Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
460 results · page 7 of 10
Aug 5, 2021Acronis True Image prior to 2021 Update 4 for Windows and Acronis True Image prior to 2021 Update 5 for macOS allowed an unauthenticated attacker (who has a locCVE-2021-32579 · Other software · Acronis · reported by MITREHigh 7.8
Acronis True Image prior to 2021 Update 4 for Windows and Acronis True Image prior to 2021 Update 5 for macOS allowed an unauthenticated attacker (who has a local code execution ability) to tamper with the micro-service API.
- Product
- True Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.acronis.comkb.acronis.com
Aug 5, 2021Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 2 of 2).CVE-2021-32578 · Other software · Acronis · reported by MITREHigh 7.8
Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 2 of 2).
- Product
- True Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.acronis.comkb.acronis.com
Aug 5, 2021Acronis True Image prior to 2021 Update 5 for Windows allowed local privilege escalation due to insecure folder permissions.CVE-2021-32577 · Other software · Acronis · reported by MITREHigh 7.8
Acronis True Image prior to 2021 Update 5 for Windows allowed local privilege escalation due to insecure folder permissions.
- Product
- True Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.acronis.comkb.acronis.com
Aug 5, 2021Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 1 of 2).CVE-2021-32576 · Other software · Acronis · reported by MITREHigh 7.8
Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 1 of 2).
- Product
- True Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.acronis.comkb.acronis.com
Jul 30, 2021A logic bug in system monitoring driver of Acronis Agent after 12.5.21540 and before 12.5.23094 allowed to bypass Windows memory protection and access sensitiveCVE-2020-14999 · Other software · Acronis · reported by MITREHigh 7.5
A logic bug in system monitoring driver of Acronis Agent after 12.5.21540 and before 12.5.23094 allowed to bypass Windows memory protection and access sensitive data.
- Product
- Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordacronis.comacronis.com
Jul 16, 2021Micronaut is a JVM-based, full stack Java framework designed for building JVM applications.CVE-2021-32769 · Other software · micronaut-projects · reported by GitHubHigh 7.5
Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. With a basic configuration, it is possible to access any file from a filesystem, using "/../../" in the URL. This occurs because Micronaut does not restrict file access to configured paths. The vulnerability is patched in version 2.5.9. As a workaround, do not use `**` in mapping, use only `*`, which exposes only flat structure of a directory not allowing traversal. If using Linux, another workaround is to run micronaut in chroot.
- Product
- micronaut-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2021Acronis True Image 2019 update 1 through 2021 update 1 on macOS allows local privilege escalation due to an insecure XPC service configuration.CVE-2020-25736 · Other software · Acronis · reported by MITREHigh 7.8
Acronis True Image 2019 update 1 through 2021 update 1 on macOS allows local privilege escalation due to an insecure XPC service configuration.
- Product
- True Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comkb.acronis.com
Jul 15, 2021Acronis True Image through 2021 on macOS allows local privilege escalation from admin to root due to insecure folder permissions.CVE-2020-25593 · Other software · Acronis · reported by MITREMedium 6.7
Acronis True Image through 2021 on macOS allows local privilege escalation from admin to root due to insecure folder permissions.
- Product
- True Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.acronis.comacronis.com
Jul 15, 2021Acronis True Image 2019 update 1 through 2020 on macOS allows local privilege escalation due to an insecure XPC service configuration.CVE-2020-15495 · Other software · Acronis · reported by MITREHigh 7.8
Acronis True Image 2019 update 1 through 2020 on macOS allows local privilege escalation due to an insecure XPC service configuration.
- Product
- True Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.acronis.comacronis.com
Jul 15, 2021Acronis True Image for Mac before 2021 Update 4 allowed local privilege escalation due to insecure folder permissions.CVE-2020-15496 · Other software · Acronis · reported by MITREHigh 7.8
Acronis True Image for Mac before 2021 Update 4 allowed local privilege escalation due to insecure folder permissions.
