Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

458 results · page 8 of 10

Nov 24, 2021Cross-site request forgery (CSRF) vulnerability in Unlimited Sitemap Generator versions prior to v8.2 allows a remote attacker to hijack the authentication of aCVE-2021-20845 · Other software · XML-Sitemaps · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Unlimited Sitemap Generator versions prior to v8.2 allows a remote attacker to hijack the authentication of an administrator and conduct arbitrary operation via a specially crafted web page.
Product
Unlimited Sitemap Generator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp xml-sitemaps.com
Nov 1, 2021Google Maps Easy: Stored Cross-Site ScriptingCVE-2021-39346 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Google Maps Easy WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/modules/marker_groups/views/tpl/mgrEditMarkerGroup.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.9.33. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Google Maps Easy
Affected
up to 1.9.33
What to do
Affects up to 1.9.33. Update Google Maps Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 10, 2021WP Design Maps & Places: Reflected Cross-Site ScriptingCVE-2021-38334 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the ~/wpdmp-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Product
WP Design Maps & Places
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP Design Maps & Places to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 9, 2021Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps Pro premium plugin (versions <= 8.1.11).CVE-2021-36871 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps Pro premium plugin (versions <= 8.1.11). Vulnerable parameters: &wpgmaps_marker_category_name, Value > &attributes[], Name > &attributes[], &icons[], &names[], &description, &link, &title.
Affected
up to 8.1.11
What to do
Affects up to 8.1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wpgmaps.com
Sep 9, 2021Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps plugin (versions <= 8.1.12).CVE-2021-36870 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps plugin (versions <= 8.1.12). Vulnerable parameters: &dataset_name, &wpgmza_gdpr_retention_purpose, &wpgmza_gdpr_company_name, &name #2, &name, &polyname #2, &polyname, &address.
Affected
up to 8.1.12
What to do
Affects up to 8.1.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 8, 2021Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory.CVE-2021-28701 · Other software · Xen · reported by security@xen.orgHigh 7.8
Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervisor enforce that no parallel request can result in the addition of a mapping of such a page to a guest. That enforcement was missing, allowing guests to retain access to pages that were freed and perhaps re-used for other purposes. Unfortunately, when XSA-379 was being prepared, this similar issue was not noticed.
Product
xen
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com xenbits.xen.org
Aug 30, 2021MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 (aka 16.6.2.66) allows blind SQL Injection via the Id (within sourceItems) parameter to the GetMaCVE-2021-37749 · Other software · Hexagongeospatial · reported by MITRECritical 9.8
MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 (aka 16.6.2.66) allows blind SQL Injection via the Id (within sourceItems) parameter to the GetMap method.
Product
Geomedia Webmap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.hexagongeospatial.com hexagongeospatial.com
Aug 16, 2021Scribble Maps: Reflected Cross-Site ScriptingCVE-2021-34651 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Scribble Maps WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the map parameter in the ~/includes/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Product
Scribble Maps
Affected
up to 1.2
What to do
Affects up to 1.2. Update Scribble Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 21, 2021WP Google Maps: Did not sanitiseCVE-2021-24383 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
Product
WP Google Maps
Fixed in
8.1.12
What to do
Update WP Google Maps to 8.1.12 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 6, 2021MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATCVE-2021-32062 · Other software · Osgeo · reported by MITREMedium 5.3
MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions that are intended to control the locations from which a mapfile may be loaded (with MapServer CGI).
Product
Mapserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
May 5, 2021Ultimate Maps by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24274 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
Product
Ultimate Maps by Supsystic
Fixed in
1.2.5
What to do
Update Ultimate Maps by Supsystic to 1.2.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Feb 17, 2021core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode.CVE-2021-26911 · Other software · Canarymail · reported by MITREHigh 7.4
core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode.
