Updated 13 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

37added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

461 results · page 7 of 10

Aug 28, 2017A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges.CVE-2017-1376 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.
Product
Operations Analytics Predictive Insights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com access.redhat.com
Apr 28, 2017IBM Insights Foundation for Energy 1.0, 1.5, and 1.6 could allow an authenticated user to obtain sensitive information from error messages.CVE-2017-1141 · Other software · IBM Corporation · reported by psirt@us.ibm.comMedium 4.3
IBM Insights Foundation for Energy 1.0, 1.5, and 1.6 could allow an authenticated user to obtain sensitive information from error messages. IBM X-Force ID: 121907.
Product
IBM Insights Foundation for Energy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com securityfocus.com
Mar 2, 2017Rapid7 Insight Collector installers prior to version 1.0.16 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a maliciousCVE-2017-5234 · Other software · Rapid7 · reported by cve@rapid7.comHigh 7.8
Rapid7 Insight Collector installers prior to version 1.0.16 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer.
Product
Insight Collector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com community.rapid7.com
Feb 13, 2017An issue was discovered in VideoInsight Web Client Version 6.3.5.11 and previous versions.CVE-2017-5151 · Other software · Panasonic · reported by ics-cert@hq.dhs.govHigh 7.3
An issue was discovered in VideoInsight Web Client Version 6.3.5.11 and previous versions. A SQL Injection vulnerability has been identified, which may allow remote code execution.
Product
Video Insight Web Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Feb 8, 2017EMC Isilon InsightIQ 4.1.0, 4.0.1, 4.0.0, 3.2.2, 3.2.1, 3.2.0, 3.1.1, 3.1.0, 3.0.1, 3.0.0 is affected by an authentication bypass vulnerability that could potenCVE-2017-2765 · Other software · EMC · reported by security_alert@emc.comCritical 9.8
EMC Isilon InsightIQ 4.1.0, 4.0.1, 4.0.0, 3.2.2, 3.2.1, 3.2.0, 3.1.1, 3.1.0, 3.0.1, 3.0.0 is affected by an authentication bypass vulnerability that could potentially be exploited by attackers to compromise the affected system.
Product
Isilon Insightiq
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Feb 2, 2017The Data Warehouse component in NetApp OnCommand Insight before 7.2.3 allows remote attackers to obtain administrative access by leveraging a default privilegedCVE-2017-5600 · Other software · Netapp · reported by MITRECritical 9.8
The Data Warehouse component in NetApp OnCommand Insight before 7.2.3 allows remote attackers to obtain administrative access by leveraging a default privileged account.
Product
Oncommand Insight
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com kb.netapp.com
Feb 1, 2017IBM Infosphere BigInsights is vulnerable to cross-site scripting.CVE-2016-2992 · Other software · IBM Corporation · reported by psirt@us.ibm.comMedium 5.4
IBM Infosphere BigInsights is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Product
BigInsights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com securityfocus.com
Feb 1, 2017IBM Infosphere BigInsights is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.CVE-2016-2924 · Other software · IBM Corporation · reported by psirt@us.ibm.comMedium 5.4
IBM Infosphere BigInsights is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Product
BigInsights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com securityfocus.com
Aug 30, 2016Directory traversal vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.6.0 allows remote attackers to read arbitrary files via unspecified vectorCVE-2016-5332 · Other software · VMware · reported by MITREMedium 5.3
Directory traversal vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.6.0 allows remote attackers to read arbitrary files via unspecified vectors.
Product
Vrealize LOG Insight
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Aug 22, 2016HPE Smart Update in Storage Sizing Tool before 13.0, Converged Infrastructure Solution Sizer Suite (CISSS) before 2.13.1, Power Advisor before 7.8.2, Insight MaCVE-2016-4377 · Other software · HP · reported by MITREHigh 8.1
HPE Smart Update in Storage Sizing Tool before 13.0, Converged Infrastructure Solution Sizer Suite (CISSS) before 2.13.1, Power Advisor before 7.8.2, Insight Management Sizer before 16.12.1, Synergy Planning Tool before 3.3, SAP Sizing Tool before 16.12.1, Sizing Tool for SAP Business Suite powered by HANA before 16.11.1, Sizer for ConvergedSystems Virtualization before 16.7.1, Sizer for Microsoft Exchange Server before 16.12.1, Sizer for Microsoft Lync Server 2013 before 16.12.1, Sizer for Microsoft SharePoint 2013 before 16.13.1, Sizer for Microsoft SharePoint 2010 before 16.11.1, and Sizer for Microsoft Skype for Business Server 2015 before 16.5.1 allows remote attackers to execute arbitrary code via unspecified vectors.