- Product
- True Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.acronis.comacronis.com
Jun 24, 2021In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php.CVE-2020-21786 · Other software · Ibos · reported by MITRECritical 9.8
In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2021In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server.CVE-2018-16497 · Other software · Versa-networks · reported by support@hackerone.comHigh 7.8
In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server. If the job is run as the user root, there is a potential privilege escalation vulnerability. In this case, the job runs a script as root that is writable by users who are members of the versa group.
- Product
- Versa Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
May 25, 2021An issue was discovered in Acronis True Image 2020 24.5.22510.CVE-2020-9452 · Other software · Acronis · reported by MITREHigh 7.8
An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe includes functionality to quarantine files by copying a suspected ransomware file from one directory to another using SYSTEM privileges. Because unprivileged users have write permissions in the quarantine folder, it is possible to control this privileged write with a hardlink. This means that an unprivileged user can write/overwrite arbitrary files in arbitrary folders. Escalating privileges to SYSTEM is trivial with arbitrary writes. While the quarantine feature is not enabled by default, it can be forced to copy the file to the quarantine by communicating with anti_ransomware_service.exe through its REST API.
- Product
- True Image 2020
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddanishcyberdefence.dkmadsjoensen.dk
May 25, 2021An issue was discovered in Acronis True Image 2020 24.5.22510.CVE-2020-9451 · Other software · Acronis · reported by MITREMedium 5.5
An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe keeps a log in a folder where unprivileged users have write permissions. The logs are generated in a predictable pattern, allowing an unprivileged user to create a hardlink from a (not yet created) log file to anti_ransomware_service.exe. On reboot, this forces the anti_ransomware_service to try to write its log into its own process, crashing in a SHARING VIOLATION. This crash occurs on every reboot.
- Product
- True Image 2020
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddanishcyberdefence.dkmadsjoensen.dk
May 25, 2021An issue was discovered in Acronis True Image 2020 24.5.22510.CVE-2020-9450 · Other software · Acronis · reported by MITREHigh 7.8
An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe exposes a REST API that can be used by everyone, even unprivileged users. This API is used to communicate from the GUI to anti_ransomware_service.exe. This can be exploited to add an arbitrary malicious executable to the whitelist, or even exclude an entire drive from being monitored by anti_ransomware_service.exe.
- Product
- True Image 2020
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddanishcyberdefence.dkmadsjoensen.dk
Apr 20, 2021OMICRON StationGuard before 1.10 allows remote attackers to cause a denial of service (connectivity outage) via crafted tcp/20499 packets to the CTRL Ethernet pCVE-2021-30464 · Other software · Omicronenergy · reported by MITREHigh 7.5
OMICRON StationGuard before 1.10 allows remote attackers to cause a denial of service (connectivity outage) via crafted tcp/20499 packets to the CTRL Ethernet port.
- Product
- Stationguard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordomicronenergy.comomicronenergy.com
Feb 21, 2021An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172.CVE-2020-35664 · Other software · Acronis · reported by MITREMedium 6.1
An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. There is cross-site scripting (XSS) in the console.
- Product
- Cyber Protect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.managed-protection.comacronis.com
Feb 21, 2021An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172.CVE-2020-35556 · Other software · Acronis · reported by MITREHigh 7.5
An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. Because the local notification service misconfigures CORS, information disclosure can occur.
- Product
- Cyber Protect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.managed-protection.comacronis.com
Jan 29, 2021Acronis True Image for Windows prior to 2021 Update 3 allowed local privilege escalation due to a DLL hijacking vulnerability in multiple components, aka an UntCVE-2020-35145 · Other software · Acronis · reported by MITREHigh 7.8
Acronis True Image for Windows prior to 2021 Update 3 allowed local privilege escalation due to a DLL hijacking vulnerability in multiple components, aka an Untrusted Search Path issue.
- Product
- True Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordacronis.comacronis.com
Dec 30, 2020Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php.CVE-2016-9023 · Other software · Exponentcms · reported by MITRECritical 9.8
Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php.
