Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
585 results · page 8 of 12
Jul 14, 2022Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search.CVE-2022-25803 · Other software · Bestpractical · reported by MITREMedium 6.1
Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Jul 14, 2022Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment.CVE-2022-25802 · Other software · Bestpractical · reported by MITREMedium 6.1
Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Jul 14, 2022Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools.CVE-2022-25801 · Other software · Bestpractical · reported by MITRECritical 9.1
Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools.
- Product
- Request Tracker For Incident Response
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Jul 14, 2022Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.CVE-2022-25800 · Other software · Bestpractical · reported by MITRECritical 9.1
Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.
- Product
- Request Tracker For Incident Response
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Jun 21, 2022IBM QRadar WinCollect Agent 10.0 and 10.0.1 could allow an attacker to obtain sensitive information due to missing best practices.CVE-2021-39006 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM QRadar WinCollect Agent 10.0 and 10.0.1 could allow an attacker to obtain sensitive information due to missing best practices. IBM X-Force ID: 213549.
- Product
- QRadar WinCollect Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 20, 2022Rating by BestWebSoft: Does not validate the submitted ratingCVE-2021-25121 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Rating by BestWebSoft WordPress plugin before 1.6 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service on the post/page when a user submit such rating
- Product
- Rating by BestWebSoft
- Fixed in
- 1.6
- What to do
- Update Rating by BestWebSoft to 1.6 or newer.
Jun 16, 2022A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0.CVE-2017-20055 · Other software · BestWebSoft · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.2 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Contact Form Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsumofpwn.nl
Jun 13, 2022Bestbooks: Does not sanitise and escape some parameters before using them in a SQL statement via an AJAX actionCVE-2022-0827 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
- Product
- Bestbooks
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update Bestbooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2022A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation.CVE-2021-26629 · Other software · tobesoft Co.,Ltd · reported by vuln@krcert.or.krHigh 8.8
A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .xzip archive file is decompressed, an arbitrary file can be d in the parent path by using the path traversal pattern ‘..\’.
- Product
- XPLATFORM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Apr 19, 2022Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands.CVE-2021-26626 · Other software · tobesoft Co.,Ltd · reported by vuln@krcert.or.krHigh 8.1
Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter value of the execBrowser function is ‘default’, the first parameter value could be passed to the ShellExecuteW API. The passed parameter is an arbitrary code to be executed. Remote attackers can use this vulnerability to execute arbitrary remote code.
- Product
- XPLATFORM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Apr 19, 2022Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform.CVE-2021-26625 · Other software · tobesoft Co.,Ltd · reported by vuln@krcert.or.krHigh 8.8
Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an automatic update function that does not verify input data except version information. Remote attackers can use this incomplete validation logic to download and execute arbitrary malicious file.
- Product
- Nexacro 17
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Feb 9, 2022improper input validation vulnerability in nexacro permits copying file to the startup folder using rename method.CVE-2021-26613 · Other software · tobesoft co., ltd · reported by vuln@krcert.or.krHigh 8.1
improper input validation vulnerability in nexacro permits copying file to the startup folder using rename method.
- Product
- Nexacro 17
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2021Besu is an Ethereum client written in Java.CVE-2021-41272 · Other software · hyperledger · reported by GitHubHigh 7.5
Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations resulted in the introduction of a signed type coercion error in values that represent negative values for 32 bit signed integers. Smart contracts that ask for shifts between approximately 2 billion and 4 billion bits (nonsensical but valid values for the operation) will fail to execute and hence fail to validate. In networks where vulnerable versions are mining with other clients or non-vulnerable versions this will result in a fork and the relevant transactions will not be included in the fork. In networks where vulnerable versions are not mining (such as Rinkeby) no fork will result and the validator nodes will stop accepting blocks. In networks where only vulnerable versions are mining the relevant transaction will not be included in any blocks. When the network adds a non-vulnerable version the network will act as in the first case. Besu 21.10.2 contains a patch for this issue. Besu 21.7.4 is not vulnerable and clients can roll back to that version. There is a workaround available: Once a transaction with the relevant shift operations is inc
- Product
- besu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2021An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform.CVE-2021-26612 · Other software · TOBESOFT · reported by vuln@krcert.or.krHigh 8.1
An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy method to execute arbitrary command after the file creation included malicious code.
- Product
- NEXACRO17
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2021An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected systems.CVE-2021-26607 · Other software · TOBESOFT · reported by vuln@krcert.or.krHigh 8.1
An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected systems.
