Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

494 results · page 7 of 10

Dec 26, 2021An issue was discovered in the mopa crate through 2021-06-01 for Rust.CVE-2021-45695 · Other software · Mopa Project · reported by MITRECritical 9.8
An issue was discovered in the mopa crate through 2021-06-01 for Rust. It incorrectly relies on Trait memory layout, possibly leading to future occurrences of arbitrary code execution or ASLR bypass.
Product
Mopa
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Dec 17, 2021SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the command line arguments to pass in any value to the Emulator executable.CVE-2021-32499 · Other software · Sick · reported by psirt@sick.deHigh 7.5
SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the command line arguments to pass in any value to the Emulator executable.
Product
Sopas Engineering Tool
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sick.com sick.com
Dec 17, 2021SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the pathname of the emulator and use path traversal to run an arbitrary executable located on CVE-2021-32498 · Other software · Sick · reported by psirt@sick.deHigh 8.6
SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the pathname of the emulator and use path traversal to run an arbitrary executable located on the host system. When the user starts the emulator from SOPAS ET the corresponding executable will be started instead of the emulator
Product
Sopas Engineering Tool
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sick.com sick.com
Dec 17, 2021SICK SOPAS ET before version 4.8.0 allows attackers to wrap any executable file into an SDD and provide this to a SOPAS ET user.CVE-2021-32497 · Other software · Sick · reported by psirt@sick.deHigh 8.6
SICK SOPAS ET before version 4.8.0 allows attackers to wrap any executable file into an SDD and provide this to a SOPAS ET user. When a user starts the emulator the executable is run without further checks.
Product
Sopas Engineering Tool
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sick.com sick.com
Dec 14, 2021WooCommerce EnvioPack: Reflected Cross-Site ScriptingCVE-2021-39314 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the ~/includes/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Product
WooCommerce EnvioPack
Affected
up to 1.2
What to do
Affects up to 1.2. Update WooCommerce EnvioPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 17, 2021Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control.CVE-2021-43979 · Other software · Openpolicyagent · reported by MITREMedium 5.3
Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control. The data replication mechanism allows policies to access the Kubernetes cluster state. During data replication, OPA/Gatekeeper does not wait for the replication to finish before processing a request, which might cause inconsistencies between the replicated resources in OPA/Gatekeeper and the resources actually present in the cluster. Inconsistency can later be reflected in a policy bypass. NOTE: the vendor disagrees that this is a vulnerability, because Kubernetes states are only eventually consistent
Product
Gatekeeper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 15, 2021Grand Vice info Co.CVE-2021-42839 · Other software · Grand Vice info Co. · reported by twcert@cert.org.twHigh 8.8
Grand Vice info Co. webopac7 file upload function fails to filter special characters. While logging in with general user’s permission, remote attackers can upload malicious script and execute arbitrary code to control the system or interrupt services.
Product
webopac7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Nov 15, 2021Grand Vice info Co.CVE-2021-42838 · Other software · Grand Vice info Co. · reported by twcert@cert.org.twMedium 6.1
Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks.
Product
webopac7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Nov 5, 2021Multiple Cross Site Scripting (XSS) vulnerabilities exits in SEO Panel v4.8.0 via the (1) to_time parameter in (a) backlinks.php, (b) analytics.php, (c) log.phpCVE-2021-39413 · Other software · Seopanel · reported by MITREMedium 6.1
Multiple Cross Site Scripting (XSS) vulnerabilities exits in SEO Panel v4.8.0 via the (1) to_time parameter in (a) backlinks.php, (b) analytics.php, (c) log.php, (d) overview.php, (e) pagespeed.php, (f) rank.php, (g) review.php, (h) saturationchecker.php, (i) social_media.php, and (j) reports.php; the (2) from_time parameter in (a) backlinks.php, (b) analytics.php, (c) log.php, (d) overview.php, (e) pagespeed.php, (f) rank.php, (g) review.php, (h) saturationchecker.php, (i) social_media.php, (j) webmaster-tools.php, and (k) reports.php; the (3) order_col parameter in (a) analytics.php, (b) review.php, (c) social_media.php, and (d) webmaster-tools.php; and the (4) pageno parameter in (a) alerts.php, (b) log.php, (c) keywords.php, (d) proxy.php, (e) searchengine.php, and (f) siteauditor.php.