- Product
- Exponent CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexponentcms.lighthouseapp.comgithub.com
Nov 24, 2020Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them.CVE-2020-26238 · Other software · jmrozanec · reported by GitHubHigh 7.9
Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.
- Product
- cron-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2020Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory.CVE-2020-10140 · Other software · Acronis · reported by cret@cert.orgHigh 7.8
Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory. Because some privileged processes are executed from the C:\ProgramData\Acronis, an unprivileged user can achieve arbitrary code execution with SYSTEM privileges by placing a DLL in one of several paths within C:\ProgramData\Acronis.
- Product
- True Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Oct 21, 2020Acronis True Image 2021 includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\.CVE-2020-10139 · Other software · Acronis · reported by cret@cert.orgHigh 7.8
Acronis True Image 2021 includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis True Image contains a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges.
- Product
- True Image 2021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Oct 21, 2020Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\.CVE-2020-10138 · Other software · Acronis · reported by cret@cert.orgHigh 7.8
Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis Cyber Backup and Cyber Protect contain a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges.
- Product
- Cyber Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 25, 2020cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).CVE-2020-26115 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cpanel.netdocs.cpanel.net
Sep 25, 2020cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).CVE-2020-26114 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cpanel.netdocs.cpanel.net
Sep 24, 2020ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkUserExpirationDate.php.CVE-2020-12842 · Other software · Gogogate · reported by MITRECritical 9.8
ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkUserExpirationDate.php.
- Product
- Ismartgate Pro Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordismartgate.comkth.diva-portal.org
Sep 24, 2020ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkExpirationDate.php.CVE-2020-12839 · Other software · Gogogate · reported by MITRECritical 9.8
ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkExpirationDate.php.
- Product
- Ismartgate Pro Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordismartgate.comkth.diva-portal.org
Sep 24, 2020ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/mailAdmin.php.CVE-2020-12838 · Other software · Gogogate · reported by MITRECritical 9.8
ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/mailAdmin.php.
- Product
- Ismartgate Pro Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordismartgate.comkth.diva-portal.org
Sep 21, 2020An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342.CVE-2020-16171 · Other software · Acronis · reported by MITREMedium 6.5
An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom Shard header. The value of this header is afterwards used in a separate web request issued by the application itself. This can be abused to conduct SSRF attacks against otherwise unreachable Acronis services that are bound to localhost such as the NotificationService on 127.0.0.1:30572.
- Product
- Cyber Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgrcesecurity.com
Jul 17, 2020Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API.CVE-2020-5756 · Other software · Tenable · reported by vulnreport@tenable.comHigh 8.8
Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API. An attacker can use this functionality to execute arbitrary OS commands on the router.
- Product
- Grandstream GWN7000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jun 18, 2020aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via the Script Content box on the Add Cron Job screen.CVE-2020-14421 · Other software · Aapanel · reported by MITREHigh 7.2
aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via the Script Content box on the Add Cron Job screen.
- Product
- Aapanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comforum.aapanel.com
Apr 21, 2020A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system via cron jobs.CVE-2020-10786 · Other software · Vestacp · reported by MITREHigh 8.8
A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system via cron jobs.
- Product
- Vesta Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2020Z-Cron 5.6 Build 04 allows an unprivileged attacker to elevate privileges by modifying a privileged user's task.CVE-2020-11799 · Other software · Z-cron · reported by MITRECritical 9.8
Z-Cron 5.6 Build 04 allows an unprivileged attacker to elevate privileges by modifying a privileged user's task. This can also affect all users who are signed in on the system if a shell is placed in a location that other unprivileged users have access to.
- Product
- Z-cron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.spookysec.netblog.spookysec.net
Apr 2, 2020A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications CVE-2020-8017 · Other software · SUSE · reported by meissner@suse.deMedium 6.2
A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users in group mktex to delete arbitrary files on the system This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.
