Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
461 results · page 6 of 10
Aug 27, 2020IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the brCVE-2020-4166 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 174402.
- Product
- Security Guardium Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 24, 2020IBM Security Guardium Insights 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.CVE-2020-4598 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 184823.
- Product
- Security Guardium Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 24, 2020IBM Security Guardium Insights 2.0.1 stores user credentials in plain in clear text which can be read by a local user.CVE-2020-4593 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.4
IBM Security Guardium Insights 2.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184747.
- Product
- Security Guardium Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 24, 2020IBM Security Guardium Insights 2.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions traCVE-2020-4170 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security Guardium Insights 2.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 174406.
- Product
- Security Guardium Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 24, 2020IBM Security Guardium Insights 2.0.1 could allow a remote attacker to hijack the clicking action of the victim.CVE-2020-4165 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 174401.
- Product
- Security Guardium Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 9, 2020IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies.CVE-2020-4173 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 174682.
- Product
- InfoSphere Guardium Activity Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 16, 2020Reflected Cross-Site Scripting (XSS) vulnerability in MONITORAPP WAF in which script can be executed when responding to Request URL information.CVE-2020-14210 · Other software · Monitorapp · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) vulnerability in MONITORAPP WAF in which script can be executed when responding to Request URL information. It provides a function to response to Request URL information when blocking.
- Product
- Application Insight Web Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2020Video Insight VMS versions prior to 7.6.1 allow remote attackers to conduct code injection attacks via unspecified vectors.CVE-2019-5997 · Other software · Panasonic Corporation · reported by vultures@jpcert.or.jpCritical 9.8
Video Insight VMS versions prior to 7.6.1 allow remote attackers to conduct code injection attacks via unspecified vectors.
- Product
- Video Insight VMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2020The NETGEAR Insight application before 2.42 for Android and iOS is affected by password mismanagement.CVE-2017-18857 · Network & remote access · Netgear · reported by MITRECritical 9.8
The NETGEAR Insight application before 2.42 for Android and iOS is affected by password mismanagement.
- Product
- Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 15, 2020Open Redirect vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation.CVE-2020-3954 · Other software · VMware · reported by security@vmware.comMedium 6.1
Open Redirect vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation.
- Product
- Vrealize LOG Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2020Cross Site Scripting (XSS) vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation.CVE-2020-3953 · Other software · VMware · reported by security@vmware.comMedium 4.8
Cross Site Scripting (XSS) vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation.
- Product
- Vrealize LOG Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2020There is a double free vulnerability in some Huawei products.CVE-2020-1862 · Other software · Huawei · reported by psirt@huawei.comLow 3.3
There is a double free vulnerability in some Huawei products. A local attacker with low privilege may perform some operations to exploit the vulnerability. Due to doubly freeing memory, successful exploit may cause some service abnormal. Affected product versions include:CampusInsight versions V100R019C00;ManageOne versions 6.5.RC2.B050.
- Product
- Campusinsight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2020HP Systems Insight Manager before 7.0 allows a remote user on adjacent network to access informationCVE-2012-1994 · Other software · HP · reported by hp-security-alert@hp.comMedium 5.7
HP Systems Insight Manager before 7.0 allows a remote user on adjacent network to access information
- Product
- HP Systems Insight Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jan 27, 2020A Stack-based Buffer Overflow vulnerability in libbelkin_api.so component of Belkin WeMo Insight Switch firmware allows a local attacker to obtain code executioCVE-2019-17094 · Other software · Belkin · reported by cve-requests@bitdefender.comHigh 8.3
A Stack-based Buffer Overflow vulnerability in libbelkin_api.so component of Belkin WeMo Insight Switch firmware allows a local attacker to obtain code execution on the device. This issue affects: Belkin WeMo Insight Switch firmware version 2.00.11396 and prior versions.
