Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
415 results · page 6 of 9
Aug 29, 2022Sensei LMS: Does not have proper permissions set in one of its REST endpointCVE-2022-2034 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers
- Product
- Sensei LMS
- Fixed in
- 4.5.0
- What to do
- Update Sensei LMS to 4.5.0 or newer.
Full record and what to do →NVD recordhackerone.comwpscan.com
Jun 21, 2022The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.CVE-2021-36761 · Other software · Qlik · reported by MITREMedium 5.3
The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.
- Product
- Qlik Sense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberiskvision.comcyberiskvision.com
Jun 8, 2022WP Simple Adsense Insertion: Does not perform CSRF checks on updates to its admin pageCVE-2022-1695 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged in user to manipulate ads and inject arbitrary javascript via submitting a form.
- Product
- WP Simple Adsense Insertion
- Fixed in
- 2.1
- What to do
- Update WP Simple Adsense Insertion to 2.1 or newer.
May 17, 2022A vulnerability was found in HTC One/Sense 4.x.CVE-2013-10001 · Other software · HTC · reported by VulDBMedium 4.8
A vulnerability was found in HTC One/Sense 4.x. It has been rated as problematic. Affected by this issue is the certification validation of the mail client. An exploit has been disclosed to the public and may be used.
- Product
- One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Insecure default variable initialization of Intel(R) RealSense(TM) ID Solution F450 before version 2.6.0.74 may allow an unauthenticated user to potentially enaCVE-2021-33130 · Other software · Intel · reported by secure@intel.comMedium 4.6
Insecure default variable initialization of Intel(R) RealSense(TM) ID Solution F450 before version 2.6.0.74 may allow an unauthenticated user to potentially enable information disclosure via physical access.
- Product
- Realsense ID F450 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22CVE-2022-26019 · Other software · pfSense · reported by vultures@jpcert.or.jpHigh 8.8
Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing files on the file system, which may result in arbitrary command execution.
- Product
- pfSense CE and pfSense Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.netgate.comjvn.jp
Mar 31, 2022Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to CVE-2022-24299 · Other software · pfSense · reported by vultures@jpcert.or.jpHigh 8.8
Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command.
- Product
- pfSense CE and pfSense Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.netgate.comjvn.jp
Mar 31, 2022Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and CVE-2021-20729 · Other software · pfSense · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a remote attacker to inject an arbitrary script via a malicious URL.
- Product
- pfSense CE and pfSense Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.netgate.comjvn.jp
Mar 10, 2022Directory traversal vulnerability in pfSense-pkg-WireGuard pfSense-pkg-WireGuard 0.1.5 versions prior to 0.1.5_4 and pfSense-pkg-WireGuard 0.1.6 versions prior CVE-2022-21132 · Other software · pfSense · reported by vultures@jpcert.or.jpMedium 6.5
Directory traversal vulnerability in pfSense-pkg-WireGuard pfSense-pkg-WireGuard 0.1.5 versions prior to 0.1.5_4 and pfSense-pkg-WireGuard 0.1.6 versions prior to 0.1.6_1 allows a remote authenticated attacker to lead a pfSense user to view a file outside the public folder.
- Product
- pfSense-pkg-WireGuard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2022diag_routes.php in pfSense 2.5.2 allows sed data injection.CVE-2021-41282 · Other software · Pfsense · reported by MITREHigh 8.8
diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (i.e., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary location.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdocs.netgate.com
Feb 21, 2022A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts.CVE-2022-0564 · Other software · Qlik Sense · reported by csirt@divd.nlMedium 5.3
A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured. The affected URI is /internal_forms_authentication/ the response time of the form is longer if the supplied user does not exists and shorter if the user exists.