- Product
- SUSE Linux Enterprise Module for Desktop Applications 15-SP1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgbugzilla.suse.com
Mar 30, 2020All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due toCVE-2020-7611 · Other software · Objectcomputing · reported by report@snyk.ioCritical 9.8
All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client.
- Product
- Micronaut
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2020Modern DRAM chips (DDR4 and LPDDR4 after 2015) are affected by a vulnerability in deployment of internal mitigations against RowHammer attacks known as Target RCVE-2020-10255 · Other software · Micron · reported by MITRECritical 9
Modern DRAM chips (DDR4 and LPDDR4 after 2015) are affected by a vulnerability in deployment of internal mitigations against RowHammer attacks known as Target Row Refresh (TRR), aka the TRRespass issue. To exploit this vulnerability, the attacker needs to create certain access patterns to trigger bit flips on affected memory modules, aka a Many-sided RowHammer attack. This means that, even when chips advertised as RowHammer-free are used, attackers may still be able to conduct privilege-escalation attacks against the kernel, conduct privilege-escalation attacks against the Sudo binary, and achieve cross-tenant virtual-machine access by corrupting RSA keys. The issue affects chips produced by SK Hynix, Micron, and Samsung. NOTE: tracking DRAM supply-chain issues is not straightforward because a single product model from a single vendor may use DRAM chips from different manufacturers.
- Product
- Ddr4 Sdram
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.vusec.netgithub.com
Feb 28, 2020UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; opeCVE-2019-3698 · Other software · SUSE · reported by meissner@suse.deMedium 5.7
UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or potentially escalate privileges by winning a race. This issue affects: SUSE Linux Enterprise Server 12 nagios version 3.5.1-5.27 and prior versions. SUSE Linux Enterprise Server 11 nagios version 3.0.6-1.25.36.3.1 and prior versions. openSUSE Factory nagios version 4.4.5-2.1 and prior versions.
- Product
- SUSE Linux Enterprise Server 12
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Feb 16, 2020Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by crond) and /root/loadCVE-2020-9024 · Other software · Iteris · reported by MITRECritical 9.8
Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by crond) and /root/loadperl.sh (executed as root at boot time) scripts.
- Product
- Vantage Velocity Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsku11army.blogspot.comsku11army.blogspot.com
Nov 21, 2019Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly.CVE-2014-0084 · Other software · rubygem-openshift-origin-node · reported by Red HatMedium 5.5
Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly.
- Product
- rubygem-openshift-origin-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Aug 2, 2019cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257).CVE-2017-18451 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC-332).CVE-2017-18399 · Websites & servers · Cpanel · reported by MITRELow 3.7
cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC-332).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 1, 2019cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task (SEC-352).CVE-2018-20943 · Websites & servers · Cpanel · reported by MITRELow 2.5
cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task (SEC-352).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 1, 2019cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab (SEC-351).CVE-2018-20942 · Websites & servers · Cpanel · reported by MITRELow 2.5
cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab (SEC-351).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 1, 2019cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342).CVE-2018-20940 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 1, 2019cPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing (SEC-382).CVE-2018-20927 · Websites & servers · Cpanel · reported by MITRELow 3.8
cPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing (SEC-382).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 1, 2019cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427).CVE-2018-20904 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 1, 2019cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408).CVE-2018-20902 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
May 24, 2019In Redaxo 5.2.0, the cron management of the admin panel suffers from CSRF that leads to arbitrary Remote Code Execution via addons/cronjob/lib/types/phpcode.phpCVE-2016-10757 · Other software · Readaxo · reported by MITREHigh 8.8
In Redaxo 5.2.0, the cron management of the admin panel suffers from CSRF that leads to arbitrary Remote Code Execution via addons/cronjob/lib/types/phpcode.php.
- Product
- Readaxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.ripstech.comdemo.ripstech.com
Apr 23, 2019In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.CVE-2018-1317 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.
- Product
- Apache Zeppelin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.