- Product
- Belkin WeMo Insight Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.bitdefender.comlabs.bitdefender.com
Dec 13, 2019There is an out-of-bounds read vulnerability in the Advanced Packages feature of the Gauss100 OLTP database in CampusInsight before V100R019C00SPC200.CVE-2019-5278 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
There is an out-of-bounds read vulnerability in the Advanced Packages feature of the Gauss100 OLTP database in CampusInsight before V100R019C00SPC200. Attackers who gain the specific permission can use this vulnerability by sending elaborate SQL statements to the database. Successful exploit of this vulnerability may cause the database to crash.
- Product
- Campusinsight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2019SQL injection vulnerability in the Video Insight VMS 7.3.2.5 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecifiedCVE-2019-5996 · Other software · Video Insight VMS · reported by vultures@jpcert.or.jpHigh 8.8
SQL injection vulnerability in the Video Insight VMS 7.3.2.5 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- 7.3.2.5 and earlier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2019IBM InfoSphere Global Name Management 5.0 and 6.0 and IBM InfoSphere Identity Insight 8.1 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attackCVE-2019-4433 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.2
IBM InfoSphere Global Name Management 5.0 and 6.0 and IBM InfoSphere Identity Insight 8.1 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162890.
- Product
- InfoSphere Identity Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 19, 2019The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product.CVE-2019-5631 · Other software · Rapid7 · reported by cve@rapid7.comHigh 7.8
The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the system (who must already be authenticated to the operating system) can elevate their privileges with this vulnerability to the privilege level of InsightAppSec (usually, SYSTEM). This issue affects version 2019.06.24 and prior versions of the product.
- Product
- InsightAppSec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.rapid7.comhelp.rapid7.com
Aug 9, 2019OnCommand Insight versions through 7.3.6 may disclose sensitive account information to an authenticated user.CVE-2019-5498 · Other software · NetApp Inc. · reported by security-alert@netapp.comMedium 6.5
OnCommand Insight versions through 7.3.6 may disclose sensitive account information to an authenticated user.
- Product
- OnCommand Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsecurity.netapp.com
Jul 12, 2019Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path.CVE-2019-5629 · Other software · Rapid7 · reported by cve@rapid7.comHigh 7.8
Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 2.6.4.
- Product
- Insight Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 3, 2019A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68.CVE-2019-5630 · Other software · Rapid7 · reported by cve@rapid7.comMedium 5.9
A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent a cross-domain pre-flight OPTIONS request.
- Product
- Nexpose/InsightVM Security Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.rapid7.comhelp.rapid7.com
Jun 3, 2019NETGEAR Insight Cloud with firmware before Insight 5.6 allows remote authenticated users to achieve command injection.CVE-2019-12591 · Network & remote access · Netgear · reported by MITREMedium 6.8
NETGEAR Insight Cloud with firmware before Insight 5.6 allows remote authenticated users to achieve command injection.
- Product
- Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
May 10, 2019Oncommand Insight versions prior to 7.3.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive informationCVE-2019-5496 · Other software · NetApp · reported by security-alert@netapp.comHigh 7.5
Oncommand Insight versions prior to 7.3.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.
- Product
- OnCommand Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsecurity.netapp.com
Apr 10, 2019A password management issue exists where the Organization authentication username and password were stored in plaintext in log files.CVE-2019-0032 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 7.8
A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A locally authenticated attacker who is able to access these stored plaintext credentials can use them to login to the Organization. Affected products are: Juniper Networks Service Insight versions from 15.1R1, prior to 18.1R1. Service Now versions from 15.1R1, prior to 18.1R1.
- Product
- Service Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comkb.juniper.net
Apr 9, 2019Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwordCVE-2019-5615 · Other software · Rapid7 · reported by cve@rapid7.comMedium 6.5
Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the salt for those passwords. Valid credentials are required to access these files and malicious users would still need to perform additional work to decrypt the credentials and escalate privileges. This issue affects: Rapid7 InsightVM versions 6.5.11 through 6.5.49.
