Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

497 results · page 7 of 10

May 6, 2021A vulnerability in the web-based messaging service interface of Cisco SD-WAN vManage Software could allow an unauthenticated, adjacent attacker to bypass authenCVE-2021-1284 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.8
A vulnerability in the web-based messaging service interface of Cisco SD-WAN vManage Software could allow an unauthenticated, adjacent attacker to bypass authentication and authorization and modify the configuration of an affected system. To exploit this vulnerability, the attacker must be able to access an associated Cisco SD-WAN vEdge device. This vulnerability is due to insufficient authorization checks. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based messaging service interface of an affected system. A successful exploit could allow the attacker to gain unauthenticated read and write access to the affected vManage system. With this access, the attacker could access information about the affected vManage system, modify the configuration of the system, or make configuration changes to devices that are managed by the system.
Product
Cisco SD-WAN vManage
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Apr 19, 2021The messaging subsystem in the Online Discussion Forum 1.0 is vulnerable to XSS in the message body.CVE-2020-28141 · Other software · Online Discussion Forum Project · reported by MITREMedium 5.4
The messaging subsystem in the Online Discussion Forum 1.0 is vulnerable to XSS in the message body. An authenticated user can send messages to arbitrary users on the system that include javascript that will execute when viewing the messages page.
Product
Online Discussion Forum
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Apr 14, 2021The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Community Edition and TIBCO Messaging - CVE-2021-28826 · Other software · TIBCO Software Inc. · reported by security@tibco.comHigh 8.8
The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Community Edition: versions 1.3.0 and below and TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Enterprise Edition: versions 1.3.0 and below.
Product
TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Community Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tibco.com tibco.com
Apr 14, 2021The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Community Edition and TIBCO Messaging - EcCVE-2021-28825 · Other software · TIBCO Software Inc. · reported by security@tibco.comHigh 8.8
The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Community Edition: versions 1.3.0 and below and TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Enterprise Edition: versions 1.3.0 and below.
Product
TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Community Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tibco.com tibco.com
Apr 13, 2021Microsoft Internet Messaging API Remote Code Execution VulnerabilityCVE-2021-27089 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Internet Messaging API Remote Code Execution Vulnerability
Product
Windows 10 Version 1803
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Jan 28, 2021It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result CVE-2021-20185 · Other software · Moodle · reported by Red HatMedium 5.3
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side (browser) denial of service for users receiving very large messages.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record moodle.org moodle.org
Jan 13, 2021A vulnerability in Cisco Webex Teams could allow an unauthenticated, remote attacker to manipulate file names within the messaging interface.CVE-2021-1242 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in Cisco Webex Teams could allow an unauthenticated, remote attacker to manipulate file names within the messaging interface. The vulnerability exists because the affected software mishandles character rendering. An attacker could exploit this vulnerability by sharing a file within the application interface. A successful exploit could allow the attacker to modify how the shared file name displays within the interface, which could allow the attacker to conduct phishing or spoofing attacks.
Product
Cisco Webex Teams
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Dec 29, 2020An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseLoadIconStreamRequest in messaging.dll.CVE-2020-5806 · Other software · Rockwellautomation · reported by vulnreport@tenable.comMedium 5.5
An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseLoadIconStreamRequest in messaging.dll. This can be done by sending a specially crafted message to 127.0.0.1:7153. Observed in FactoryTalk Linx 6.11. All versions of FactoryTalk Linx are affected.
Product
Factorytalk Linx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
Dec 10, 2020An information disclosure flaw allows a malicious, authenticated, privileged web UI user to obtain a password for a remote SCP backup server that they might notCVE-2020-12595 · Other software · Broadcom · reported by secure@symantec.comMedium 4.9
An information disclosure flaw allows a malicious, authenticated, privileged web UI user to obtain a password for a remote SCP backup server that they might not otherwise be authorized to access. This affects SMG prior to 10.7.4.
Product
Symantec Messaging Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com support.broadcom.com
Dec 10, 2020A privilege escalation flaw allows a malicious, authenticated, privileged CLI user to escalate their privileges on the system and gain full control over the SMGCVE-2020-12594 · Other software · Broadcom · reported by secure@symantec.comHigh 7.2
A privilege escalation flaw allows a malicious, authenticated, privileged CLI user to escalate their privileges on the system and gain full control over the SMG appliance. This affects SMG prior to 10.7.4.
Product
Symantec Messaging Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com support.broadcom.com
Dec 9, 2020Matrix is an ecosystem for open federated Instant Messaging and VoIP.CVE-2020-26257 · Other software · matrix-org · reported by GitHubMedium 6.5
Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).
