE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Oct 24, 2017IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could disclose sensitive information to a local user when logging is enabled.CVE-2017-1211 · Other software · IBM · reported by psirt@us.ibm.comLow 2.5
IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could disclose sensitive information to a local user when logging is enabled. IBM X-Force ID: 123851.
- Product
- Daeja ViewONE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Oct 24, 2017IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could allow an unauthenticated attacker to inject data into log files made to look legitimaCVE-2017-1210 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could allow an unauthenticated attacker to inject data into log files made to look legitimate. IBM X-Force ID: 123850.
- Product
- Daeja ViewONE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Oct 24, 2017IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to cross-site scripting.CVE-2017-1209 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123849.
- Product
- Daeja ViewONE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Aug 9, 2017Data corruption vulnerability in firmware in Intel Solid-State Drive Consumer, Professional, Embedded, Data Center affected firmware versions LSBG200, LSF031C, CVE-2017-5695 · Other software · Intel Corporation · reported by secure@intel.comMedium 4.6
Data corruption vulnerability in firmware in Intel Solid-State Drive Consumer, Professional, Embedded, Data Center affected firmware versions LSBG200, LSF031C, LSF036C, LBF010C, LSBG100, LSF031C, LSF036C, LBF010C, LSF031P, LSF036P, LBF010P, LSF031P, LSF036P, LBF010P, LSMG200, LSF031E, LSF036E, LSMG100, LSF031E, LSF036E, LSDG200, LSF031D, LSF036D allows local users to cause a denial of service via unspecified vectors.
- Product
- Solid-State Drive Consumer, Professional, Embedded, Data Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsecurity-center.intel.com
Aug 9, 2017Data corruption vulnerability in firmware in Intel Solid-State Drive Professional PSF104P, PSF109P allows local users to cause a denial of service via unspecifiCVE-2017-5694 · Other software · Intel Corporation · reported by secure@intel.comMedium 4.6
Data corruption vulnerability in firmware in Intel Solid-State Drive Professional PSF104P, PSF109P allows local users to cause a denial of service via unspecified vectors.
- Product
- Solid-State Drive Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-center.intel.comsecurity-center.intel.com
Aug 5, 2017SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xml_path HTTP parameter that trusts user-supplied inpCVE-2017-12439 · Other software · Socusoft · reported by MITREHigh 7.5
SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xml_path HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated redirection issues.
- Product
- Flash Slideshow Maker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jul 13, 2017IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated attacker to download files they should not have access to due toCVE-2017-1308 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated attacker to download files they should not have access to due to improper access controls. IBM X-Force ID: 125462.
- Product
- Daeja ViewONE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Jul 10, 2017IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct phishing attacks, using an opCVE-2017-1398 · Websites & servers · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 127385.
- Product
- WebSphere Commerce Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.