- Product
- Qlik Sense Enterprise on Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.qlik.comcsirt.divd.nl
Feb 9, 2022Improper access control in the Intel(R) RealSense(TM) DCM before version 20210625 may allow an authenticated user to potentially enable information disclosure vCVE-2021-33119 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper access control in the Intel(R) RealSense(TM) DCM before version 20210625 may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Realsense Depth Camera Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS.CVE-2022-23993 · Other software · Pfsense · reported by MITREMedium 6.1
/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.netgate.comgithub.com
Dec 8, 2021SYNEL - eharmonynew / Synel Reports - The attacker can log in to the system with default credentials and export a report of eharmony system with sensetive data CVE-2021-36718 · Other software · SYNEL · reported by cna@cyber.gov.ilMedium 6.1
SYNEL - eharmonynew / Synel Reports - The attacker can log in to the system with default credentials and export a report of eharmony system with sensetive data (Employee name, Employee ID number, Working hours etc') The vulnerabilety has been addressed and fixed on version 11. Default credentials , Security miscommunication , Sensetive data exposure vulnerability in Synel Reports of SYNEL eharmonynew, Synel Reports allows an attacker to log into the system with default credentials. This issue affects: SYNEL eharmonynew, Synel Reports 8.0.2 version 11 and prior versions.
- Product
- Synel eharmonynew, Synel Reports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Uncontrolled search path in the Intel(R) RealSense(TM) D400 Series UWP driver for Windows 10 before version 6.1.160.22 may allow an authenticated user to potentCVE-2021-33063 · Other software · Intel · reported by secure@intel.comHigh 7.8
Uncontrolled search path in the Intel(R) RealSense(TM) D400 Series UWP driver for Windows 10 before version 6.1.160.22 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Realsense D400 Series Universal Windows Platform Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2021A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester.CVE-2021-42770 · Other software · Opnsense · reported by MITREMedium 6.1
A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester.
- Product
- Opnsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.orange.comgithub.com
Jul 12, 2021An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php, a component of the pfSense software WebGUI, on veCVE-2020-19203 · Other software · Netgate · reported by MITREMedium 5.4
An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php, a component of the pfSense software WebGUI, on version 2.4.4-p2 and earlier. The widget did not encode the descr (description) parameter of wake-on-LAN entries in its output, leading to a possible stored XSS.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.netgate.comgist.github.com
Jul 12, 2021A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4.4CVE-2020-19201 · Other software · Netgate · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4.4-p2 and earlier. The page did not encode output from the filter reload process, and a stored XSS was possible via the descr (description) parameter on NAT rules.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.netgate.comgist.github.com
Jun 9, 2021Protection mechanism failure in some Intel(R) RealSense(TM) IDs may allow an unauthenticated user to potentially enable escalation of privilege via physical accCVE-2020-24515 · Other software · Intel · reported by secure@intel.comMedium 6.8
Protection mechanism failure in some Intel(R) RealSense(TM) IDs may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
- Product
- Realsense ID F450 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Improper authentication in some Intel(R) RealSense(TM) IDs may allow an unauthenticated user to potentially enable escalation of privilege via physical access.CVE-2020-24514 · Other software · Intel · reported by secure@intel.comMedium 6.8
Improper authentication in some Intel(R) RealSense(TM) IDs may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
- Product
- Realsense ID F450 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021A vulnerability exists in gowitness < 2.3.6 that allows an unauthenticated attacker to perform an arbitrary file read using the file:// scheme in the url parameCVE-2021-33359 · Other software · Sensepost · reported by MITREHigh 7.5
A vulnerability exists in gowitness < 2.3.6 that allows an unauthenticated attacker to perform an arbitrary file read using the file:// scheme in the url parameter to get an image of any file.
- Product
- Gowitness
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2021An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization oCVE-2021-31643 · Other software · Chiyu-tech · reported by MITREMedium 5.4
An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization on the component if.cgi - username parameter.
- Product
- Bf-631 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgitbook.seguranca-informatica.pt
Jun 1, 2021A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, anCVE-2021-31642 · Other software · Chiyu-tech · reported by MITREMedium 6.5
A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC. The vulnerability can be explored by sending an unexpected integer (> 32 bits) on the page parameter that will crash the web portal and making it unavailable until a reboot of the device.
