Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
402 results · page 7 of 9
Aug 27, 2020KandNconcepts Club CMS 1.1 and 1.2 has SQL Injection via the 'team.php,player.php,club.php' id parameter.CVE-2020-23973 · Other software · Kandnconcepts Club CMS Project · reported by MITRECritical 9.8
KandNconcepts Club CMS 1.1 and 1.2 has SQL Injection via the 'team.php,player.php,club.php' id parameter.
- Product
- Kandnconcepts Club CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
May 26, 2020A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by CVE-2020-9046 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 8.8
A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files.
- Product
- Kantech EntraPass Security Management Software Special Edition versions 8.22 and prior
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjohnsoncontrols.comus-cert.gov
Mar 24, 2020Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to execute arbitrary OS commands via unspecified vectors.CVE-2020-5556 · Other software · EKAKIN · reported by vultures@jpcert.or.jpCritical 9.8
Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
- Product
- Shihonkanri Plus GOOUT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2020Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write data of the files placed in the same directory where it is placed via unCVE-2020-5555 · Other software · EKAKIN · reported by vultures@jpcert.or.jpCritical 9.1
Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write data of the files placed in the same directory where it is placed via unspecified vector due to the improper input validation issue.
- Product
- Shihonkanri Plus GOOUT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2020Directory traversal vulnerability in Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write arbitrary files via unspecified vecCVE-2020-5554 · Other software · EKAKIN · reported by vultures@jpcert.or.jpCritical 9.1
Directory traversal vulnerability in Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write arbitrary files via unspecified vectors.
- Product
- Shihonkanri Plus GOOUT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2020A vulnerability with the SmartService API Service option exists whereby an unauthorized user could potentially exploit this to upload malicious code to the servCVE-2019-7589 · Other software · Johnson Controls · reported by productsecurity@jci.comCritical 9.8
A vulnerability with the SmartService API Service option exists whereby an unauthorized user could potentially exploit this to upload malicious code to the server that could be executed at system level privileges. This affects Johnson Controls' Kantech EntraPass Corporate Edition versions 8.0 and prior; Kantech EntraPass Global Edition versions 8.0 and prior.
- Product
- Kantech EntraPass Corporate Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjohnsoncontrols.comus-cert.gov
Feb 22, 2020fauzantrif eLection 2.0 has SQL Injection via the admin/ajax/op_kandidat.php id parameter.CVE-2020-9340 · Other software · Fauzantrif Election Project · reported by MITREHigh 7.2
fauzantrif eLection 2.0 has SQL Injection via the admin/ajax/op_kandidat.php id parameter.
- Product
- Fauzantrif Election
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2020The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof serversCVE-2020-5522 · Other software · Fuji Xerox Co.,Ltd. · reported by vultures@jpcert.or.jpHigh 7.4
The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- kantan netprint App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2020The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers andCVE-2020-5521 · Other software · Fuji Xerox Co.,Ltd. · reported by vultures@jpcert.or.jpHigh 7.4
The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- kantan netprint App for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2019In setCpuVulkanInUse of GpuStats.cpp, there is possible memory corruption due to a use after free.CVE-2019-2217 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In setCpuVulkanInUse of GpuStats.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141003796
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Sep 23, 2019The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.CVE-2019-16377 · Other software · Makandra · reported by MITRECritical 9.8
The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrubygems.org
Apr 26, 2019An issue was discovered in Dillon Kane Tidal Workload Automation Agent 3.2.0.5 (formerly known as Cisco Workload Automation or CWA).CVE-2019-6689 · Other software · Dillonkane · reported by MITREHigh 7.8
An issue was discovered in Dillon Kane Tidal Workload Automation Agent 3.2.0.5 (formerly known as Cisco Workload Automation or CWA). The Enterprise Scheduler for AIX allows local users to gain privileges via Command Injection in crafted Tidal Job Buffers (TJB) parameters. NOTE: this vulnerability exists because the CVE-2014-3272 solution did not address AIX operating systems.