Product
synapse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 9, 2020Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 has updated a specific critical library that may vulnerable to attack.CVE-2020-27694 · Other software · Trend Micro · reported by security@trendmicro.comHigh 8.8
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 has updated a specific critical library that may vulnerable to attack.
Product
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec-consult.com success.trendmicro.com
Nov 9, 2020Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash that is considered outdated.CVE-2020-27693 · Other software · Trend Micro · reported by security@trendmicro.comMedium 4.4
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash that is considered outdated.
Product
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec-consult.com success.trendmicro.com
Nov 9, 2020Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an information disclosure vulnerability which could allow an attacker toCVE-2020-27019 · Other software · Trend Micro · reported by security@trendmicro.comMedium 5.5
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an information disclosure vulnerability which could allow an attacker to access a specific database and key.
Product
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec-consult.com success.trendmicro.com
Nov 9, 2020Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a server side request forgery vulnerability which could allow an authentCVE-2020-27018 · Other software · Trend Micro · reported by security@trendmicro.comMedium 5.5
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a server side request forgery vulnerability which could allow an authenticated attacker to abuse the product's web server and grant access to web resources or parts of local files. An attacker must already have obtained authenticated privileges on the product to exploit this vulnerability.
Product
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec-consult.com success.trendmicro.com
Nov 9, 2020Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow CVE-2020-27017 · Other software · Trend Micro · reported by security@trendmicro.comMedium 4.9
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability.
Product
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec-consult.com success.trendmicro.com
Nov 9, 2020Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross-site request forgery (CSRF) vulnerability which could allow an aCVE-2020-27016 · Other software · Trend Micro · reported by security@trendmicro.comHigh 8.8
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross-site request forgery (CSRF) vulnerability which could allow an attacker to modify policy rules by tricking an authenticated administrator into accessing an attacker-controlled web page. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability.
Product
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec-consult.com success.trendmicro.com
Nov 6, 2020A vulnerability in virtualization channel messaging in Cisco Webex Meetings Desktop App for Windows could allow a local attacker to execute arbitrary code on a CVE-2020-3588 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.3
A vulnerability in virtualization channel messaging in Cisco Webex Meetings Desktop App for Windows could allow a local attacker to execute arbitrary code on a targeted system. This vulnerability occurs when this app is deployed in a virtual desktop environment and using virtual environment optimization. This vulnerability is due to improper validation of messages processed by the Cisco Webex Meetings Desktop App. A local attacker with limited privileges could exploit this vulnerability by sending malicious messages to the affected software by using the virtualization channel interface. A successful exploit could allow the attacker to modify the underlying operating system configuration, which could allow the attacker to execute arbitrary code with the privileges of a targeted user. Note: This vulnerability can be exploited only when Cisco Webex Meetings Desktop App is in a virtual desktop environment on a hosted virtual desktop (HVD) and is configured to use the Cisco Webex Meetings virtual desktop plug-in for thin clients.
Product
Cisco Webex Meetings Desktop App
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Oct 23, 2020OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API.CVE-2020-15002 · Other software · Open-xchange · reported by MITREMedium 5
OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
Sep 2, 2020A flaw in Trading Technologies Messaging 7.1.28.3 (ttmd.exe) relates to invalid parameter handling when calling strcpy_s() with an invalid parameter (i.e., a loCVE-2020-5779 · Other software · Tradingtechnologies · reported by vulnreport@tenable.comHigh 7.5
A flaw in Trading Technologies Messaging 7.1.28.3 (ttmd.exe) relates to invalid parameter handling when calling strcpy_s() with an invalid parameter (i.e., a long src string parameter) as a part of processing a type 4 message sent to default TCP RequestPort 10200. It's been observed that ttmd.exe terminates as a result.
Product
Trading Technologies Messaging
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
Sep 2, 2020A flaw exists in Trading Technologies Messaging 7.1.28.3 (ttmd.exe) due to improper validation of user-supplied data when processing a type 8 message sent to deCVE-2020-5778 · Other software · Tradingtechnologies · reported by vulnreport@tenable.comHigh 7.5
A flaw exists in Trading Technologies Messaging 7.1.28.3 (ttmd.exe) due to improper validation of user-supplied data when processing a type 8 message sent to default TCP RequestPort 10200. An unauthenticated, remote attacker can exploit this issue, via a specially crafted message, to terminate ttmd.exe.
Product
Trading Technologies Messaging
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
Aug 7, 2020DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG).CVE-2020-11852 · Other software · Microfocus · reported by security@opentext.comHigh 8.8
DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG). Affecting all SMG Appliance running releases prior to July 2020. The vulnerability could allow a logged in user with rights to generate DKIM key information to inject system commands into the call to the DKIM system command.
