Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
428 results · page 6 of 9
Nov 16, 2020In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeoverCVE-2020-27422 · Other software · Anuko · reported by MITRECritical 9.8
In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.
- Product
- Time Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comanuko.com
Oct 16, 2020In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formuCVE-2020-15255 · Other software · anuko · reported by GitHubHigh 8.7
In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value starts with an equal sign). This is fixed in version 1.19.23.5325.
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 17, 2020In getNotificationBuilder of CarrierServiceStateTracker.java, there is a possible permission bypass due to an unsafe PendingIntent.CVE-2020-0397 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In getNotificationBuilder of CarrierServiceStateTracker.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-155092443
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Sep 3, 2020A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated user to execute authentication bypass with SQL injectCVE-2020-24193 · Other software · Daily Tracker System Project · reported by MITRECritical 9.8
A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated user to execute authentication bypass with SQL injection via the email parameter.
- Product
- Daily Tracker System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jul 6, 2020PlayerGeneric.cpp in MilkyTracker through 1.02.00 has a use-after-free in the PlayerGeneric destructor.CVE-2020-15569 · Other software · Milkytracker Project · reported by MITREMedium 5.5
PlayerGeneric.cpp in MilkyTracker through 1.02.00 has a use-after-free in the PlayerGeneric destructor.
- Product
- Milkytracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jun 26, 2020Support Incident Tracker (aka SiT! or SiTracker) 3.67 p2 allows post-authentication SQL injection via the site_edit.php typeid or site parameter, the search_incCVE-2020-15308 · Other software · Turnkeylinux · reported by MITREHigh 7.2
Support Incident Tracker (aka SiT! or SiTracker) 3.67 p2 allows post-authentication SQL injection via the site_edit.php typeid or site parameter, the search_incidents_advanced.php search_title parameter, or the report_qbe.php criteriafield parameter.
- Product
- Support Incident Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Mar 30, 2020In Intland codeBeamer ALM 9.5 and earlier, there is stored XSS via the Trackers Title parameter.CVE-2019-19913 · Other software · Intland · reported by MITREMedium 4.8
In Intland codeBeamer ALM 9.5 and earlier, there is stored XSS via the Trackers Title parameter.
- Product
- Codebeamer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 31, 2020Stack-based buffer overflow in the gps_tracker function in airodump-ng.c in Aircrack-ng before 1.2 RC 1 allows local users to execute arbitrary code or gain priCVE-2014-8321 · Other software · Aircrack-ng · reported by MITREHigh 7.8
Stack-based buffer overflow in the gps_tracker function in airodump-ng.c in Aircrack-ng before 1.2 RC 1 allows local users to execute arbitrary code or gain privileges via unspecified vectors.
- Product
- Aircrack-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaircrack-ng.blogspot.compacketstormsecurity.com
Jan 2, 2020In Support Incident Tracker (SiT!) 3.67, the id parameter is affected by XSS on all endpoints that use this parameter, a related issue to CVE-2012-2235.CVE-2019-20223 · Other software · Sitracker · reported by MITREMedium 6.1
In Support Incident Tracker (SiT!) 3.67, the id parameter is affected by XSS on all endpoints that use this parameter, a related issue to CVE-2012-2235.
- Product
- Support Incident Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfatihhcelik.blogspot.comfatihhcelik.blogspot.com
Jan 2, 2020In Support Incident Tracker (SiT!) 3.67, the Short Application Name and Application Name inputs in the config.php page are affected by XSS.CVE-2019-20222 · Other software · Sitracker · reported by MITREMedium 6.1
In Support Incident Tracker (SiT!) 3.67, the Short Application Name and Application Name inputs in the config.php page are affected by XSS.
- Product
- Support Incident Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfatihhcelik.blogspot.comfatihhcelik.blogspot.com
Jan 2, 2020In Support Incident Tracker (SiT!) 3.67, Load Plugins input in the config.php page is affected by XSS.CVE-2019-20221 · Other software · Sitracker · reported by MITREMedium 6.1
In Support Incident Tracker (SiT!) 3.67, Load Plugins input in the config.php page is affected by XSS. The XSS payload is, for example, executed on the about.php page.
- Product
- Support Incident Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfatihhcelik.blogspot.comfatihhcelik.blogspot.com
Jan 2, 2020In Support Incident Tracker (SiT!) 3.67, the search_id parameter in the search_incidents_advanced.php page is affected by XSS.CVE-2019-20220 · Other software · Sitracker · reported by MITREMedium 6.1
In Support Incident Tracker (SiT!) 3.67, the search_id parameter in the search_incidents_advanced.php page is affected by XSS.
- Product
- Support Incident Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfatihhcelik.blogspot.comfatihhcelik.blogspot.com
Oct 16, 2019Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Order Tracker).CVE-2019-2990 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Order Tracker). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iStore accessible data as well as unauthorized update, insert or delete access to some of Oracle iStore accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
- Product
- iStore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2019Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE-2018-4993).CVE-2019-17497 · Other software · Pdf-xchange · reported by MITREMedium 6.5
Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE-2018-4993). For example, an NTLM hash is sent for a link to \\192.168.0.2\C$\file.pdf without user interaction.
- Product
- Pdf-xchange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2019SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user.CVE-2019-17307 · Other software · Sugarcrm · reported by MITREHigh 7.2
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user.
- Product
- Sugarcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sugarcrm.comsupport.sugarcrm.com
Sep 10, 2019The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.CVE-2017-18605 · WordPress plugins & themes · reported by MITRECritical 9.8
The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.
- Product
- gravitate-qa-tracker
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update gravitate-qa-tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 21, 2019The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.CVE-2017-18554 · WordPress plugins & themes · reported by MITREMedium 6.1
The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.
- Product
- analytics-tracker
- Fixed in
- 1.1.1
- What to do
- Update analytics-tracker to 1.1.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 2, 2019An issue was discovered in Schism Tracker through 20190722.CVE-2019-14524 · Other software · Schismtracker · reported by MITREHigh 7.8
An issue was discovered in Schism Tracker through 20190722. There is a heap-based buffer overflow via a large number of song patterns in fmt_mtm_load_song in fmt/mtm.c, a different vulnerability than CVE-2019-14465.
- Product
- Schism Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Aug 2, 2019An issue was discovered in Schism Tracker through 20190722.CVE-2019-14523 · Other software · Schismtracker · reported by MITREHigh 7.8
An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga Oktalyzer parser in fmt/okt.c.
- Product
- Schism Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Aug 1, 2019ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.CVE-2019-14497 · Other software · Milkytracker Project · reported by MITREHigh 7.8
ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.
- Product
- Milkytracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Aug 1, 2019LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.CVE-2019-14496 · Other software · Milkytracker Project · reported by MITREHigh 7.8
LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.
- Product
- Milkytracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 31, 2019fmt_mtm_load_song in fmt/mtm.c in Schism Tracker 20190722 has a heap-based buffer overflow.CVE-2019-14465 · Other software · Schismtracker · reported by MITREHigh 7.8
fmt_mtm_load_song in fmt/mtm.c in Schism Tracker 20190722 has a heap-based buffer overflow.
- Product
- Schism Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2019XMFile::read in XMFile.cpp in milkyplay in MilkyTracker 1.02.00 has a heap-based buffer overflow.CVE-2019-14464 · Other software · Milkytracker Project · reported by MITREMedium 5.5
XMFile::read in XMFile.cpp in milkyplay in MilkyTracker 1.02.00 has a heap-based buffer overflow.
- Product
- Milkytracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 23, 2019Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local priCVE-2019-12162 · Other software · Upwork · reported by MITREHigh 7.8
Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the original update.exe.
- Product
- Time Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.upwork.comvuldb.com
Jul 15, 2019On Fitbit activity-tracker devices, certain addresses never change.CVE-2014-10374 · Other software · Fitbit · reported by MITREMedium 6.5
On Fitbit activity-tracker devices, certain addresses never change. According to the popets-2019-0036.pdf document, this leads to "permanent trackability" and "considerable privacy concerns" without a user-accessible anonymization feature. The devices, such as Charge 2, transmit Bluetooth Low Energy (BLE) advertising packets with a TxAdd flag indicating random addresses, but the addresses remain constant. If devices come within BLE range at one or more locations where an adversary has set up passive sniffing, the adversary can determine whether the same device has entered one of these locations.
- Product
- Charge 2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpetsymposium.orgtwitter.com
Mar 21, 2019The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attaCVE-2018-18898 · Other software · Bestpractical · reported by MITREHigh 7.5
The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbestpractical.comlists.debian.org
Mar 8, 2019A buffer overflow in the kernel driver CybKernelTracker.sys in CyberArk Endpoint Privilege Manager versions prior to 10.7 allows an attacker (without AdministraCVE-2019-9627 · Other software · Cyberark · reported by MITREHigh 7
A buffer overflow in the kernel driver CybKernelTracker.sys in CyberArk Endpoint Privilege Manager versions prior to 10.7 allows an attacker (without Administrator privileges) to escalate privileges or crash the machine by loading an image, such as a DLL, with a long path.
- Product
- Endpoint Privilege Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Mar 12, 2018A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 allows attackers to execute arbitrary SQLCVE-2018-7538 · Other software · Enalean · reported by MITRECritical 9.8
A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 allows attackers to execute arbitrary SQL commands.
- Product
- Tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Feb 17, 2018SQL Injection exists in the File Download Tracker 3.0 component for Joomla! via the dynfield[phone] or sess parameter.CVE-2018-6004 · Other software · Techsolsystem · reported by MITRECritical 9.8
SQL Injection exists in the File Download Tracker 3.0 component for Joomla! via the dynfield[phone] or sess parameter.
- Product
- File Download Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jan 31, 2018Tracker PDF-XChange Viewer and Viewer AX SDK before 2.5.322.8 mishandle conversion from YCC to RGB colour spaces by calculating on the basis of 1 bpc instead ofCVE-2018-6462 · Other software · Tracker-software · reported by MITREHigh 7.8
Tracker PDF-XChange Viewer and Viewer AX SDK before 2.5.322.8 mishandle conversion from YCC to RGB colour spaces by calculating on the basis of 1 bpc instead of 8 bpc, which might allow remote attackers to execute arbitrary code via a crafted PDF document.
- Product
- Pdf-xchange Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.detracker-software.com
Jan 25, 2018Multiple SQL injections exist in SugarCRM Community Edition 6.5.26 and below via the track parameter to modules\Campaigns\Tracker.php and modules\Campaigns\utilCVE-2018-6308 · Other software · Sugarcrm · reported by MITRECritical 9.8
Multiple SQL injections exist in SugarCRM Community Edition 6.5.26 and below via the track parameter to modules\Campaigns\Tracker.php and modules\Campaigns\utils.php, the default_currency_name parameter to modules\Configurator\controller.php and modules\Currencies\Currency.php, the duplicate parameter to modules\Contacts\ShowDuplicates.php, the mergecur parameter to modules\Currencies\index.php and modules\Opportunities\Opportunity.php, and the load_signed_id parameter to modules\Documents\Document.php.
- Product
- Sugarcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddefensecode.comdefensecode.com
Jan 10, 2018Office Tracker 11.2.5 has XSS via the logincount parameter to the /otweb/OTPClientLogin URI.CVE-2017-18023 · Other software · Officetracker · reported by MITREMedium 6.1
Office Tracker 11.2.5 has XSS via the logincount parameter to the /otweb/OTPClientLogin URI.
- Product
- Officetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Dec 27, 2017The launchURL function in PDF-XChange Viewer 2.5 (Build 314.0) might allow remote attackers to execute arbitrary code via a crafted PDF file.CVE-2017-13056 · Other software · Tracker-software · reported by MITREHigh 7.8
The launchURL function in PDF-XChange Viewer 2.5 (Build 314.0) might allow remote attackers to execute arbitrary code via a crafted PDF file.
- Product
- Pdf-xchange Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 6, 2017Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.2 allow remote attackers to inject arbitrary web script or HTML viaCVE-2015-2148 · Websites & servers · Phpbugtracker Project · reported by MITREMedium 4.8
Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.2 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
- Product
- Phpbugtracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Oct 6, 2017Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands via unspecified paramCVE-2015-2147 · Websites & servers · Phpbugtracker Project · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands via unspecified parameters.
- Product
- Phpbugtracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.killedkenny.ioopenwall.com
Oct 6, 2017Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameCVE-2015-2146 · Websites & servers · Phpbugtracker Project · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to project.php, the (2) group_id parameter to group.php, the (3) status_id parameter to status.php, the (4) resolution_id parameter to resolution.php, the (5) severity_id parameter to severity.php, the (6) priority_id parameter to priority.php, the (7) os_id parameter to os.php, or the (8) site_id parameter to site.php.
- Product
- Phpbugtracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 6, 2017Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to inject arbitrary web script or HTML viaCVE-2015-2145 · Websites & servers · Phpbugtracker Project · reported by MITREMedium 4.8
Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
- Product
- Phpbugtracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Oct 6, 2017Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to inject arbitrary web script oCVE-2015-2144 · Websites & servers · Phpbugtracker Project · reported by MITREMedium 4.8
Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) project name parameter to project.php; the (2) use_js parameter to user.php; the (3) use_js parameter to group.php; the (4) Description parameter to status.php; the (5) Description parameter to severity.php; the (6) Regex parameter to os.php; or the (7) Name parameter to database.php.
- Product
- Phpbugtracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 6, 2017Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to hijack the authentication of useCVE-2015-2143 · Websites & servers · Phpbugtracker Project · reported by MITREHigh 8.8
Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to hijack the authentication of users for requests that cause an unspecified impact via unknown parameters.
- Product
- Phpbugtracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Oct 6, 2017Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to (1) hijack the authentCVE-2015-2142 · Websites & servers · Phpbugtracker Project · reported by MITREHigh 8
Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to (1) hijack the authentication of users for requests that cause an unspecified impact via the id parameter to project.php, (2) hijack the authentication of users for requests that cause an unspecified impact via the group_id parameter to group.php, (3) hijack the authentication of users for requests that delete statuses via the status_id parameter to status.php, (4) hijack the authentication of users for requests that delete severities via the severity_id parameter to severity.php, (5) hijack the authentication of users for requests that cause an unspecified impact via the priority_id parameter to priority.php, (6) hijack the authentication of users for requests that delete the operating system via the os_id parameter to os.php, (7) hijack the authentication of users for requests that delete databases via the database_id parameter to database.php, or (8) hijack the authentication of users for requests that delete sites via the site_id parameter to sites.php.
- Product
- Phpbugtracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Sep 14, 2017Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting new contacts into thCVE-2017-1002007 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table.
- Affected
- 1.5 to 1.5
- What to do
- Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Sep 14, 2017Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts intoCVE-2017-1002006 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table.
- Affected
- 1.5 to 1.5
- What to do
- Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Sep 14, 2017Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the enCVE-2017-1002005 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the end of an SQL query.
- Affected
- 1.5 to 1.5
- What to do
- Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Sep 14, 2017Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of aCVE-2017-1002004 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of an SQL query.
- Affected
- 1.5 to 1.5
- What to do
- Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Jul 3, 2017The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated useCVE-2017-5944 · Other software · Bestpractical · reported by MITREHigh 8.8
The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Jul 3, 2017Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site reqCVE-2017-5943 · Other software · Bestpractical · reported by MITREHigh 8.8
Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site request forgery (CSRF) verification tokens via a crafted URL.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Jul 3, 2017Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes iCVE-2017-5361 · Other software · Bestpractical · reported by MITREMedium 5.9
Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote attackers to obtain sensitive user password information via a timing side-channel attack.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2017Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachmeCVE-2016-6127 · Other software · Bestpractical · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified content type.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
May 5, 2017The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app 3.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-tCVE-2017-5906 · Other software · Everyday Health INC · reported by MITREMedium 5.9
The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app 3.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Diabetes IN Check\
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2017Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS TrackerCVE-2017-5239 · Other software · Eview · reported by cve@rapid7.comHigh 7.5
Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS Tracker discloses personally identifying information, such as GPS data and IMEI numbers, to any man-in-the-middle (MitM) listener.
- Product
- EV-07S GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comcommunity.rapid7.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.