Product
Converged Infrastructure Solution Sizer Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com h20566.www2.hpe.com
Jul 2, 2016Cross-site request forgery (CSRF) vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.3.2 allows remote attackers to hijack the authentication of CVE-2016-2082 · Other software · VMware · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.3.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Product
Vrealize LOG Insight
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com vmware.com
Jul 2, 2016Cross-site scripting (XSS) vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.3.2 allows remote attackers to inject arbitrary web script or HTML CVE-2016-2081 · Other software · VMware · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Vrealize LOG Insight
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com vmware.com
Jun 24, 2016Huawei FusionInsight HD before V100R002C60SPC200 allows local users to gain root privileges via unspecified vectors.CVE-2016-5723 · Other software · Huawei · reported by MITREHigh 7.8
Huawei FusionInsight HD before V100R002C60SPC200 allows local users to gain root privileges via unspecified vectors.
Product
Fusioninsight HD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huawei.com huawei.com
Jun 8, 2016HPE Systems Insight Manager (SIM) before 7.5.1 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecifieCVE-2016-4366 · Other software · HP · reported by MITRECritical 9.8
HPE Systems Insight Manager (SIM) before 7.5.1 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.
Product
Systems Insight Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Jun 8, 2016HPE Insight Control server deployment allows remote attackers to obtain sensitive information via unspecified vectors.CVE-2016-4365 · Other software · HP · reported by MITREHigh 7.5
HPE Insight Control server deployment allows remote attackers to obtain sensitive information via unspecified vectors.
Product
Insight Control Server Deployment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Jun 8, 2016HPE Insight Control server deployment allows local users to gain privileges via unspecified vectors.CVE-2016-4364 · Other software · HP · reported by MITREHigh 8.4
HPE Insight Control server deployment allows local users to gain privileges via unspecified vectors.
Product
Insight Control Server Deployment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Jun 8, 2016HPE Insight Control server deployment allows remote attackers to modify data via unspecified vectors.CVE-2016-4363 · Other software · HP · reported by MITREMedium 6.1
HPE Insight Control server deployment allows remote attackers to modify data via unspecified vectors.
Product
Insight Control Server Deployment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Jun 8, 2016HPE Insight Control server deployment allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.CVE-2016-4362 · Other software · HP · reported by MITREHigh 8.1
HPE Insight Control server deployment allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
Product
Insight Control Server Deployment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Jun 8, 2016HPE Matrix Operating Environment before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a differCVE-2016-4357 · Other software · HP · reported by MITREHigh 8.1
HPE Matrix Operating Environment before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-2028.
Product
Systems Insight Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Jun 8, 2016HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a diffeCVE-2016-2030 · Other software · HP · reported by MITREHigh 8.1
HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-2017, CVE-2016-2019, CVE-2016-2020, CVE-2016-2021, and CVE-2016-2022.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Jun 8, 2016HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerCVE-2016-2029 · Other software · HP · reported by MITRECritical 9.1
HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-4358.
Product
Systems Insight Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Jun 8, 2016HPE Matrix Operating Environment before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a differCVE-2016-2028 · Other software · HP · reported by MITREHigh 8.1
HPE Matrix Operating Environment before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-4357.
Product
Systems Insight Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Jun 8, 2016HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than CVCVE-2016-2026 · Other software · HP · reported by MITREHigh 7.5
HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2016-2027.
Product
Systems Insight Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Jun 8, 2016HPE Insight Control before 7.5.1 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.CVE-2016-2024 · Other software · HP · reported by MITRECritical 9.8
HPE Insight Control before 7.5.1 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.