- Product
- Tidal Workload Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordashsecurity.wordpress.comashsecurity.wordpress.com
Feb 6, 2019A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that allows attackers with CVE-2019-1003020 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that allows attackers with Overall/Read permission to submit a GET request to an attacker-specified URL.
- Product
- Jenkins Kanboard Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2019app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting.CVE-2019-7324 · Other software · Kanboard · reported by MITREMedium 6.1
app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 7, 2019Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver.CVE-2018-5410 · Other software · Dokan · reported by cret@cert.orgHigh 7.8
Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.5000 version update.
- Product
- Open Source File System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comcwe.mitre.org
Dec 10, 2018The nxfs.sys driver in the DokanFS library 0.6.0 in NoMachine before 6.4.6 on Windows 10 allows local users to cause a denial of service (BSOD) because uninitiaCVE-2018-20029 · Other software · Dokan-dev · reported by MITREMedium 5.5
The nxfs.sys driver in the DokanFS library 0.6.0 in NoMachine before 6.4.6 on Windows 10 allows local users to cause a denial of service (BSOD) because uninitialized memory can be read.
- Product
- Dokany
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnomachine.comnomachine.com
Nov 16, 2018Local Server 1.0.9 has a Buffer Overflow via crafted data on Port 4008.CVE-2018-18756 · Other software · Kangujang · reported by MITREHigh 7.5
Local Server 1.0.9 has a Buffer Overflow via crafted data on Port 4008.
- Product
- Local Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Sep 7, 2018Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1.CVE-2018-16654 · Other software · Zurmo · reported by MITREMedium 6.1
Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1.
- Product
- Zurmo CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbitbucket.org
Jun 26, 2018Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker cCVE-2018-1000549 · Other software · Wekan Project · reported by MITREMedium 5.3
Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker could perform a brute force attack to obtain valid usernames and email addresses.. This attack appear to be exploitable via HTTP Request.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comshadow-vault.com
May 30, 2018tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a via a crafted TIFF file.CVE-2018-11556 · Other software · Littlecms · reported by MITREHigh 7.8
tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a via a crafted TIFF file. NOTE: Little CMS developers do consider this a vulnerability because the issue is based on an sample program using LIBTIFF and do not apply to the lcms2 library, lcms2 does not depends on LIBTIFF other than to build sample programs, and the issue cannot be reproduced on the lcms2 library.”
- Product
- Little CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2018The Artezio Kanban Board plugin 1.4 revision 1914 for Atlassian Jira has XSS via the Board Name in a Create New Board action, related to an artezioboard/mainPagCVE-2016-10715 · Other software · Artezio · reported by MITREMedium 5.4
The Artezio Kanban Board plugin 1.4 revision 1914 for Atlassian Jira has XSS via the Board Name in a Create New Board action, related to an artezioboard/mainPage.jspa?kanbanId=7#/kanban-view URI.
- Product
- Kanban Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Feb 28, 2018An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoMachine 6.0.66_2 and earlier allows a locCVE-2018-6947 · Other software · Nomachine · reported by MITREHigh 7.8
An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoMachine 6.0.66_2 and earlier allows a local low privileged user to gain elevation of privileges on Windows 7 (32 and 64bit), and denial of service for Windows 8 and 10.
- Product
- Nomachine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private project of another user.CVE-2017-15212 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user.CVE-2017-15211 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another user.CVE-2017-15210 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user.CVE-2017-15209 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user.CVE-2017-15208 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another user.CVE-2017-15207 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of another user.CVE-2017-15206 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user.CVE-2017-15205 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user.CVE-2017-15204 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user.CVE-2017-15203 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user.CVE-2017-15202 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another user.CVE-2017-15201 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user.CVE-2017-15200 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, CVE-2017-15199 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, Identifier, and Description.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can edit a category of a private project of another user.CVE-2017-15198 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit a category of a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to a private project of another user.CVE-2017-15197 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of another user.CVE-2017-15196 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 10, 2017In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a private project of another user.CVE-2017-15195 · Other software · Kanboard · reported by MITREMedium 4.3
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a private project of another user.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Sep 20, 2017The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrarCVE-2017-14609 · Other software · Kannel · reported by MITREHigh 7.8
The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated by bearerbox.