- Product
- InsightVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.rapid7.comhelp.rapid7.com
Jan 22, 2019An issue was discovered in creditease-sec insight through 2018-09-11.CVE-2019-6510 · Other software · Creditease-sec · reported by MITREHigh 8.8
An issue was discovered in creditease-sec insight through 2018-09-11. user_delete in srcpm/app/admin/views.py allows CSRF.
- Product
- Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2019An issue was discovered in creditease-sec insight through 2018-09-11.CVE-2019-6509 · Other software · Creditease-sec · reported by MITREHigh 8.8
An issue was discovered in creditease-sec insight through 2018-09-11. depart_delete in srcpm/app/admin/views.py allows CSRF.
- Product
- Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2019An issue was discovered in creditease-sec insight through 2018-09-11.CVE-2019-6508 · Other software · Creditease-sec · reported by MITREHigh 8.8
An issue was discovered in creditease-sec insight through 2018-09-11. role_perm_delete in srcpm/app/admin/views.py allows CSRF.
- Product
- Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2019An issue was discovered in creditease-sec insight through 2018-09-11.CVE-2019-6507 · Other software · Creditease-sec · reported by MITREHigh 8.8
An issue was discovered in creditease-sec insight through 2018-09-11. login_user_delete in srcpm/app/admin/views.py allows CSRF.
- Product
- Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2018IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict TraCVE-2018-1525 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 142117.
- Product
- i2 Enterprise Insight Analysis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 6, 2018IBM i2 Enterprise Insight Analysis 2.1.7 allows web pages to be stored locally which can be read by another user on the system.CVE-2018-1505 · Other software · IBM · reported by psirt@us.ibm.comMedium 4
IBM i2 Enterprise Insight Analysis 2.1.7 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 141413.
- Product
- i2 Enterprise Insight Analysis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 6, 2018IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to hijack the clicking action of the victim.CVE-2018-1504 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 141340.
- Product
- i2 Enterprise Insight Analysis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Nov 13, 2018VMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2) contains a vulnerability due to improper authorization in the user registration method.CVE-2018-6980 · Other software · VMware · reported by security@vmware.comHigh 7.2
VMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2) contains a vulnerability due to improper authorization in the user registration method. Successful exploitation of this issue may allow Admin users with view only permission to perform certain administrative functions which they are not allowed to perform.
- Product
- VMware vRealize Log Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comvmware.com
Oct 16, 2018Vulnerability in the Oracle Retail Sales Audit component of Oracle Retail Applications (subcomponent: Operational Insights).CVE-2018-3115 · Other software · Oracle · reported by secalert_us@oracle.comHigh 7.7
Vulnerability in the Oracle Retail Sales Audit component of Oracle Retail Applications (subcomponent: Operational Insights). Supported versions that are affected are 15.0 and 16.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Sales Audit. While the vulnerability is in Oracle Retail Sales Audit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Sales Audit accessible data as well as unauthorized update, insert or delete access to some of Oracle Retail Sales Audit accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Sales Audit. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L).
- Product
- Retail Sales Audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Aug 21, 2018Stack-based Buffer Overflow vulnerability in libUPnPHndlr.so in Belkin Wemo Insight Smart Plug allows remote attackers to bypass local security protection via aCVE-2018-6692 · Other software · Belkin · reported by trellixpsirt@trellix.comCritical 10
Stack-based Buffer Overflow vulnerability in libUPnPHndlr.so in Belkin Wemo Insight Smart Plug allows remote attackers to bypass local security protection via a crafted HTTP post packet.
- Product
- Wemo Insight Smart Plug
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuringtomorrow.mcafee.comsecuringtomorrow.mcafee.com
Jul 31, 2018NetApp OnCommand Insight version 7.3.0 and versions prior to 7.2.0 are susceptible to clickjacking attacks which could cause a user to perform an unintended actCVE-2017-13652 · Other software · Netapp · reported by MITREMedium 6.5
NetApp OnCommand Insight version 7.3.0 and versions prior to 7.2.0 are susceptible to clickjacking attacks which could cause a user to perform an unintended action in the user interface.