- Product
- NEXACRO17
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2021Polo Video Gallery – Best wordpress video gallery: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24415 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
- Product
- Polo Video Gallery – Best wordpress video gallery
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Polo Video Gallery – Best wordpress video gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack againsCVE-2021-38562 · Other software · Bestpractical · reported by MITREHigh 7.5
Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comgithub.com
Sep 9, 2021Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file CVE-2020-7874 · Other software · TOBESOFT · reported by vuln@krcert.or.krHigh 8.8
Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file download and execution. This vulnerability is due to incomplete validation of file download URL or file extension.
- Product
- NEXACRO14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2021WP LMS – Best WordPress LMS: Does not properly sanitise or validate its User Field TitlesCVE-2021-24504 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)
- Product
- WP LMS – Best WordPress LMS
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP LMS – Best WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 20, 2021When using XPLATFORM 9.2.2.270 or earlier versions ActiveX component, arbitrary commands can be executed due to improper input validationCVE-2020-7866 · Other software · Tobesoft · reported by vuln@krcert.or.krHigh 8.8
When using XPLATFORM 9.2.2.270 or earlier versions ActiveX component, arbitrary commands can be executed due to improper input validation
- Product
- XPLATFORM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.tobesoft.co.krkrcert.or.kr
Jun 20, 2021Quiz And Survey Master – Best Quiz, Exam and Survey: Did not sanitise or escape its result_id parameterCVE-2021-24368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This could allow for privilege escalation by inducing a logged in admin to open a malicious link
- Product
- Quiz And Survey Master – Best Quiz, Exam and Survey
- Fixed in
- 7.1.18
- What to do
- Update Quiz And Survey Master – Best Quiz, Exam and Survey to 7.1.18 or newer.
Jun 14, 2021In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitisedCVE-2021-24357 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue.
- Product
- Best Image Gallery & Responsive Photo Gallery – FooGallery
- Fixed in
- 2.0.35
- What to do
- Update Best Image Gallery & Responsive Photo Gallery – FooGallery to 2.0.35 or newer.
May 24, 2021The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilCVE-2021-24307 · WordPress plugins & themes · reported by WPScanHigh 8.8
The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section "Tool > Import/Export". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.
- Fixed in
- 4.1.0.2
- What to do
- Update the plugin to 4.1.0.2 or newer.
May 10, 2021In Windscribe v1.83 Build 20, 'WindscribeService' has an Unquoted Service Path that facilitates privilege escalation.CVE-2020-22809 · Other software · Windscribe · reported by MITREHigh 7.8
In Windscribe v1.83 Build 20, 'WindscribeService' has an Unquoted Service Path that facilitates privilege escalation.
- Product
- Windscribe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
May 4, 2021All versions of Windscribe VPN for Mac and Windows <= v2.02.10 contain a local privilege escalation vulnerability in the WindscribeService component.CVE-2020-27518 · Other software · Windscribe · reported by MITREHigh 7.8
All versions of Windscribe VPN for Mac and Windows <= v2.02.10 contain a local privilege escalation vulnerability in the WindscribeService component. A low privilege user could leverage several openvpn options to execute code as root/SYSTEM.
- Product
- Windscribe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2021A vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command.CVE-2020-7857 · Other software · Tobesoft · reported by vuln@krcert.or.krHigh 7.5
A vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of improper classes. This issue affects: Tobesoft XPlatform versions prior to 9.2.2.280.
- Product
- XPlatform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2021In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to emergency services due CVE-2021-0400 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to emergency services due to improper input validation. This could lead to incorrect reporting of location data to emergency services with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11Android ID: A-177561690
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 12, 2021Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for: Did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attributeCVE-2021-24221 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is embed on a public page or post, then unauthenticated users could exploit the injection.
- Product
- Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for
- Fixed in
- 7.1.12
- What to do
- Update Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for to 7.1.12 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 25, 2021SSH server configuration file does not implement some best practices.CVE-2021-27450 · Other software · GE · reported by ics-cert@hq.dhs.govHigh 7.8
SSH server configuration file does not implement some best practices. This could lead to a weakening of the SSH protocol strength, which could lead to additional misconfiguration or be leveraged as part of a larger attack on the MU320E (all firmware versions prior to v04A00.1).
- Product
- Mu320e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Mar 24, 2021An outbound read/write vulnerability exists in XPLATFORM that does not check offset input ranges, allowing out-of-range data to be read.CVE-2020-7853 · Other software · Tobesoft · reported by vuln@krcert.or.krMedium 5.5
An outbound read/write vulnerability exists in XPLATFORM that does not check offset input ranges, allowing out-of-range data to be read. An attacker can exploit arbitrary code execution.