Product
SEO Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sisl.lab.uic.edu sisl.lab.uic.edu
Nov 2, 2021Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded.CVE-2021-38491 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded. This vulnerability affects Firefox < 92.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org security.gentoo.org
Oct 1, 2021CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file.CVE-2021-38101 · Other software · Corel · reported by MITREHigh 7.8
CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CPT file. This is different from CVE-2021-38099.
Product
Photopaint 2020
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortinet.com
Oct 1, 2021Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file.CVE-2021-38100 · Other software · Corel · reported by MITREHigh 7.8
Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CPT file.
Product
Photopaint 2020
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortinet.com
Oct 1, 2021CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file.CVE-2021-38099 · Other software · Corel · reported by MITREHigh 7.8
CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CPT file. This is different from CVE-2021-38101.
Product
Photopaint 2020
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortinet.com
Aug 20, 2021A remote code execution vulnerability in SEOPanel 4.6.0 has been fixed for 4.7.0.CVE-2020-27461 · Other software · Seopanel · reported by MITREHigh 8.8
A remote code execution vulnerability in SEOPanel 4.6.0 has been fixed for 4.7.0. This vulnerability allowed for remote code execution through an authenticated file upload via the Settings Panel>Import website function.
Product
Seopanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sourceforge.net exploit-db.com
May 14, 2021A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference.CVE-2021-3537 · Other software · Siemens · reported by Red HatMedium 5.9
A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.
Product
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com lists.debian.org
Apr 2, 2021This issue was addressed with improved setting propagation.CVE-2020-9978 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.5
This issue was addressed with improved setting propagation. This issue is fixed in macOS Big Sur 11.0.1, tvOS 14.0, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, watchOS 7.0, iOS 14.0 and iPadOS 14.0. An attacker in a privileged network position may be able to unexpectedly alter application state.
Product
tvOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Mar 31, 2021kopano-ical (formerly zarafa-ical) in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x thCVE-2021-28994 · Other software · Kopano · reported by MITREHigh 7.5
kopano-ical (formerly zarafa-ical) in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x through 7.2.x allows memory exhaustion via long HTTP headers.
Product
Groupware Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Mar 25, 2021A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "report_type" parameter.CVE-2021-29010 · Other software · Seopanel · reported by MITREMedium 4.8
A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "report_type" parameter.
Product
SEO Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 25, 2021A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "type" parameter.CVE-2021-29009 · Other software · Seopanel · reported by MITREMedium 4.8
A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "type" parameter.
Product
SEO Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 25, 2021A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via webmaster-tools.php in the "to_time" parameter.CVE-2021-29008 · Other software · Seopanel · reported by MITREMedium 4.8
A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via webmaster-tools.php in the "to_time" parameter.
Product
SEO Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 18, 2021A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and the "from_time" parameter.CVE-2021-28420 · Other software · Seopanel · reported by MITREMedium 4.8
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and the "from_time" parameter.
Product
SEO Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Mar 18, 2021The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve all databaseCVE-2021-28419 · Other software · Seopanel · reported by MITREHigh 7.2
The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve all databases.
Product
SEO Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Mar 18, 2021A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" parameter.CVE-2021-28418 · Other software · Seopanel · reported by MITREMedium 4.8
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" parameter.
Product
SEO Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Mar 18, 2021A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and the "search_name" parameter.CVE-2021-28417 · Other software · Seopanel · reported by MITREMedium 4.8
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and the "search_name" parameter.