Product
Canary Mail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com apps.apple.com
Oct 20, 2020This affects all versions of package osm-static-maps.CVE-2020-7749 · Other software · Osm-static-maps Project · reported by report@snyk.ioHigh 7.6
This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read.
Product
Osm-static-maps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 29, 2020The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/CVE-2020-12675 · WordPress plugins & themes · reported by MITREHigh 8.8
The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/retrieval/deletion of PHP template files, leading to Remote Code Execution. NOTE: this issue exists because of an incomplete fix for CVE-2020-12077.
Product
mappress-google-maps-for-wordpress
Fixed in
2.54.6
What to do
Update mappress-google-maps-for-wordpress to 2.54.6 or newer.
Full record and what to do →NVD record blog.alertlogic.com wordpress.org
Apr 22, 2020The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capability checks), leadinCVE-2020-12077 · WordPress plugins & themes · reported by MITREHigh 8.8
The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capability checks), leading to remote code execution.
Product
mappress-google-maps-for-wordpress
Fixed in
2.53.9
What to do
Update mappress-google-maps-for-wordpress to 2.53.9 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 20, 2020Xmidt cjwt through 1.0.1 before 2019-11-25 maps unsupported algorithms to alg=none, which sometimes leads to untrusted accidental JWT acceptance.CVE-2019-19324 · Other software · Xmidt · reported by MITREHigh 7.5
Xmidt cjwt through 1.0.1 before 2019-11-25 maps unsupported algorithms to alg=none, which sometimes leads to untrusted accidental JWT acceptance.
Product
Cjwt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 26, 2020The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufCVE-2019-19134 · WordPress plugins & themes · reported by MITREMedium 6.1
The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based tokens or to launch other attacks.
Fixed in
2.2.3
What to do
Update the plugin to 2.2.3 or newer.
Full record and what to do →NVD record heroplugins.com heroplugins.com
Jan 31, 2020Cross-site scripting (XSS) vulnerability in infoware MapSuite MapAPI 1.0.x before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to inject arbitrary webCVE-2014-2843 · Other software · Infoware · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in infoware MapSuite MapAPI 1.0.x before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Mapsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record iw.mapandroute.de iw.mapandroute.de
Jan 23, 2020WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.CVE-2012-6649 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.
Affected
1.1.21 to 1.1.21
What to do
Affects 1.1.21 to 1.1.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com securityfocus.com
Jan 23, 2020The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSSCVE-2014-7238 · WordPress plugins & themes · reported by MITREMedium 6.1
The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS
Affected
1.0 to 2.4
What to do
Affects 1.0 to 2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Jan 9, 2020Gateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability which allows remote attackers to execute local PHP code and obtCVE-2012-2950 · Other software · Gatewaygeomatics · reported by MITREHigh 8.1
Gateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability which allows remote attackers to execute local PHP code and obtain sensitive information.
Product
Mapserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Oct 29, 2019Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing.CVE-2010-1678 · Other software · Osgeo · reported by MITREHigh 7.5
Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing.
Product
Mapserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record people.canonical.com security-tracker.debian.org
Sep 5, 2019A SQL injection vulnerability in IntraMaps MapControl 8 allows attackers to execute arbitrary SQL commands via the /ApplicationEngine/Search/Refine/Set page.CVE-2019-13191 · Other software · Mapsolutions · reported by MITREHigh 7.5
A SQL injection vulnerability in IntraMaps MapControl 8 allows attackers to execute arbitrary SQL commands via the /ApplicationEngine/Search/Refine/Set page.
Product
Intramaps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.contentsecurity.com.au blog.contentsecurity.com.au
Aug 21, 2019The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.CVE-2017-18557 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.
Product
bws-google-maps
Fixed in
1.3.6
What to do
Update bws-google-maps to 1.3.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 9, 2019The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.CVE-2019-14792 · WordPress plugins & themes · reported by MITREMedium 5.4
The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.
