Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

4,359 results · page 84 of 88

Oct 22, 2009Unspecified vulnerability in the Business Intelligence Enterprise Edition component in unspecified Oracle Application Server versions allows remote attackers toCVE-2009-1999 · Other software · Oracle · reported by secalert_us@oracle.comMedium 4.3
Unspecified vulnerability in the Business Intelligence Enterprise Edition component in unspecified Oracle Application Server versions allows remote attackers to affect integrity via unknown vectors.
Product
Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Oct 22, 2009Unspecified vulnerability in the Business Intelligence Enterprise Edition component in Oracle Application Server 10.1.3.4.1 allows local users to affect confideCVE-2009-1990 · Other software · Oracle · reported by secalert_us@oracle.comLow 1.7
Unspecified vulnerability in the Business Intelligence Enterprise Edition component in Oracle Application Server 10.1.3.4.1 allows local users to affect confidentiality via unknown vectors.
Product
Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Sep 18, 2009Unspecified vulnerability in the wberuntimeear application in the test servlet in IBM WebSphere Business Events 6.1 and 6.2 allows remote attackers to execute aCVE-2009-2741 · Other software · IBM · reported by MITREHigh 10
Unspecified vulnerability in the wberuntimeear application in the test servlet in IBM WebSphere Business Events 6.1 and 6.2 allows remote attackers to execute arbitrary code via unknown vectors.
Product
Websphere Business Events
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com exchange.xforce.ibmcloud.com
Sep 14, 2009Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10.2 allow remote attackers to affect confidentiality via unknown vectors related to the (1CVE-2008-7239 · Other software · Oracle · reported by MITREMedium 5
Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10.2 allow remote attackers to affect confidentiality via unknown vectors related to the (1) Oracle Application Object Library (APP02) and (2) Oracle Applications Manager (APP04).
Product
E-business Suite 11i
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info secunia.com
Sep 14, 2009Multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.3 allow (1) local users to affect confidentiality and integrity via unknown vectors relatedCVE-2008-7238 · Other software · Oracle · reported by MITREMedium 6
Multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.3 allow (1) local users to affect confidentiality and integrity via unknown vectors related to the Mobile Application Server component (APP01); (2) remote attackers to affect confidentiality via unknown vectors related to the Oracle Applications Framework (APP03); remote authenticated users to affect confidentiality and integrity via unknown vectors related to the (3) CRM Technical Foundation (APP05) and (4) Oracle Application Object Library (APP06); and remote authenticated users to affect integrity and availability via unknown vectors related to (5) Oracle Applications Technology Stack (APP07).
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info secunia.com
Sep 14, 2009Unspecified vulnerability in the Oracle Forms component in Oracle Application Server 10.1.2.2 and E-Business Suite 12.0.3 allows remote attackers to affect inteCVE-2008-7235 · Other software · Oracle · reported by MITREMedium 4.3
Unspecified vulnerability in the Oracle Forms component in Oracle Application Server 10.1.2.2 and E-Business Suite 12.0.3 allows remote attackers to affect integrity via unknown vectors, aka AS04.
Product
Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info secunia.com
Sep 14, 2009Unspecified vulnerability in the E-Business Application client, as used in Oracle Application Server 1.1.8.26 and E-Business Suite 11.5.10.2, allows remote attaCVE-2008-7233 · Other software · Oracle · reported by MITREHigh 9.3
Unspecified vulnerability in the E-Business Application client, as used in Oracle Application Server 1.1.8.26 and E-Business Suite 11.5.10.2, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Oracle Jinitiator component, aka AS02.
Product
Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info secunia.com
Aug 5, 2009Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and eaCVE-2009-2676 · Other software · SUN · reported by MITREMedium 6.8
Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher.
Product
Java SE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Jul 14, 2009Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality viCVE-2009-1986 · Other software · Oracle · reported by secalert_us@oracle.comLow 2.6
Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality via unknown vectors.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jul 14, 2009Unspecified vulnerability in the Application Install component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1 allows local users to affect confidentialiCVE-2009-1984 · Other software · Oracle · reported by secalert_us@oracle.comMedium 4.4
Unspecified vulnerability in the Application Install component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the Patch Administrator.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jul 14, 2009Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1 allows remote attackers to affect integrity via CVE-2009-1983 · Other software · Oracle · reported by secalert_us@oracle.comMedium 4.3
Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1 allows remote attackers to affect integrity via unknown vectors.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jul 14, 2009Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2 and 12.0.6 allows remote attackers to affect integCVE-2009-1982 · Other software · Oracle · reported by secalert_us@oracle.comMedium 4.3
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2 and 12.0.6 allows remote attackers to affect integrity via unknown vectors.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jul 14, 2009Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1 allows remote authenticated CVE-2009-1980 · Other software · Oracle · reported by secalert_us@oracle.comMedium 6
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jun 26, 2009Stack-based buffer overflow in mnet.exe in Unisys Business Information Server (BIS) 10 and 10.1 on Windows allows remote attackers to execute arbitrary code viaCVE-2009-1628 · Other software · Unisys · reported by MITREHigh 10
Stack-based buffer overflow in mnet.exe in Unisys Business Information Server (BIS) 10 and 10.1 on Windows allows remote attackers to execute arbitrary code via a crafted TCP packet.