Product
SEO Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Feb 17, 2021Improper conditions check in the Intel(R) FPGA OPAE Driver for Linux before kernel version 4.17 may allow an authenticated user to potentially enable escalationCVE-2020-24485 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper conditions check in the Intel(R) FPGA OPAE Driver for Linux before kernel version 4.17 may allow an authenticated user to potentially enable escalation of privilege via local access.
Product
Trace Analyzer And Collector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 4, 2021An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis < 4.0.2.CVE-2020-16194 · Other software · Store-opart · reported by MITREMedium 5.3
An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis < 4.0.2. Unauthenticated attackers can have access to any user's invoice and delivery address by exploiting an IDOR on the delivery_address and invoice_address fields.
Product
Op'art Devis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 1, 2021Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter.CVE-2021-3002 · Other software · Seopanel · reported by MITREMedium 6.1
Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter.
Product
SEO Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cinquino.eu github.com
Dec 31, 2020Seo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter, as demonstrated by the seo/seopanel/websites.php URI.CVE-2020-35930 · Other software · Seopanel · reported by MITREMedium 5.4
Seo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter, as demonstrated by the seo/seopanel/websites.php URI.
Product
SEO Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 19, 2020A Cross Site Scripting (XSS) vulnerability exists in OPAC in Sokrates SOWA SowaSQL through 5.6.1 via the sowacgi.php typ parameter.CVE-2020-28350 · Other software · Sokrates · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) vulnerability exists in OPAC in Sokrates SOWA SowaSQL through 5.6.1 via the sowacgi.php typ parameter.
Product
Sowasql
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Nov 2, 2020u'An Unaligned address or size can propagate to the database due to improper page permissions and can lead to improper access control' in Snapdragon Auto, SnapdCVE-2020-3638 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
u'An Unaligned address or size can propagate to the database due to improper page permissions and can lead to improper access control' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Agatti, Bitra, Kamorta, QCA6390, QCS404, QCS610, Rennell, SA515M, SC7180, SC8180X, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastruc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Oct 23, 2020FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL].CVE-2020-24848 · Other software · Fruitywifi Project · reported by MITREHigh 7.8
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
Product
Fruitywifi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Aug 29, 2020The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported CVE-2020-24972 · Other software · Kleopatra Project · reported by MITREHigh 8.8
The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.
Product
Kleopatra
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Jun 29, 2020A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of kopano-spamd of openSUSE Leap 15.1, openSUSE Tumbleweed allowed local attackers with CVE-2020-8014 · Other software · openSUSE · reported by meissner@suse.deHigh 7.7
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of kopano-spamd of openSUSE Leap 15.1, openSUSE Tumbleweed allowed local attackers with the privileges of the kopano user to escalate to root. This issue affects: openSUSE Leap 15.1 kopano-spamd versions prior to 10.0.5-lp151.4.1. openSUSE Tumbleweed kopano-spamd versions prior to 10.0.5-1.1.
Product
openSUSE Leap 15.1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.suse.com bugzilla.suse.com
Jun 22, 2020In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse.CVE-2020-4030 · Other software · FreeRDP · reported by GitHubLow 3.5
In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2.
Product
FreeRDP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org freerdp.com
Jun 11, 2020HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers.CVE-2020-12797 · Other software · Hashicorp · reported by MITREMedium 5.3
HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.
Product
Consul
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 17, 2020In onOpActiveChanged and related methods of AppOpsControllerImpl.java, there is a possible way to display an app overlaying other apps without the notification CVE-2020-0080 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onOpActiveChanged and related methods of AppOpsControllerImpl.java, there is a possible way to display an app overlaying other apps without the notification icon that it's overlaying. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-144092031
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Mar 19, 2020An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows.CVE-2020-9345 · Other software · Signotec · reported by MITREMedium 6.5
An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows. It is possible to perform a Denial of Service attack because the application doesn't limit the number of opened WebSocket sockets. If a victim visits an attacker-controlled website, this vulnerability can be exploited.