Product
WP Google Maps
Fixed in
7.11.35
What to do
Update WP Google Maps to 7.11.35 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jul 5, 2019HTML5 Maps 1.6.5.6 and earlier: Cross-site request forgery (CSRF)CVE-2019-5983 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in HTML5 Maps 1.6.5.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
HTML5 Maps 1.6.5.6 and earlier
Affected
up to 1.6.5.6
What to do
Affects up to 1.6.5.6. Update HTML5 Maps 1.6.5.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
May 28, 2019In Webbukkit Dynmap 3.0-beta-3 or below, due to a missing login check in servlet/MapStorageHandler.java, an attacker can see a map image without login even if vCVE-2019-12395 · Other software · Dynmap Project · reported by MITREMedium 5.3
In Webbukkit Dynmap 3.0-beta-3 or below, due to a missing login check in servlet/MapStorageHandler.java, an attacker can see a map image without login even if victim enables login-required in setting.
Product
Dynmap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp github.com
Apr 2, 2019In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.CVE-2019-10692 · WordPress plugins & themes · reported by MITRECritical 9.8
In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.
Product
In the wp-google-maps
Fixed in
7.11.18
What to do
Update In the wp-google-maps to 7.11.18 or newer.
Full record and what to do →NVD record packetstormsecurity.com rapid7.com
Mar 21, 2019The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.CVE-2019-9912 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.
Product
wp-google-maps
Fixed in
7.10.43
What to do
Update wp-google-maps to 7.10.43 or newer.
Full record and what to do →NVD record seclists.org lists.openwall.net
Feb 15, 2019Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXMLCVE-2015-4615 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXML, mapCSSXML, mapHTML,mapID variables
Affected
1.09 to 1.09
What to do
Affects 1.09 to 1.09. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org wordpress.org
Feb 4, 2019MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvg_save that caCVE-2019-1000003 · WordPress plugins & themes · reported by MITREHigh 8.8
MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvg_save that can result in an attacker can modify post data, including embedding javascript. This attack appears to be exploitable via the victim must be logged in to WordPress as an admin, and click a link. This vulnerability appears to have been fixed in 3.3.0 and later.
Fixed in
3.3.0
What to do
Update the plugin to 3.3.0 or newer.
Full record and what to do →NVD record advisories.dxw.com wpvulndb.com
Jan 15, 2019It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices.CVE-2018-16846 · Other software · [UNKNOWN] · reported by Red HatMedium 6.5
It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices.
Product
ceph
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org access.redhat.com
Jan 9, 2019Google XML Sitemaps Version 4.0.9 and earlier: Cross-site scriptingCVE-2018-16204 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.8
Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Google XML Sitemaps Version 4.0.9 and earlier
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update Google XML Sitemaps Version 4.0.9 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Oct 3, 2018The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.CVE-2018-17947 · WordPress plugins & themes · reported by MITREMedium 6.1
The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.
Product
Snazzy Maps
Fixed in
1.1.5
What to do
Update Snazzy Maps to 1.1.5 or newer.
Full record and what to do →NVD record defensecode.com seclists.org
Jul 12, 2018The komoot GmbH "Komoot - Cycling & Hiking Maps" app before 9.3.2 -- aka komoot-cycling-hiking-maps/id447374873 -- for iOS does not verify X.509 certificates frCVE-2017-14709 · Other software · Komoot · reported by MITREHigh 7.4
The komoot GmbH "Komoot - Cycling & Hiking Maps" app before 9.3.2 -- aka komoot-cycling-hiking-maps/id447374873 -- for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Komoot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record crissyfield.de crissyfield.de
Apr 16, 2018The CATALooK.netStore module through 7.2.8 for DNN (formerly DotNetNuke) allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin parameter, or the /ImagCVE-2018-10138 · Other software · Catalooksupport · reported by MITREMedium 6.1
The CATALooK.netStore module through 7.2.8 for DNN (formerly DotNetNuke) allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin parameter, or the /ImageViewer.aspx link or desc parameter.