- Product
- Semac S2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgitbook.seguranca-informatica.pt
Jun 1, 2021A stored cross-site scripting (XSS) vulnerability was discovered in pfSense 2.4.5-p1 which allows an authenticated attacker to execute arbitrary web scripts viaCVE-2020-26693 · Other software · Pfsense · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability was discovered in pfSense 2.4.5-p1 which allows an authenticated attacker to execute arbitrary web scripts via exploitation of the load_balancer_monitor.php function.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2021An open redirect issue was discovered in OPNsense through 20.1.5.CVE-2020-23015 · Other software · Opnsense · reported by MITREMedium 6.1
An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in login page was not filtered and can redirect user to any website.
- Product
- Opnsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2021pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field.CVE-2021-27933 · Other software · Pfsense · reported by MITREMedium 6.1
pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Feb 17, 2021Incorrect default permissions in the installer for the Intel(R) RealSense(TM) DCM may allow a privileged user to potentially enable escalation of privilege via CVE-2020-8765 · Other software · Intel · reported by secure@intel.comMedium 6.7
Incorrect default permissions in the installer for the Intel(R) RealSense(TM) DCM may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Realsense Depth Camera Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver.CVE-2020-26961 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding attack. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 12, 2020Incorrect default permissions in the Intel(R) RealSense(TM) D400 Series Dynamic Calibration Tool before version 2.11, may allow an authenticated user to potentiCVE-2020-12306 · Other software · Intel · reported by secure@intel.comHigh 7.8
Incorrect default permissions in the Intel(R) RealSense(TM) D400 Series Dynamic Calibration Tool before version 2.11, may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Realsense D400 Series Dynamic Calibration Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2020Improper permissions in the installer for the Intel(R) RealSense(TM) D400 Series UWP driver for Windows* 10 may allow an authenticated user to potentially enablCVE-2020-8763 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper permissions in the installer for the Intel(R) RealSense(TM) D400 Series UWP driver for Windows* 10 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Realsense D415 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2020An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version.CVE-2020-10797 · Other software · Netgate · reported by MITREMedium 6.1
An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version. After passing inputs to the command and executing this command, the $result variable is not sanitized before it is printed.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.netgate.comgithub.com
Apr 1, 2020pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user.CVE-2020-11457 · Other software · Netgate · reported by MITREMedium 5.4
pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 6, 2020Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator configures login credentiCVE-2015-2909 · Other software · Dedicated Micros · reported by cret@cert.orgCritical 9.8
Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator configures login credentials, which makes it easier for remote attackers to obtain access by leveraging situations in which this warning was not heeded. NOTE: the vendor states "The user is presented with clear warnings on the GUI that they should set usernames and passwords."
- Product
- DV-IP Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybergibbons.comkb.cert.org
Nov 14, 2019The Hisense F17 Android device with a build fingerprint of Hisense/F17_4G/HS6739MT:8.1.0/O11019/Hisense_F17_4G_00_S01:user/release-keys contains a pre-installedCVE-2019-15372 · Other software · Hisense · reported by MITREMedium 5.5
The Hisense F17 Android device with a build fingerprint of Hisense/F17_4G/HS6739MT:8.1.0/O11019/Hisense_F17_4G_00_S01:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
- Product
- Infinity F17 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkryptowire.comkryptowire.com
Nov 14, 2019The Hisense U965 Android device with a build fingerprint of Hisense/U965_4G_10/HS6739MT:8.1.0/O11019/Hisense_U965_4G_10_S01:user/release-keys contains a pre-insCVE-2019-15360 · Other software · Hisense · reported by MITREMedium 5.5
The Hisense U965 Android device with a build fingerprint of Hisense/U965_4G_10/HS6739MT:8.1.0/O11019/Hisense_U965_4G_10_S01:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
- Product
- Infinity U965 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkryptowire.comkryptowire.com
Nov 2, 2019/usr/local/www/freeradius_view_config.php in the freeradius3 package before 0.15.7_3 for pfSense on FreeBSD allows a user with an XSS payload as password or useCVE-2019-18667 · Other software · Pfsense · reported by MITREMedium 6.1
/usr/local/www/freeradius_view_config.php in the freeradius3 package before 0.15.7_3 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser.