- Product
- Kannel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredmine.kannel.orgredmine.kannel.org
Aug 18, 2017Untrusted search path vulnerability in Installer for Shin Kikan Toukei Houkoku Data Nyuryokuyou Program (program released on 2013 September 30) Distributed on tCVE-2017-10821 · Other software · Agency for Natural Resources and Energy of Ministry of Economy,Trade and Industry (METI) · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Installer for Shin Kikan Toukei Houkoku Data Nyuryokuyou Program (program released on 2013 September 30) Distributed on the website until 2017 May 17 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Installer for Shin Kikan Toukei Houkoku Data Nyuryokuyou Program (program released on 2013 September 30)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2017An authenticated standard user could reset the password of the admin by altering form data.CVE-2017-12851 · Other software · Kanboard · reported by MITREHigh 8.8
An authenticated standard user could reset the password of the admin by altering form data. Affects kanboard before 1.0.46.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Aug 14, 2017An authenticated standard user could reset the password of other users (including the admin) by altering form data.CVE-2017-12850 · Other software · Kanboard · reported by MITREHigh 8.8
An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affects kanboard before 1.0.46.
- Product
- Kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jul 7, 2017Untrusted search path vulnerability in Douro Kouji Kanseizutou Check Program Ver3.1 (cdrw_checker_3.1.0.lzh) and earlier allows remote attackers to gain privileCVE-2017-2230 · Other software · National Institute for Land and Infrastructure Management · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Douro Kouji Kanseizutou Check Program Ver3.1 (cdrw_checker_3.1.0.lzh) and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Douro Kouji Kanseizutou Check Program
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2017www.modified-shop.org modified eCommerce Shopsoftware 2.0.2.2 rev 10690 has XXE in api/it-recht-kanzlei/api-it-recht-kanzlei.php.CVE-2017-8110 · Websites & servers · Modified-shop · reported by MITRECritical 10
www.modified-shop.org modified eCommerce Shopsoftware 2.0.2.2 rev 10690 has XXE in api/it-recht-kanzlei/api-it-recht-kanzlei.php.
- Product
- Modified Ecommerce Shopsoftware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjgj212.blogspot.hkjgj212.blogspot.hk
Apr 13, 2017KanColleViewer versions 3.8.1 and earlier operates as an open proxy which allows remote attackers to trigger outbound network traffic.CVE-2015-2947 · Other software · Grabacr.net · reported by vultures@jpcert.or.jpCritical 9.1
KanColleViewer versions 3.8.1 and earlier operates as an open proxy which allows remote attackers to trigger outbound network traffic.
- Product
- Kancolleviewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2017The Konke Smart Plug K does not require authentication for TELNET sessions, which allows remote attackers to obtain "equipment management authority" via TCP trCVE-2014-7279 · Other software · Kankunit · reported by MITRECritical 9.8
The Konke Smart Plug K does not require authentication for TELNET sessions, which allows remote attackers to obtain "equipment management authority" via TCP traffic to port 23.
- Product
- Konke Smart Plug Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jun 9, 2015The Kankun Smart Socket device and mobile application uses a hardcoded AES 256 bit key, which makes it easier for remote attackers to (1) obtain sensitive inforCVE-2015-4080 · Other software · Kankun · reported by MITREMedium 6.8
The Kankun Smart Socket device and mobile application uses a hardcoded AES 256 bit key, which makes it easier for remote attackers to (1) obtain sensitive information by sniffing the network and (2) obtain access to the device by encrypting messages.
- Product
- Smartsocket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Apr 10, 2015noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by interceptinCVE-2013-7436 · Other software · Kanaka · reported by MITREMedium 4.3
noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
- Product
- Novnc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.comrhn.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.