Product
Secure Messaging Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.microfocus.com support.microfocus.com
Jul 2, 2020In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require aCVE-2020-5910 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
Product
Nginx Controller
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.f5.com support.f5.com
Apr 6, 2020There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module.CVE-2020-11585 · Other software · Dnnsoftware · reported by MITREMedium 4.3
There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager (other than ones contained in a secure folder) by sending themselves a message with the file attached, e.g., by using an arbitrary small integer value in the fileIds parameter.
Product
Dotnetnuke
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record neff.blog neff.blog
Feb 19, 2020A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) feature of Cisco Meeting Server software could allow an unauthenticated, remote attackeCVE-2020-3160 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) feature of Cisco Meeting Server software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition for users of XMPP conferencing applications. Other applications and processes are unaffected. The vulnerability is due to improper input validation of XMPP packets. An attacker could exploit this vulnerability by sending crafted XMPP packets to an affected device. An exploit could allow the attacker to cause process crashes and a DoS condition for XMPP conferencing applications.
Product
Cisco Meeting Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Dec 11, 2019Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a server-side request forgery (SSRF) exploit, which is a type of issue that can let an attackCVE-2019-18379 · Other software · Symantec · reported by secure@symantec.comHigh 7.3
Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a server-side request forgery (SSRF) exploit, which is a type of issue that can let an attacker send crafted requests from the backend server of a vulnerable web application or access services available through the loopback interface.
Product
Messaging Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.symantec.com support.symantec.com
Dec 11, 2019Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to iCVE-2019-18378 · Other software · Symantec · reported by secure@symantec.comMedium 4.8
Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.
Product
Messaging Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.symantec.com support.symantec.com
Dec 11, 2019Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempCVE-2019-18377 · Other software · Symantec · reported by secure@symantec.comHigh 7.2
Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
Product
Messaging Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.symantec.com support.symantec.com
Oct 24, 2019Symantec Messaging Gateway (prior to 10.7.0), may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially allCVE-2019-9699 · Other software · Symantec · reported by secure@symantec.comMedium 4.5
Symantec Messaging Gateway (prior to 10.7.0), may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially allow unauthorized access to data.
Product
Symantec Messaging Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.symantec.com support.symantec.com
Sep 10, 2019Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (before versions 7.31, 7.40, 7.50) allows an attacker to aCVE-2019-0356 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.3
Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (before versions 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted.
Product
SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Aug 7, 2019Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where tCVE-2019-10379 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Product
Jenkins Google Cloud Messaging Notification Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Jul 12, 2019Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash ACVE-2019-12827 · Other software · Digium · reported by MITREMedium 6.5
Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message.
Product
Asterisk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record downloads.digium.com issues.asterisk.org
Jul 11, 2019Symantec Messaging Gateway, prior to 10.7.1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempCVE-2019-12751 · Other software · Symantec · reported by secure@symantec.comCritical 9.8
Symantec Messaging Gateway, prior to 10.7.1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
Product
Message Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com support.symantec.com
Jun 28, 2019Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messagesCVE-2018-14867 · Other software · Odoo · reported by MITREMedium 5.3
Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters.
Product
Odoo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 19, 2019CSRF exists in Nimble Messaging Bulk SMS Marketing Application 1.0 for adding an admin account.CVE-2018-17387 · Other software · Ranksol · reported by MITREHigh 8.8
CSRF exists in Nimble Messaging Bulk SMS Marketing Application 1.0 for adding an admin account.
Product
Nimble Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
May 10, 2019A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover prevCVE-2019-3566 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.9
A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover previously sent messages. This behavior requires independent knowledge of metadata for previous messages, which are not available publicly. This issue affects WhatsApp for Android 2.19.52 and 2.19.54 - 2.19.103, as well as WhatsApp Business for Android starting in v2.19.22 until v2.19.38.
Product
WhatsApp for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record facebook.com facebook.com
Apr 10, 2019Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7CVE-2019-0278 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.3
Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to see the names of database tables used by the application, leading to information disclosure.
Product
SAP NetWeaver Process Integration (Messaging System)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Feb 25, 2019Improper input validation in wireless service messaging module for data received from broadcast messages can lead to heap overflow in Snapdragon Auto, SnapdragoCVE-2018-11945 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Improper input validation in wireless service messaging module for data received from broadcast messages can lead to heap overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in versions MDM9150, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130.
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdrago
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com qualcomm.com
Feb 20, 2019A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.java, UsernameAuthentCVE-2019-1003028 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.java, UsernameAuthenticationMethod.java that allows attackers with Overall/Read permission to have Jenkins connect to a JMS endpoint.