Product
Insight Contol
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Jun 8, 2016HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a diffeCVE-2016-2022 · Other software · HP · reported by MITREHigh 8.1
HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-2017, CVE-2016-2019, CVE-2016-2020, CVE-2016-2021, and CVE-2016-2030.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Jun 8, 2016HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a diffeCVE-2016-2021 · Other software · HP · reported by MITREHigh 8.1
HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-2017, CVE-2016-2019, CVE-2016-2020, CVE-2016-2022, and CVE-2016-2030.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Jun 8, 2016HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a diffeCVE-2016-2020 · Other software · HP · reported by MITREHigh 8.1
HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-2017, CVE-2016-2019, CVE-2016-2021, CVE-2016-2022, and CVE-2016-2030.
Product
Systems Insight Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Jun 8, 2016HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a diffeCVE-2016-2019 · Other software · HP · reported by MITREHigh 8.1
HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-2017, CVE-2016-2020, CVE-2016-2021, CVE-2016-2022, and CVE-2016-2030.
Product
Systems Insight Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Jun 8, 2016HPE Systems Insight Manager (SIM) before 7.5.1 allows remote attackers to obtain sensitive information or modify data via unspecified vectors.CVE-2016-2018 · Other software · HP · reported by MITRECritical 9.1
HPE Systems Insight Manager (SIM) before 7.5.1 allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
Product
Systems Insight Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Jun 8, 2016HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a diffeCVE-2016-2017 · Other software · HP · reported by MITREHigh 8.1
HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-2019, CVE-2016-2020, CVE-2016-2021, CVE-2016-2022, and CVE-2016-2030.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20566.www2.hpe.com h20566.www2.hpe.com
Mar 18, 2016Siemens APOGEE Insight uses weak permissions for the application folder, which allows local users to obtain sensitive information or modify data via unspecifiedCVE-2016-3155 · Other software · Siemens · reported by MITRELow 3.4
Siemens APOGEE Insight uses weak permissions for the application folder, which allows local users to obtain sensitive information or modify data via unspecified vectors.
Product
Apogee Insight
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siemens.com ics-cert.us-cert.gov
Mar 11, 2016The REST API in the DTE Energy Insight application before 1.7.8 for Android allows remote authenticated users to obtain unspecified customer information via a SCVE-2016-1562 · Other software · DTE Energy · reported by cret@cert.orgMedium 4.3
The REST API in the DTE Energy Insight application before 1.7.8 for Android allows remote authenticated users to obtain unspecified customer information via a SQL expression in the filter parameter.
Product
Insight
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jeffq.com kb.cert.org
Jan 5, 2016HP Insight Control server provisioning before 7.5.0 RabbitMQ allows remote attackers to obtain sensitive information via unspecified vectors.CVE-2015-6858 · Other software · HP · reported by MITRELow 3.7
HP Insight Control server provisioning before 7.5.0 RabbitMQ allows remote attackers to obtain sensitive information via unspecified vectors.
Product
Insight Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jan 2, 2016The Big SQL component in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0 allows remote authenticated users to bypass intended access restrictions and CVE-2015-5020 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
The Big SQL component in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0 allows remote authenticated users to bypass intended access restrictions and truncate arbitrary tables via unspecified vectors.
Product
Infosphere Biginsights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com securitytracker.com
Dec 31, 2015Untrusted search path vulnerability in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0, when a DB2 database is used, allows local users to gain privilCVE-2015-1947 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.4
Untrusted search path vulnerability in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0, when a DB2 database is used, allows local users to gain privileges via a Trojan horse library that is loaded by a setuid or setgid program.
Product
Infosphere Biginsights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com www-304.ibm.com
Dec 21, 2015Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other producCVE-2015-1836 · Other software · IBM · reported by Red HatHigh 7.3
Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic.
Product
Infosphere Biginsights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mail-archives.apache.org www-01.ibm.com
Dec 21, 2015The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and oCVE-2015-1772 · Other software · IBM · reported by Red HatHigh 7.3
The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request.
Product
Infosphere Biginsights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mail-archives.apache.org www-01.ibm.com
Nov 8, 2015Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, stores a cleartext BigSheets password in a configuration file, which allows locaCVE-2015-4940 · Websites & servers · Apache · reported by psirt@us.ibm.comLow 2.1
Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, stores a cleartext BigSheets password in a configuration file, which allows local users to obtain sensitive information by reading this file.
