Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
331 results · page 6 of 7
Jun 23, 2021In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPFCVE-2021-33624 · Computers, phones & browsers · Linux · reported by MITREMedium 4.7
In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Apr 23, 2021In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit.CVE-2021-31780 · Other software · Misp-project · reported by MITREHigh 7.5
In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit. When an object has a sharing group associated with an event edit, the sharing group object is ignored and instead the passed local ID is reused.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2021An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139.CVE-2021-27904 · Other software · Misp-project · reported by MITREMedium 5.5
An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139. In the implementation of Sharing Groups, the "all org" flag sometimes provided view access to unintended actors.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage() function.CVE-2020-24085 · Other software · Misp-project · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage() function. Due to a lack of controller validation in "path" parameter, an attacker can execute malicious JavaScript code.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2021MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button.CVE-2021-3184 · Other software · Misp-project · reported by MITREMedium 6.1
MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2021MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp.CVE-2021-25325 · Other software · Misp-project · reported by MITREMedium 6.1
MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2021MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp.CVE-2021-25324 · Other software · Misp-project · reported by MITREMedium 6.1
MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2021The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a passworCVE-2021-25323 · Other software · Misp-project · reported by MITRECritical 9.1
The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a password.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2020app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field.CVE-2020-29572 · Other software · Misp-project · reported by MITREMedium 6.1
app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2020MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php.CVE-2020-29006 · Other software · Misp-project · reported by MITRECritical 9.8
MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled.CVE-2020-28947 · Other software · Misp-project · reported by MITREMedium 6.1
In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2020MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.CVE-2020-28043 · Other software · Misp-project · reported by MITREHigh 7.5
MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2020SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Right Hemisphere Binary (.rh) file received from untrusted sources which resultsCVE-2020-6376 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.5
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Right Hemisphere Binary (.rh) file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Sep 18, 2020An issue was discovered in MISP before 2.4.132.CVE-2020-25766 · Other software · Misp-project · reported by MITREHigh 7.5
An issue was discovered in MISP before 2.4.132. It can perform an unwanted action because of a POST operation on a form that is not linked to the login page.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2020radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in r_x509_parse_algorithmidentifier in libr/util/x509.c.CVE-2020-17487 · Other software · Radare · reported by MITREHigh 7.5
radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in r_x509_parse_algorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in IMAGE_DIRECTORY_ENTRY_SECURITY.
- Product
- Radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Aug 3, 2020radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformed DW_AT_name in the .CVE-2020-16269 · Other software · Radare · reported by MITREMedium 5.5
radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformed DW_AT_name in the .debug_info section.
- Product
- Radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Jul 14, 2020In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.CVE-2020-15711 · Other software · Misp-project · reported by MITREHigh 8.8
In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2020An issue was discovered in MISP 2.4.128.CVE-2020-15412 · Other software · Misp-project · reported by MITREMedium 4.3
An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2020An issue was discovered in MISP 2.4.128.CVE-2020-15411 · Other software · Misp-project · reported by MITRECritical 9.8
An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2020app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations.CVE-2020-14969 · Other software · Misp-project · reported by MITREHigh 7.5
app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2020app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view.CVE-2020-13153 · Other software · Misp-project · reported by MITREMedium 6.1
app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2020MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case.CVE-2020-12889 · Other software · Misp · reported by MITRECritical 9.8
MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case.
- Product
- Misp-maltego
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2020app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP.CVE-2020-11458 · Other software · Misp-project · reported by MITREMedium 4.9
app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the full contents of a file, but does cause a leaks of strings that match certain patterns. Among the data that can leak are passwords from database.php or GPG key passphrases from config.php.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commatthias.sdfeu.org
Mar 17, 2020cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).CVE-2019-20492 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Mar 9, 2020MISP 2.4.122 has Persistent XSS in the sighting popover tool.CVE-2020-10247 · Other software · Misp-project · reported by MITREMedium 6.1
MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sighting_field.ctp.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2020MISP 2.4.122 has reflected XSS via unsanitized URL parameters.CVE-2020-10246 · Other software · Misp-project · reported by MITREMedium 6.1
MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2020Stack buffer overflow due to instance id is misplaced inside definition of hardware accelerated effects in makefile in Snapdragon Auto, Snapdragon Compute, SnapCVE-2019-10569 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Stack buffer overflow due to instance id is misplaced inside definition of hardware accelerated effects in makefile in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile in APQ8053, APQ8098, MDM9607, MDM9640, MSM8998, QCS605, SC8180X, SDM439, SDM630, SDM636, SDM660, SDM845, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Mar 2, 2020The bencoding parser in BitTorrent uTorrent through 3.5.5 (build 45505) misparses nested bencoded dictionaries, which allows a remote attacker to cause a denialCVE-2020-8437 · Other software · Bittorrent · reported by MITREHigh 7.5
The bencoding parser in BitTorrent uTorrent through 3.5.5 (build 45505) misparses nested bencoded dictionaries, which allows a remote attacker to cause a denial of service.