Product
Jenkins JMS Messaging Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jenkins.io
Jan 3, 2019An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0.CVE-2018-3986 · Other software · Telegram · reported by talos-cna@cisco.comMedium 5.5
An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0. The "Secret Chats" functionality allows a user to delete all traces of a chat, either by using a time trigger or by direct request. There is a bug in this functionality that leaves behind photos taken and shared on the secret chats, even after the chats are deleted. These photos will be stored in the device and accessible to all applications installed on the Android device.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com talosintelligence.com
Jan 3, 2019Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workersCVE-2018-16879 · Other software · [UNKNOWN] · reported by Red HatCritical 9.8
Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting projects or inventory files.
Product
Tower
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugzilla.redhat.com
Nov 6, 2018The Schema repository server (tibschemad) component of TIBCO Software Inc.'s TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community EditionCVE-2018-12413 · Other software · TIBCO Software Inc. · reported by security@tibco.comHigh 7.5
The Schema repository server (tibschemad) component of TIBCO Software Inc.'s TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc. TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition: 1.0.0, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition: 1.0.0.
Product
TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com tibco.com
Sep 19, 2018The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which is a type of issue where XML input contaCVE-2018-12243 · Other software · Symantec Corporation · reported by secure@symantec.comHigh 8.8
The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which is a type of issue where XML input containing a reference to an external entity is processed by a weakly configured XML parser. The attack uses file URI schemes or relative paths in the system identifier to access files that should not normally be accessible.
Product
Symantec Messaging Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com support.symantec.com
Sep 19, 2018The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to an authentication bypass exploit, which is a type of issue that can allow attackersCVE-2018-12242 · Other software · Symantec Corporation · reported by secure@symantec.comCritical 9.8
The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to an authentication bypass exploit, which is a type of issue that can allow attackers to potentially circumvent security mechanisms currently in place and gain access to the system or network.
Product
Symantec Messaging Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com support.symantec.com
Jul 18, 2018Vulnerability in the Oracle Communications Messaging Server component of Oracle Communications Applications (subcomponent: Web Client).CVE-2018-2936 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Oracle Communications Messaging Server component of Oracle Communications Applications (subcomponent: Web Client). The supported version that is affected is 3.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Messaging Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Messaging Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Messaging Server accessible data as well as unauthorized read access to a subset of Oracle Communications Messaging Server accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Product
Communications Convergence
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com securityfocus.com
Jul 10, 2018The "Firebase Cloud Messaging (FCM) + Advance Admin Panel" component supporting Firebase Push Notification on iOS (through 2017-10-26) allows SQL injection via CVE-2018-13850 · Other software · Icanstudioz · reported by MITRECritical 9.8
The "Firebase Cloud Messaging (FCM) + Advance Admin Panel" component supporting Firebase Push Notification on iOS (through 2017-10-26) allows SQL injection via the /advance_push/public/login username parameter.
Product
Firebase Push Notification ON IOS / FCM + Advance Admin Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxsecurity.com cxsecurity.com
Jun 29, 2018An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated aCVE-2018-12465 · Other software · Micro Focus · reported by security@opentext.comCritical 9.1
An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in conjunction with CVE-2018-12464 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that used GWAVA product name (i.e. GWAVA 6.5).
Product
Secure Messaging Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pentest.blog support.microfocus.com
Jun 29, 2018A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacCVE-2018-12464 · Other software · Micro Focus · reported by security@opentext.comCritical 10
A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be exploited to create an administrative account and used in conjunction with CVE-2018-12465 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that use the GWAVA product name (i.e. GWAVA 6.5).
Product
Secure Messaging Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pentest.blog support.microfocus.com
Feb 16, 2018A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access seCVE-2018-3609 · Other software · Trend Micro · reported by security@trendmicro.comHigh 8.1
A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log file that could be used to bypass authentication on vulnerable installations.
Product
Trend Micro InterScan Messaging Security Virtual Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com korelogic.com
Jan 8, 2018The "XML Interface to Messaging, Scheduling, and Signaling" (XIMSS) protocol implementation in CommuniGate Pro (CGP) 6.2 suffers from a Missing XIMSS Protocol VCVE-2018-3815 · Other software · Stalker · reported by MITREMedium 5.7
The "XML Interface to Messaging, Scheduling, and Signaling" (XIMSS) protocol implementation in CommuniGate Pro (CGP) 6.2 suffers from a Missing XIMSS Protocol Validation attack that leads to an email spoofing attack, allowing a malicious authenticated attacker to send a message from any source email address. The attack uses an HTTP POST request to a /Session URI, and interchanges the XML From and To elements.
Product
Communigate Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.