- Product
- Xplatform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Mar 9, 2021Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java.CVE-2021-21369 · Other software · hyperledger · reported by GitHubMedium 6.5
Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API service. If username and password authentication is enabled for the HTTP JSON-RPC API service, then prior to making any requests to an API endpoint the requestor must use the login endpoint to obtain a JSON web token (JWT) using their credentials. A single user can readily overload the login endpoint with invalid requests (incorrect password). As the supplied password is checked for validity on the main vertx event loop and takes a relatively long time this can cause the processing of other valid requests to fail. A valid username is required for this vulnerability to be exposed. This has been fixed in version 1.5.1.
- Product
- besu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2021best it Amazon Pay Plugin before 9.4.2 for Shopware exposes Sensitive Information to an Unauthorized Actor.CVE-2020-28199 · Other software · Bestit · reported by MITRECritical 9.1
best it Amazon Pay Plugin before 9.4.2 for Shopware exposes Sensitive Information to an Unauthorized Actor.
- Product
- Amazon PAY
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2020Improper input validation vulnerability exists in TOBESOFT XPLATFORM which could cause arbitrary .hta file execution when the command string is begun with http:CVE-2020-7841 · Other software · TOBESOFT · reported by vuln@krcert.or.krHigh 8.8
Improper input validation vulnerability exists in TOBESOFT XPLATFORM which could cause arbitrary .hta file execution when the command string is begun with http://, https://, mailto://
- Product
- XPLATFORM XPlatformLib922.dll
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2020Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to 6.6.20.294 allows anCVE-2020-15297 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 7.1
Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to 6.6.20.294 allows an unprivileged attacker to bypass the in-place mitigations and interact with hosts on the network. This issue affects: Bitdefender Update Server versions prior to 6.6.20.294.
- Product
- Bitdefender Update Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Sep 4, 2020An Authenticated Persistent XSS vulnerability was discovered in the Best Support System, tested version v3.0.4.CVE-2020-24963 · Other software · Appsbd · reported by MITREMedium 5.4
An Authenticated Persistent XSS vulnerability was discovered in the Best Support System, tested version v3.0.4.
- Product
- Best Support System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2020The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.CVE-2020-7730 · Other software · Bestzip Project · reported by report@snyk.ioCritical 9.8
The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.
- Product
- Bestzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2020In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of othCVE-2020-15110 · Other software · jupyterhub · reported by GitHubMedium 6.8
In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames. This has been fixed in 0.12.
- Product
- kubespawner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2020A vulnerability exists that could allow the execution of operating system commands on systems running MiPlatform 2019.05.16 and earlier.CVE-2020-7825 · Other software · TOBESOFT · reported by vuln@krcert.or.krHigh 8.8
A vulnerability exists that could allow the execution of operating system commands on systems running MiPlatform 2019.05.16 and earlier. An attacker could execute arbitrary remote command by sending parameters to WinExec function in ExtCommandApi.dll module of MiPlatform.
- Product
- MiPlatform 320, 320U, 330, 330U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2020XPLATFORM v9.2.260 and eariler versions contain a vulnerability that could allow remote files to be downloaded by setting the arguments to the vulnerable methodCVE-2020-7815 · Other software · TOBESOFT · reported by vuln@krcert.or.krHigh 7.8
XPLATFORM v9.2.260 and eariler versions contain a vulnerability that could allow remote files to be downloaded by setting the arguments to the vulnerable method. this can be leveraged for code execution. File download vulnerability in ____COMPONENT____ of TOBESOFT XPLATFORM allows ____ATTACKER/ATTACK____ to cause ____IMPACT____. This issue affects: TOBESOFT XPLATFORM 9.2.250 versions prior to 9.2.260 on Windows.
- Product
- XPLATFORM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.tobesoft.co.krkrcert.or.kr
Jul 5, 2020An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress.CVE-2020-15536 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fields.
- Product
- An issue was discovered in the bestsoftinc Hotel Booking System Pro
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update An issue was discovered in the bestsoftinc Hotel Booking System Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Jul 5, 2020An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress.CVE-2020-15535 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the registration fields.