- Product
- Utorrent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.whtaguy.comforum.utorrent.com
Feb 11, 2020An issue was discovered in MISP before 2.4.121.CVE-2020-8894 · Other software · Misp-project · reported by MITREMedium 6.5
An issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2020An issue was discovered in MISP before 2.4.121.CVE-2020-8893 · Other software · Misp-project · reported by MITREHigh 7.5
An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2020An issue was discovered in MISP before 2.4.121.CVE-2020-8892 · Other software · Misp-project · reported by MITREHigh 8.1
An issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2020An issue was discovered in MISP before 2.4.121.CVE-2020-8891 · Other software · Misp-project · reported by MITREMedium 5.9
An issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to block a brute-force series of invalid requests.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2020An issue was discovered in MISP before 2.4.121.CVE-2020-8890 · Other software · Misp-project · reported by MITREMedium 5.9
An issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine hosting the web server and the machine hosting the database) when trying to block a brute-force series of invalid requests.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2019In app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on tagging data.CVE-2019-19379 · Other software · Misp-project · reported by MITREMedium 5.3
In app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on tagging data.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2019PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then misparsed by libxml2.CVE-2010-4657 · Websites & servers · php5 · reported by Red HatHigh 7.5
PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then misparsed by libxml2. This results in memory leak into the resulting output.
- Product
- php5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugs.launchpad.net
Sep 10, 2019MISP before 2.4.115 allows privilege escalation in certain situations.CVE-2019-16202 · Other software · Misp-project · reported by MITREMedium 6.5
MISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the __checkLoggedActions function with a "This could be an indication of an attempted privilege escalation on older vulnerable versions of MISP (<2.4.115)" message.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexcellium-services.comgithub.com
Jul 30, 2019cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479).CVE-2019-14400 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Jul 27, 2019In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view.CVE-2019-14286 · Other software · Misp-project · reported by MITREMedium 6.1
In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicious MISP event must be crafted in order to trigger the vulnerability.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2019main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port wCVE-2017-7189 · Websites & servers · PHP · reported by MITREHigh 7.5
main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to 127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this example) is hardcoded into an application as a security policy, but the hostname argument (i.e., 127.0.0.1:80 in this example) is obtained from untrusted input.
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.php.netgithub.com
Jul 4, 2019ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.CVE-2019-13305 · Other software · Imagemagick · reported by MITREHigh 7.8
ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orggithub.com
Jul 4, 2019ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment.CVE-2019-13304 · Other software · Imagemagick · reported by MITREHigh 7.8
ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orggithub.com
Jun 17, 2019app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled CVE-2019-12868 · Other software · Misp-project · reported by MITREHigh 7.2
app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2019An issue was discovered in MISP 2.4.108.CVE-2019-12794 · Other software · Misp-project · reported by MITREMedium 6.6
An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins (organization admins have the inherent ability to reset passwords for all of their organization's users). This, however, could be abused in a situation where the host organization of an instance creates organization admins. An organization admin could set a password manually for the site admin or simply use the API key of the site admin to impersonate them. The potential for abuse only occurs when the host organization creates lower-privilege organization admins instead of the usual site admins. Also, only organization admins of the same organization as the site admin could abuse this.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2019An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107.CVE-2019-11814 · Other software · Misp-project · reported by MITREMedium 6.1
An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2019An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107.CVE-2019-11813 · Other software · Misp-project · reported by MITREMedium 6.1
An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107. There is persistent XSS via link type attributes with javascript:// links.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2019A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107.CVE-2019-11812 · Other software · Misp-project · reported by MITREMedium 6.1
A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be included in the discussion interface, and can be triggered by clicking on the link.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2019In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.CVE-2019-10254 · Other software · Misp-project · reported by MITREMedium 6.1
In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2019In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.CVE-2019-9578 · Other software · Yubico · reported by MITREHigh 7.5
In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.
- Product
- Libu2f-host
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Mar 1, 2019In MISP 2.4.102, an authenticated user can view sightings that they should not be eligible for.CVE-2019-9482 · Other software · Misp-project · reported by MITREMedium 5.3
In MISP 2.4.102, an authenticated user can view sightings that they should not be eligible for. Exploiting this requires access to the event that has received the sighting. The issue affects instances with restrictive sighting settings (event only / sighting reported only).
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2019In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of servCVE-2009-5155 · Other software · GNU · reported by MITREHigh 7.5
In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.
- Product
- Glibc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.savannah.gnu.orgdebbugs.gnu.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.