Product
.netstore
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxsecurity.com cxsecurity.com
Apr 11, 2018An elevation of privilege vulnerability exists when Windows improperly handles objects in memory and incorrectly maps kernel memory, aka "Microsoft DirectX GrapCVE-2018-1009 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
An elevation of privilege vulnerability exists when Windows improperly handles objects in memory and incorrectly maps kernel memory, aka "Microsoft DirectX Graphics Kernel Subsystem Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.
Product
Windows Server 2012 R2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Mar 25, 2018The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature.CVE-2018-9020 · WordPress plugins & themes · reported by MITREMedium 5.4
The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature.
Product
Events Manager
Fixed in
5.8.1.2
What to do
Update Events Manager to 5.8.1.2 or newer.
Full record and what to do →NVD record wp-events-plugin.com wordpress.org
Feb 28, 2018The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8CVE-2018-1304 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.9
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.
Product
Apache Tomcat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Dec 31, 2017Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint.CVE-2017-18004 · Other software · Zurmo · reported by MITREMedium 5.4
Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint.
Product
Zurmo CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bitbucket.org bitbucket.org
Sep 27, 2017The Googlemaps plugin 3.2 and earlier for Joomla! allows remote attackers with control of a sub-domain belonging to a victim domain to cause a denial of serviceCVE-2014-9686 · Other software · Mapsplugin · reported by MITREMedium 5.9
The Googlemaps plugin 3.2 and earlier for Joomla! allows remote attackers with control of a sub-domain belonging to a victim domain to cause a denial of service via the 'url' parameter to plugin_googlemap3_kmlprxy.php. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7428.
Product
Googlemaps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org websecurity.com.ua
Sep 14, 2017The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugin_googlemap2_proxy.php.CVE-2013-7429 · Other software · Mapsplugin · reported by MITRECritical 9.8
The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugin_googlemap2_proxy.php.
Product
Googlemaps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org mapsplugin.com
Sep 7, 2017The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to cause a denial of service via the url parameter to plugin_googlemap2_proxy.php.CVE-2013-7428 · Other software · Mapsplugin · reported by MITREHigh 7.5
The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to cause a denial of service via the url parameter to plugin_googlemap2_proxy.php.
Product
Googlemaps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org mapsplugin.com
Aug 29, 2017Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla!.CVE-2013-7433 · Other software · Mapsplugin · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla!.
Product
Googlemaps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityvulns.ru mapsplugin.com
Aug 29, 2017The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to bypass an intended protection mechanism.CVE-2013-7432 · Other software · Mapsplugin · reported by MITREHigh 7.5
The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to bypass an intended protection mechanism.
Product
Googlemaps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityvulns.ru mapsplugin.com
Aug 29, 2017Full path disclosure in the Googlemaps plugin before 3.1 for Joomla!.CVE-2013-7431 · Other software · Mapsplugin · reported by MITREMedium 5.3
Full path disclosure in the Googlemaps plugin before 3.1 for Joomla!.
Product
Googlemaps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityvulns.ru mapsplugin.com
Aug 28, 2017Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the CVE-2013-7430 · Other software · Mapsplugin · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the xmlns parameter.
Product
Googlemaps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mapsplugin.com openwall.com
Jun 19, 2017NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily manipulate memory leadCVE-2017-1000375 · Other software · Netbsd · reported by MITRECritical 9.8
NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily manipulate memory leading to arbitrary code execution. This affects NetBSD 7.1 and possibly earlier versions.
Product
Netbsd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exploit-db.com
Mar 15, 2017Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial CVE-2017-5522 · Other software · Debian · reported by MITRECritical 9.8
Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.
Product
Debian Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record debian.org mapserver.org
Dec 8, 2016In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails.CVE-2016-9839 · Other software · Osgeo · reported by MITREHigh 7.5
In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails.
Product
Mapserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.