- Product
- Oncommand Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsecurity.netapp.com
Apr 20, 2018IBM InfoSphere BigInsights 2.1.2 allows remote authenticated users to discover SMTP server credentials via vectors related to the Alert management service.CVE-2014-4782 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM InfoSphere BigInsights 2.1.2 allows remote authenticated users to discover SMTP server credentials via vectors related to the Alert management service. IBM X-Force ID: 95029.
- Product
- Infosphere Biginsights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww-01.ibm.comexchange.xforce.ibmcloud.com
Feb 15, 2018An improper input validation vulnerability in HPE Insight Control version 7.6 LR1 was found.CVE-2017-8969 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.7
An improper input validation vulnerability in HPE Insight Control version 7.6 LR1 was found.
- Product
- Insight Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsupport.hpe.com
Feb 15, 2018A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.CVE-2016-8518 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.5
A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.
- Product
- Systems Insight Manager using OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comh20566.www2.hpe.com
Feb 15, 2018A cross site scripting vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.CVE-2016-8517 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 6.1
A cross site scripting vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.
- Product
- Systems Insight Manager using OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comh20566.www2.hpe.com
Feb 15, 2018A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.CVE-2016-8516 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.5
A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.
- Product
- Systems Insight Manager using OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comh20566.www2.hpe.com
Feb 9, 2018Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in CVE-2018-1000023 · Other software · Insight.bitpay · reported by MITREMedium 5.3
Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request.
- Product
- Insight-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2017IBM Insights Foundation for Energy 2.0 could reveal sensitive information in error messages to authenticated users that could e used to conduct further attacks.CVE-2017-1342 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Insights Foundation for Energy 2.0 could reveal sensitive information in error messages to authenticated users that could e used to conduct further attacks. IBM X-Force ID: 126457.
- Product
- Insights Foundation for Energy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Dec 7, 2017IBM Infosphere BigInsights 4.2.0 could allow an attacker to inject code that could allow access to restricted data and files.CVE-2017-1336 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.4
IBM Infosphere BigInsights 4.2.0 could allow an attacker to inject code that could allow access to restricted data and files. IBM X-Force ID: 126244.
- Product
- BigInsights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Nov 16, 2017A vulnerability in Cisco Umbrella Insights Virtual Appliances 2.1.0 and earlier could allow an authenticated, local attacker to log in to an affected virtual apCVE-2017-12350 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.2
A vulnerability in Cisco Umbrella Insights Virtual Appliances 2.1.0 and earlier could allow an authenticated, local attacker to log in to an affected virtual appliance with root privileges. The vulnerability is due to the presence of default, static user credentials for an affected virtual appliance. An attacker could exploit this vulnerability by using the hypervisor console to connect locally to an affected system and then using the static credentials to log in to an affected virtual appliance. A successful exploit could allow the attacker to log in to the affected appliance with root privileges. Cisco Bug IDs: CSCvg31220.
- Product
- Umbrella Virtual Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Nov 1, 2017IBM Infosphere BigInsights 4.2.0 and 4.2.5 could allow a remote attacker to hijack the clicking action of the victim.CVE-2017-1554 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Infosphere BigInsights 4.2.0 and 4.2.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 131398.
- Product
- BigInsights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Nov 1, 2017IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to cross-site scripting.CVE-2017-1553 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131397.
- Product
- BigInsights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Nov 1, 2017IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection.CVE-2017-1552 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 131396.
- Product
- BigInsights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Oct 2, 2017IBM Insights Foundation for Energy 2.0 is vulnerable to cross-site scripting.CVE-2017-1345 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Insights Foundation for Energy 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126460.
- Product
- Insights Foundation for Energy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Oct 2, 2017IBM Insights Foundation for Energy 2.0 is vulnerable to SQL injection.CVE-2017-1311 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Insights Foundation for Energy 2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 125719.
- Product
- Insights Foundation for Energy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.