- Product
- Pfsense-pkg-freeradius3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2019diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands.CVE-2019-16667 · Other software · Netgate · reported by MITREHigh 8.8
diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csrf_callback() produces a "CSRF token expired" error and a Try Again button when a CSRF token is missing.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compastebin.com
Sep 26, 2019An issue was discovered in pfSense through 2.4.4-p3.CVE-2019-16915 · Other software · Netgate · reported by MITRECritical 9.8
An issue was discovered in pfSense through 2.4.4-p3. widgets/widgets/picture.widget.php uses the widgetkey parameter directly without sanitization (e.g., a basename call) for a pathname to file_get_contents or file_put_contents.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comredmine.pfsense.org
Sep 26, 2019An XSS issue was discovered in pfSense through 2.4.4-p3.CVE-2019-16914 · Other software · Netgate · reported by MITREMedium 6.1
An XSS issue was discovered in pfSense through 2.4.4-p3. In services_captiveportal_mac.php, the username and delmac parameters are displayed without sanitization.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comredmine.pfsense.org
Sep 25, 2019pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters iCVE-2019-16701 · Other software · Netgate · reported by MITREHigh 8.8
pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 13, 2019The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.CVE-2016-10954 · WordPress plugins & themes · reported by MITRECritical 9.8
The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.
- Product
- Neosense
- Fixed in
- 1.8
- What to do
- Update Neosense to 1.8 or newer.
Full record and what to do →NVD recordlifeforms.nlwpvulndb.com
Aug 13, 2019The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.CVE-2017-18487 · WordPress plugins & themes · reported by MITREMedium 6.1
The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.
- Product
- adsense-plugin (aka Google AdSense)
- Fixed in
- 1.44
- What to do
- Update adsense-plugin (aka Google AdSense) to 1.44 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jun 25, 2019In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leveraCVE-2019-12949 · Other software · Netgate · reported by MITREMedium 6.1
In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diag_command.php and rrd_fetch_json.php (timePeriod parameter), to a server. Then, the remote attacker can run any command with root privileges on that server.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2019OPNsense 18.7.x before 18.7.7 has Incorrect Access Control.CVE-2018-18958 · Other software · Opnsense · reported by MITREMedium 6.5
OPNsense 18.7.x before 18.7.7 has Incorrect Access Control.
- Product
- Opnsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.opnsense.orgforum.opnsense.org
Jun 2, 2019Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php.CVE-2019-12585 · Other software · Apcupsd · reported by MITRECritical 9.8
Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php.
- Product
- Apcupsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2019Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php.CVE-2019-12584 · Other software · Apcupsd · reported by MITREMedium 6.1
Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php.
- Product
- Apcupsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2019In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php actioCVE-2019-12347 · Other software · Netgate · reported by MITREMedium 6.1
In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. The vulnerability occurs due to input validation errors.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comctrsec.io
May 20, 2019Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges toCVE-2019-11816 · Other software · Netgate · reported by MITREHigh 7.2
Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted request.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.opnsense.orgnetgate.com
Apr 30, 2019An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense EnterpriCVE-2019-11628 · Other software · Qlik · reported by MITREHigh 8.2
An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests.
- Product
- Qlikview Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqliksupport.force.comqliksupport.force.com
Mar 1, 2019In pfSense 2.4.4_1, blocking of source IP addresses on the basis of failed HTTPS authentication is inconsistent with blocking of source IP addresses on the basiCVE-2018-20799 · Other software · Netgate · reported by MITREHigh 7.5
In pfSense 2.4.4_1, blocking of source IP addresses on the basis of failed HTTPS authentication is inconsistent with blocking of source IP addresses on the basis of failed SSH authentication (the behavior does not match the sshguard documentation), which might make it easier for attackers to bypass intended access restrictions.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredmine.pfsense.orgredmine.pfsense.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.