Product
Signopad-api/web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record syss.de syss.de
Mar 19, 2020An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows.CVE-2020-9343 · Other software · Signotec · reported by MITREMedium 6.5
An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows. It is possible to perform a Denial of Service attack because the implementation doesn't limit the parsing of nested JSON structures. If a victim visits an attacker-controlled website, this vulnerability can be exploited via WebSocket data with a deeply nested JSON array.
Product
Signopad-api/web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record syss.de syss.de
Mar 18, 2020django-nopassword before 5.0.0 stores cleartext secrets in the database.CVE-2019-10682 · Other software · Django-nopassword Project · reported by MITREHigh 7.5
django-nopassword before 5.0.0 stores cleartext secrets in the database.
Product
Django-nopassword
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 2, 2020The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability, allowing remote authenticated attacCVE-2018-14384 · Other software · Seopanel · reported by MITREMedium 4.8
The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability, allowing remote authenticated attackers to inject arbitrary web script or HTML via the websites.php name parameter.
Product
SEO Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wizlynxgroup.com wizlynxgroup.com
Feb 27, 2020This issue was addressed with improved setting propagation.CVE-2020-3873 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
This issue was addressed with improved setting propagation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Turning off "Load remote content in messages” may not apply to all mail previews.
Product
iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Dec 19, 2019HrAddFBBlock in libfreebusy/freebusyutil.cpp in Kopano Groupware Core before 8.7.7 allows out-of-bounds access, as demonstrated by mishandling of an array copy CVE-2019-19907 · Other software · Kopano · reported by MITRECritical 9.8
HrAddFBBlock in libfreebusy/freebusyutil.cpp in Kopano Groupware Core before 8.7.7 allows out-of-bounds access, as demonstrated by mishandling of an array copy during parsing of ICal data.
Product
Groupware Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org stash.kopano.io
Dec 18, 2019An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reusedCVE-2012-2312 · Other software · JBoss AS 7 · reported by Red HatHigh 7.8
An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated privileges.
Product
JBoss
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Dec 4, 2019COPA-DATA zenone32 zenon Editor through 8.10 has an Uncontrolled Search Path Element.CVE-2019-15638 · Other software · Copadata · reported by MITREHigh 7.8
COPA-DATA zenone32 zenon Editor through 8.10 has an Uncontrolled Search Path Element.
Product
Zenon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.copadata.com copadata.com
Nov 19, 2019A potential vulnerability in the discontinued LenovoPaper software version 1.0.0.22 may allow local privilege escalation.CVE-2019-6191 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A potential vulnerability in the discontinued LenovoPaper software version 1.0.0.22 may allow local privilege escalation.
Product
LenovoPaper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.lenovo.com support.lenovo.com
Oct 30, 2019European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain ExplicitKeyTrustEvaluator return value is nCVE-2019-18633 · Other software · Europa · reported by MITRECritical 9.8
European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain ExplicitKeyTrustEvaluator return value is not checked. NOTE: only 2.1 is confirmed to be affected.
Product
Eidas-node Integration Package
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec-consult.com sec-consult.com
Oct 30, 2019European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML response with a forgedCVE-2019-18632 · Other software · Europa · reported by MITRECritical 9.8
European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML response with a forged certificate.
Product
Eidas-node Integration Package
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec-consult.com sec-consult.com
Sep 30, 2019In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_tCVE-2019-16996 · Other software · Metinfo · reported by MITREHigh 7.2
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter.
Product
Metinfo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 25, 2019The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallockeCVE-2015-9425 · WordPress plugins & themes · reported by MITREMedium 5.4
The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey parameter.
Product
social-locker
Fixed in
4.2.5
What to do
Update social-locker to 4.2.5 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 9, 2019In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field,CVE-2019-16168 · Other software · Siemens · reported by MITREMedium 6.5
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
Product
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.