Product
Business Information Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ftp.support.unisys.com labs.idefense.com
May 16, 2009admin/adminaddeditdetails.php in Business Community Script does not properly restrict access, which allows remote attackers to gain privileges and add administrCVE-2009-1652 · Other software · 2daybiz · reported by MITREHigh 7.5
admin/adminaddeditdetails.php in Business Community Script does not properly restrict access, which allows remote attackers to gain privileges and add administrators via a direct request.
Product
Business Community Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
May 16, 2009SQL injection vulnerability in admin/member_details.php in 2daybiz Business Community Script allows remote attackers to execute arbitrary SQL commands via the mCVE-2009-1651 · Other software · 2daybiz · reported by MITREHigh 7.5
SQL injection vulnerability in admin/member_details.php in 2daybiz Business Community Script allows remote attackers to execute arbitrary SQL commands via the mid parameter.
Product
Business Community Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
May 1, 2009SQL injection vulnerability in directory.php in Sites for Scripts (SFS) EZ Home Business Directory allows remote attackers to execute arbitrary SQL commands viaCVE-2008-6783 · Other software · Scripts-for-sites · reported by MITREHigh 7.5
SQL injection vulnerability in directory.php in Sites for Scripts (SFS) EZ Home Business Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.
Product
EZ Home Business Directory
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com osvdb.org
Apr 15, 2009The Oracle Applications Framework component in Oracle E-Business Suite 12.0.6 and 11i10CU2 uses default passwords for unspecified "FND Applications Users (not DCVE-2009-1000 · Other software · Oracle · reported by secalert_us@oracle.comHigh 7.5
The Oracle Applications Framework component in Oracle E-Business Suite 12.0.6 and 11i10CU2 uses default passwords for unspecified "FND Applications Users (not DB users)," which has unknown impact and attack vectors.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 15, 2009Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 allows remote attackers to affect confidentialityCVE-2009-0999 · Other software · Oracle · reported by secalert_us@oracle.comMedium 6.8
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 15, 2009Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.0.6 and 11i10CU2 allows remote attackers to affect integrCVE-2009-0995 · Other software · Oracle · reported by secalert_us@oracle.comMedium 4.3
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.0.6 and 11i10CU2 allows remote attackers to affect integrity via unknown vectors.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 15, 2009The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 200CVE-2009-0077 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5
The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2004 SP3, 2006, 2006 Supportability Update, and 2006 SP1; does not properly manage the session state of web listeners, which allows remote attackers to cause a denial of service (many stale sessions) via crafted packets, aka "Web Proxy TCP State Limited Denial of Service Vulnerability."
Product
Forefront Threat Management Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Mar 11, 2009The SIP channel driver in Asterisk Open Source 1.4.22, 1.4.23, and 1.4.23.1; 1.6.0 before 1.6.0.6; 1.6.1 before 1.6.1.0-rc2; and Asterisk Business Edition C.2.3CVE-2009-0871 · Other software · Digium · reported by MITRELow 3.5
The SIP channel driver in Asterisk Open Source 1.4.22, 1.4.23, and 1.4.23.1; 1.6.0 before 1.6.0.6; 1.6.1 before 1.6.1.0-rc2; and Asterisk Business Edition C.2.3, with the pedantic option enabled, allows remote authenticated users to cause a denial of service (crash) via a SIP INVITE request without any headers, which triggers a NULL pointer dereference in the (1) sip_uri_headers_cmp and (2) sip_uri_params_cmp functions.
Product
Asterisk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.digium.com bugs.digium.com
Mar 2, 2009SQL injection vulnerability in survey_results_text.php in TurnkeyForms Business Survey Pro 1.0 allows remote attackers to execute arbitrary SQL commands via theCVE-2008-6349 · Other software · Turnkeyforms · reported by MITREHigh 7.5
SQL injection vulnerability in survey_results_text.php in TurnkeyForms Business Survey Pro 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
Business Survey Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Feb 27, 2009SQL injection vulnerability in the WEBERkommunal Facilities (wes_facilities) extension 2.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands vCVE-2008-6338 · Other software · Weber-ebusiness · reported by MITREHigh 7.5
SQL injection vulnerability in the WEBERkommunal Facilities (wes_facilities) extension 2.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Product
WES Facilities
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com typo3.org
Feb 25, 2009SQL injection vulnerability in index.php in PHP TV Portal 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the mid parameter.CVE-2008-6285 · Other software · Businessvein · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in PHP TV Portal 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the mid parameter.
Product
PHP TV Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Feb 23, 2009Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and (1) read sensitive Customer or Order data via a modifCVE-2009-0700 · Other software · Plunet · reported by MITREMedium 4
Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and (1) read sensitive Customer or Order data via a modified Pfad parameter to pagesUTF8/Sys_DirAnzeige.jsp, or (2) list sensitive Jobs via a direct request to pagesUTF8/auftrag_job.jsp.
Product
Business Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com archives.neohapsis.com
Feb 23, 2009Cross-site scripting (XSS) vulnerability in pagesUTF8/auftrag_allgemeinauftrag.jsp in Plunet BusinessManager 4.1 and earlier allows remote authenticated users tCVE-2009-0699 · Other software · Plunet · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in pagesUTF8/auftrag_allgemeinauftrag.jsp in Plunet BusinessManager 4.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the (1) QUB and (2) Bez74 parameters.
Product
Business Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com archives.neohapsis.com
Feb 10, 2009SQL injection vulnerability in the classified page (classified.php) in BusinessSpace 1.2 and earlier allows remote attackers to execute arbitrary SQL commands vCVE-2009-0516 · