Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 16 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list
33added in the last 30 days
542new WordPress flaws this week
391,528entries in the database

4,359 results · page 68 of 88

  • Sep 26, 2017IBM Business Process Manager 8.0.1.1 and 8.5.7 is vulnerable to cross-site scripting.CVE-2017-1425 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4

    IBM Business Process Manager 8.0.1.1 and 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127478.

    Product
    Business Process Manager Advanced
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordibm.comsecurityfocus.com

  • Sep 25, 2017IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting.CVE-2017-1424 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4

    IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127477.

    Product
    Business Process Manager Advanced
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordibm.comsecurityfocus.com

  • Sep 25, 2017IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by a local user withinCVE-2017-1346 · Other software · IBM · reported by psirt@us.ibm.comLow 2.5

    IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by a local user within a short timespan. IBM X-Force ID: 126461.

    Product
    Business Process Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordibm.comsecurityfocus.com

  • Sep 21, 2017A vulnerability in the Secure Shell (SSH) subsystem of Cisco Small Business Managed Switches software could allow an authenticated, remote attacker to cause a rCVE-2017-6720 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5

    A vulnerability in the Secure Shell (SSH) subsystem of Cisco Small Business Managed Switches software could allow an authenticated, remote attacker to cause a reload of the affected switch, resulting in a denial of service (DoS) condition. The vulnerability is due to improper processing of SSH connections. An attacker could exploit this vulnerability by logging in to an affected switch via SSH and sending a malicious SSH message. This vulnerability affects the following Cisco products when SSH is enabled: Small Business 300 Series Managed Switches, Small Business 500 Series Stackable Managed Switches, 350 Series Managed Switches, 350X Series Stackable Managed Switches, 550X Series Stackable Managed Switches, ESW2 Series Advanced Switches. Cisco Bug IDs: CSCvb48377.

    Product
    Sf302-08pp Firmware
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com

  • Sep 21, 2017A vulnerability in the handling of IP fragments for the Cisco Small Business SPA300, SPA500, and SPA51x Series IP Phones could allow an unauthenticated, remote CVE-2017-12219 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5

    A vulnerability in the handling of IP fragments for the Cisco Small Business SPA300, SPA500, and SPA51x Series IP Phones could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to the inability to handle many large IP fragments for reassembly in a short duration. An attacker could exploit this vulnerability by sending a crafted stream of IP fragments to the targeted device. An exploit could allow the attacker to cause a DoS condition when the device unexpectedly reloads. Cisco Bug IDs: CSCve82586.

    Product
    SPA 301 Firmware
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Sep 15, 2017IBM Business Process Manager (aka BPM) 7.5.x, 8.0.x, and 8.5.x and WebSphere Lombardi Edition (aka WLE) 7.2.x allow remote authenticated users to bypass intendeCVE-2015-0110 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5

    IBM Business Process Manager (aka BPM) 7.5.x, 8.0.x, and 8.5.x and WebSphere Lombardi Edition (aka WLE) 7.2.x allow remote authenticated users to bypass intended access restrictions on internal service types via vectors involving the executeServiceByName URL.

    Product
    Business Process Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comwww-304.ibm.com

  • Sep 5, 2017Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology firmware versions 11.0.25.3001 and 11.0.26.3000 anti-rollbCVE-2017-5698 · Other software · Intel Corporation · reported by secure@intel.comMedium 4.4

    Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology firmware versions 11.0.25.3001 and 11.0.26.3000 anti-rollback will not prevent upgrading to firmware version 11.6.x.1xxx which is vulnerable to CVE-2017-5689 and can be performed by a local user with administrative privileges.

    Product
    Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity-center.intel.comsecurity-center.intel.com

  • Aug 28, 2017Cross-site scripting (XSS) vulnerability in IBM Business Process Manager Standard 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; IBM Business ProcessCVE-2015-0101 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1

    Cross-site scripting (XSS) vulnerability in IBM Business Process Manager Standard 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; IBM Business Process Manager Express 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; and IBM Business Process Manager Advanced 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5.

    Product
    Business Process Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordwww-01.ibm.comsecurityfocus.com

  • Aug 14, 2017A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1CVE-2017-9655 · Other software · Osisoft · reported by ics-cert@hq.dhs.govMedium 5.4

    A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker may be able to upload a malicious script that attempts to redirect users to a malicious web site.

    Product
    PI Integrator For Business Analystics
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov

  • Aug 14, 2017An Improper Authorization issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 CVE-2017-9653 · Other software · Osisoft · reported by ics-cert@hq.dhs.govCritical 9.8

    An Improper Authorization issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker is able to gain privileged access to the system while unauthorized.

    Product
    PI Integrator For Business Analystics
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov

  • Aug 8, 2017Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: AD Utilities).CVE-2017-3562 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: AD Utilities). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications DBA. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications DBA accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications DBA accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).

    Product
    Applications DBA
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp).CVE-2017-10246 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2

    Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data as well as unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

    Product
    Application Object Library
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Account Hierarchy Manager).CVE-2017-10245 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5

    Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Account Hierarchy Manager). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle General Ledger. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle General Ledger accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

    Product
    General Ledger
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Attachments).CVE-2017-10244 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3

    Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Attachments). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

    Product
    Application Object Library
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: Shopping Cart).CVE-2017-10192 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3

    Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: Shopping Cart). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle iStore accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

    Product
    iStore
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle Web Analytics component of Oracle E-Business Suite (subcomponent: Common Libraries).CVE-2017-10191 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2

    Vulnerability in the Oracle Web Analytics component of Oracle E-Business Suite (subcomponent: Common Libraries). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Analytics. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Web Analytics, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Web Analytics accessible data as well as unauthorized update, insert or delete access to some of Oracle Web Analytics accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

    Product
    Web Analytics
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User and Company Profile).CVE-2017-10186 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3

    Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User and Company Profile). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle iStore accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

    Product
    iStore
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: User Management).CVE-2017-10185 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2

    Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: User Management). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

    Product
    CRM Technical Foundation
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle Field Service component of Oracle E-Business Suite (subcomponent: Wireless/WAP).CVE-2017-10184 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3

    Vulnerability in the Oracle Field Service component of Oracle E-Business Suite (subcomponent: Wireless/WAP). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Field Service. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Field Service accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

    Product
    Field Service
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: CMRO).CVE-2017-10180 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2

    Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: CMRO). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

    Product
    CRM Technical Foundation
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Application Management Pack for Oracle E-Business Suite component of Oracle E-Business Suite (subcomponent: User Monitoring).CVE-2017-10179 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the Application Management Pack for Oracle E-Business Suite component of Oracle E-Business Suite (subcomponent: User Monitoring). Supported versions that are affected are AMP 12.1.0.4.0 and AMP 13.1.1.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Management Pack for Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Application Management Pack for Oracle E-Business Suite accessible data as well as unauthorized read access to a subset of Application Management Pack for Oracle E-Business Suite accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

    Product
    Application Management Pack for Oracle E-Business Suite
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Flexfields).CVE-2017-10177 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1

    Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Flexfields). The supported version that is affected is 12.2.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Application Object Library accessible data as well as unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

    Product
    Application Object Library
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: Profiles).CVE-2017-10175 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3

    Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: Profiles). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle iSupport accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

    Product
    iSupport
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: Service Request).CVE-2017-10174 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2

    Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: Service Request). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iSupport, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iSupport accessible data as well as unauthorized update, insert or delete access to some of Oracle iSupport accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

    Product
    iSupport
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: Home Page).CVE-2017-10171 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2

    Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: Home Page). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Marketing, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as unauthorized update, insert or delete access to some of Oracle Marketing accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

    Product
    Marketing
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle Field Service component of Oracle E-Business Suite (subcomponent: Wireless/WAP).CVE-2017-10170 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2

    Vulnerability in the Oracle Field Service component of Oracle E-Business Suite (subcomponent: Wireless/WAP). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Field Service. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Field Service, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Field Service accessible data as well as unauthorized update, insert or delete access to some of Oracle Field Service accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

    Product
    Field Service
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle Applications Manager component of Oracle E-Business Suite (subcomponent: Oracle Diagnostics Interfaces).CVE-2017-10144 · Other software · Oracle · reported by secalert_us@oracle.comHigh 7.5

    Vulnerability in the Oracle Applications Manager component of Oracle E-Business Suite (subcomponent: Oracle Diagnostics Interfaces). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Applications Manager. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

    Product
    Applications Manager
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Preferences).CVE-2017-10143 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2

    Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Preferences). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

    Product
    CRM Technical Foundation
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User Management).CVE-2017-10130 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.6

    Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User Management). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iStore accessible data as well as unauthorized update, insert or delete access to some of Oracle iStore accessible data. CVSS 3.0 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

    Product
    iStore
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: CRM User Management Framework).CVE-2017-10113 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2

    Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: CRM User Management Framework). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Common Applications, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Common Applications accessible data as well as unauthorized update, insert or delete access to some of Oracle Common Applications accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

    Product
    Common Applications
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User Registration).CVE-2017-10112 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2

    Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User Registration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iStore accessible data as well as unauthorized update, insert or delete access to some of Oracle iStore accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

    Product
    iStore
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Aug 8, 2017Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Analytics Web Administration).CVE-2017-10058 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.9

    Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Analytics Web Administration). Supported versions that are affected are 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.0 Base Score 6.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N).

    Product
    Business Intelligence Enterprise Edition
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

  • Jul 11, 2017Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution VulnCVE-2017-0243 · Email & office · Microsoft Corporation · reported by secure@microsoft.comHigh 7.8

    Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8570.

    Product
    Microsoft Office 2007 SP2 and SP3, Microsoft Office 2010 SP2, Microsoft Office Web Apps 2010 SP2, and Microsoft Business Productivity Servers 2010 SP2.
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • Jun 14, 2017A remote code execution vulnerability exists in Skype for Business when the software fails to sanitize specially crafted content, aka "Skype for Business RemoteCVE-2017-8550 · Computers, phones & browsers · Microsoft Corporation · reported by secure@microsoft.comMedium 5.4

    A remote code execution vulnerability exists in Skype for Business when the software fails to sanitize specially crafted content, aka "Skype for Business Remote Code Execution Vulnerability".

    Product
    Skype for Business
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comportal.msrc.microsoft.com

  • Jun 8, 2017IBM Business Process Manager 8.0 and 8.5 are vulnerable to cross-site scripting.CVE-2017-1140 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4

    IBM Business Process Manager 8.0 and 8.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

    Product
    Business Process Manager Advanced
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordibm.comsecurityfocus.com

  • Jun 8, 2017Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a staticCVE-2014-8687 · Other software · Seagate · reported by MITRECritical 9.8

    Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a static encryption key to create session tokens.

    Product
    Business NAS Firmware
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

  • Jun 7, 2017IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents of a file.CVE-2017-1125 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3

    IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents of a file. IBM X-Force ID: 121340.

    Product
    Cognos Business Intelligence
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordibm.comsecurityfocus.com

  • Jun 7, 2017IBM Predictive Solutions Foundation (formerly PMQ) could allow a remote attacker to include arbitrary files.CVE-2016-9710 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3

    IBM Predictive Solutions Foundation (formerly PMQ) could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to specify a file from the local system, which could allow the attacker to obtain sensitive information. IBM X-Force ID: 119618.

    Product
    Cognos Business Intelligence
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordibm.comsecurityfocus.com

  • Jun 7, 2017IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML CVE-2016-0254 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5

    IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote authenticated attacker could exploit this vulnerability to consume all available CPU resources and cause a denial of service. IBM X-Force ID: 110563.

    Product
    Cognos Business Intelligence
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordibm.comsecurityfocus.com

  • Jun 7, 2017An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1.CVE-2017-7314 · Other software · Personify · reported by MITREHigh 7.5

    An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available.

    Product
    Personify360 E-business
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordamswoes.wordpress.comamswoes.wordpress.com

  • Jun 7, 2017An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1.CVE-2017-7313 · Other software · Personify · reported by MITREHigh 7.5

    An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required.

    Product
    Personify360 E-business
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordamswoes.wordpress.comamswoes.wordpress.com

  • Jun 7, 2017An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1.CVE-2017-7312 · Other software · Personifycorp · reported by MITRECritical 9.8

    An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can add a vendor account or read existing vendor account data (including usernames and passwords).

    Product
    Personify360
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordamswoes.wordpress.comamswoes.wordpress.com

  • Jun 5, 2017Openbravo Business Suite 3.0 is affected by SQL injection.CVE-2017-9437 · Other software · Openbravo · reported by MITREHigh 8.8

    Openbravo Business Suite 3.0 is affected by SQL injection. This vulnerability could allow remote authenticated attackers to inject arbitrary SQL code.

    Product
    Openbravo ERP
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordwizlynxgroup.comwizlynxgroup.com

  • May 25, 2017SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to B1iXcellerator/execCVE-2016-6256 · Network & remote access · SAP · reported by MITRECritical 9.6

    SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to B1iXcellerator/exec/soap/vP.001sap0003.in_WCSX/com.sap.b1i.vplatform.runtime/INB_WS_CALL_SYNC_XPT/INB_WS_CALL_SYNC_XPT.ipo/proc, aka SAP Security Note 2378065.

    Product
    Business ONE
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com

  • May 22, 2017IBM Business Process Manager 8.0 and 8.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.CVE-2017-1159 · Other software · IBM Corporation · reported by psirt@us.ibm.comMedium 5.4

    IBM Business Process Manager 8.0 and 8.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 122891.

    Product
    Business Process Manager Advanced
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordibm.comsecurityfocus.com

  • May 16, 2017A vulnerability in the Universal Plug-and-Play (UPnP) implementation in the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, Layer 2-adjacentCVE-2017-3882 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.6

    A vulnerability in the Universal Plug-and-Play (UPnP) implementation in the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, Layer 2-adjacent attacker to execute arbitrary code or cause a denial of service (DoS) condition. The remote code execution could occur with root privileges. The vulnerability is due to incomplete range checks of the UPnP input data, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a malicious request to the UPnP listening port of the targeted device. An exploit could allow the attacker to cause the device to reload or potentially execute arbitrary code with root privileges. This vulnerability affects all firmware releases of the Cisco CVR100W Wireless-N VPN Router prior to Firmware Release 1.0.1.22. Cisco Bug IDs: CSCuz72642.

    Product
    Small Business RV Router Firmware
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • May 3, 2017A vulnerability in the remote management access control list (ACL) feature of the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, remote attCVE-2017-6620 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8

    A vulnerability in the remote management access control list (ACL) feature of the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, remote attacker to bypass the remote management ACL. The vulnerability is due to incorrect implementation of the ACL decision made during the ingress connection request to the remote management interface. An attacker could exploit this vulnerability by sending a connection to the management IP address or domain name of the targeted device. A successful exploit could allow the attacker to bypass the configured remote management ACL. This can occur when the Remote Management configuration parameter is set to Disabled. This vulnerability affects Cisco CVR100W Wireless-N VPN Routers running a firmware image prior to 1.0.1.24. Cisco Bug IDs: CSCvc14457.

    Product
    Small Business RV Series Router Firmware
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com

  • May 2, 2017Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation VulnerabilityCVE-2017-5689 · Other software · Intel · reported by secure@intel.comExploitedCritical 9.8

    Intel products contain a vulnerability which can allow attackers to perform privilege escalation.

    Product
    Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability
    On CISA’s list since
    Jan 28, 2022 (federal fix deadline Jul 28, 2022)
    What to do
    Attackers are using this now. Install Intel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogoracle.comsecurityfocus.com

  • Apr 28, 2017The Business LaLa Call App for Android 1.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof CVE-2017-2104 · Other software · K-Opticom Corporation · reported by vultures@jpcert.or.jpMedium 5.9

    The Business LaLa Call App for Android 1.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

    Product
    Business LaLa Call App for Android
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordjvn.jpsecurityfocus.com

  • Apr 25, 2017Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: Audience workbench).CVE-2017-3434 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1

    Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: Audience workbench). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle One-to-One Fulfillment accessible data as well as unauthorized read access to a subset of Oracle One-to-One Fulfillment accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N).

    Product
    One-to-One Fulfillment
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.