- Product
- An issue was discovered in the bestsoftinc Car Rental System
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update An issue was discovered in the bestsoftinc Car Rental System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Jul 2, 2020Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by modifying the CVE-2020-7821 · Other software · Tobesoft · reported by vuln@krcert.or.krHigh 7.8
Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by modifying the value of registry path. This can be leveraged for code execution by rebooting the victim’s PC
- Product
- NEXACRO14/17 ExCommonApiV13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.tobesoft.co.krkrcert.or.kr
Jul 2, 2020Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by setting the arCVE-2020-7820 · Other software · Tobesoft · reported by vuln@krcert.or.krHigh 7.8
Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by setting the arguments to the vulnerable API. This can be leveraged for code execution by rebooting the victim’s PC
- Product
- NEXACRO14/17 ExCommonApiV13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.tobesoft.co.krkrcert.or.kr
Jun 30, 2020CyMiInstaller322 ActiveX which runs MIPLATFORM downloads files required to run applications.CVE-2019-19161 · Other software · TOBESOFT.CO.LTD · reported by vuln@krcert.or.krHigh 7.2
CyMiInstaller322 ActiveX which runs MIPLATFORM downloads files required to run applications. A vulnerability in downloading files by CyMiInstaller322 ActiveX caused by an attacker to download randomly generated DLL files and MIPLATFORM to load those DLLs due to insufficient verification.
- Product
- MIPLATFORM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordboho.or.krtobesoft.com
Jun 12, 2020In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds (OOB) read/write vulnerabCVE-2020-13656 · Other software · Morganstanley · reported by MITRECritical 9.8
In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds (OOB) read/write vulnerability that leads to both local and remote code (via RPC) execution.
- Product
- Hobbes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordknow.bishopfox.comknow.bishopfox.com
May 11, 2020A use-after-free vulnerability in the TOBESOFT XPLATFORM versions 9.1 to 9.2.2 may lead to code execution on a system running it.CVE-2019-19162 · Other software · TOBESOFT · reported by vuln@krcert.or.krHigh 7.8
A use-after-free vulnerability in the TOBESOFT XPLATFORM versions 9.1 to 9.2.2 may lead to code execution on a system running it.
- Product
- XPLATFORM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2020Tobesoft Xplatform 9.2.2.250 and earlier version have an arbitrary code execution vulnerability by using method supported by Xplatform ActiveX Control.CVE-2020-7806 · Other software · Tobesoft · reported by vuln@krcert.or.krHigh 7.8
Tobesoft Xplatform 9.2.2.250 and earlier version have an arbitrary code execution vulnerability by using method supported by Xplatform ActiveX Control. It allows attacker to cause remote code execution.
- Product
- Xplatform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.tobesoft.co.krboho.or.kr
May 6, 2020Tobesoft Nexacro v2019.9.25.1 and earlier version have an arbitrary code execution vulnerability by using method supported by Nexacro14 ActiveX Control.CVE-2019-19167 · Other software · Tobesoft · reported by vuln@krcert.or.krHigh 7.8
Tobesoft Nexacro v2019.9.25.1 and earlier version have an arbitrary code execution vulnerability by using method supported by Nexacro14 ActiveX Control. It allows attacker to cause remote code execution.
- Product
- Nexacro14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.tobesoft.co.krboho.or.kr
May 6, 2020Tobesoft XPlatform v9.1, 9.2.0, 9.2.1 and 9.2.2 have a vulnerability that can load unauthorized DLL files.CVE-2019-19166 · Other software · Tobesoft · reported by vuln@krcert.or.krHigh 7.8
Tobesoft XPlatform v9.1, 9.2.0, 9.2.1 and 9.2.2 have a vulnerability that can load unauthorized DLL files. It allows attacker to cause remote code execution.
- Product
- XPlatform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.tobesoft.co.krboho.or.kr
Apr 24, 2020This document describes a security vulnerability in Blade Maintenance Entity, Integrated Maintenance Entity and Maintenance Entity products.CVE-2020-7131 · Other software · HP · reported by security-alert@hpe.comCritical 9
This document describes a security vulnerability in Blade Maintenance Entity, Integrated Maintenance Entity and Maintenance Entity products. All J/H-series NonStop systems have a security vulnerability associated with an open UDP port 17185 on the Maintenance LAN which could result in information disclosure, denial-of-service attacks or local memory corruption against the affected system and a complete control of the system may also be possible. This vulnerability exists only if one gains access to the Maintenance LAN to which Blade Maintenance Entity, Integrated Maintenance Entity or Maintenance Entity product is connected. **Workaround:** Block the UDP port 17185(In the Maintenance LAN Network Switch/Firewall). Fix: Install following SPRs, which are already available: * T1805A01^AAI (Integrated Maintenance Entity) * T4805A01^AAZ (Blade Maintenance Entity). These SPRs are also usable with the following RVUs: * J06.19.00 ? J06.23.01. No fix planned for the following RVUs: J06.04.00 ? J06.18.01. No fix planned for H-Series NonStop systems. No fix planned for the product T2805 (Maintenance Entity).
- Product
- Blade Maintenance Entity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.