Product
Ambari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com securitytracker.com
Nov 8, 2015Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, includes cleartext passwords on a Configs screen, which allows physically proximCVE-2015-4928 · Websites & servers · Apache · reported by psirt@us.ibm.comMedium 4.3
Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, includes cleartext passwords on a Configs screen, which allows physically proximate attackers to obtain sensitive information by reading password fields.
Product
Ambari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com securitytracker.com
Aug 26, 2015HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to CVE-2015-5405 · Other software · HP · reported by hp-security-alert@hp.comMedium 6.5
HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.
Product
Systems Insight Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20564.www2.hpe.com h20564.www2.hpe.com
Aug 26, 2015HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote attackers to obtain senCVE-2015-5404 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.5
HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
Product
Systems Insight Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20564.www2.hpe.com h20564.www2.hpe.com
Aug 26, 2015HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to CVE-2015-5403 · Other software · HP · reported by hp-security-alert@hp.comMedium 4
HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-2139.
Product
Systems Insight Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20564.www2.hpe.com h20564.www2.hpe.com
Aug 26, 2015HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows local users to gain privilegesCVE-2015-5402 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.2
HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows local users to gain privileges, and consequently obtain sensitive information, modify data, or cause a denial of service, via unspecified vectors.
Product
Systems Insight Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20564.www2.hpe.com h20564.www2.hpe.com
Aug 26, 2015HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to CVE-2015-2140 · Other software · HP · reported by hp-security-alert@hp.comMedium 6.5
HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
Product
Systems Insight Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20564.www2.hpe.com h20564.www2.hpe.com
Aug 26, 2015HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to CVE-2015-2139 · Other software · HP · reported by hp-security-alert@hp.comMedium 4
HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5403.
Product
Systems Insight Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h20564.www2.hpe.com h20564.www2.hpe.com
Apr 22, 2015The Big SQL component in IBM InfoSphere BigInsights 3.0 through 3.0.0.2 allows remote authenticated users to bypass intended HDFS data-access restrictions via (CVE-2015-1889 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
The Big SQL component in IBM InfoSphere BigInsights 3.0 through 3.0.0.2 allows remote authenticated users to bypass intended HDFS data-access restrictions via (1) a crafted CREATE HADOOP TABLE statement referencing the data of an arbitrary user or (2) an import of a certain Hive table definition with the HCAT_SYNC_OBJECTS procedure.
Product
Infosphere Biginsights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com securitytracker.com
Feb 24, 2015IBM Rational Insight 1.1.1.5 allows remote attackers to bypass authentication and obtain sensitive information via a crafted request to a Jazz Reporting ServiceCVE-2014-6115 · Other software · IBM · reported by psirt@us.ibm.comMedium 5
IBM Rational Insight 1.1.1.5 allows remote attackers to bypass authentication and obtain sensitive information via a crafted request to a Jazz Reporting Service (JRS) report URL.
Product
Rational Insight
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com www-01.ibm.com
Feb 12, 2015The alert module in IBM InfoSphere BigInsights 2.1.2 and 3.x before 3.0.0.2 allows remote attackers to obtain sensitive Alert management-services API informatioCVE-2014-4781 · Other software · IBM · reported by psirt@us.ibm.comMedium 5
The alert module in IBM InfoSphere BigInsights 2.1.2 and 3.x before 3.0.0.2 allows remote attackers to obtain sensitive Alert management-services API information via a network-tracing attack.
Product
Infosphere Biginsights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com exchange.xforce.ibmcloud.com
Jan 15, 2015Cross-site scripting (XSS) vulnerability in the server in HP Insight Control allows remote attackers to inject arbitrary web script or HTML via unspecified vectCVE-2014-7881 · Other software · HP · reported by hp-security-alert@hp.comMedium 4.3
Cross-site scripting (XSS) vulnerability in the server in HP Insight Control allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Insight Control Server Deployment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com h20564.www2.hp.com
Dec 12, 2014Cross-site scripting (XSS) vulnerability in EMC Isilon InsightIQ 2.x and 3.x before 3.1 allows remote attackers to inject arbitrary web script or HTML via unspeCVE-2014-4628 · Other software · EMC · reported by security_alert@emc.comMedium 4.3
Cross-site scripting (XSS) vulnerability in EMC Isilon InsightIQ 2.x and 3.x before 3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Isilon Insightiq
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com archives.neohapsis.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.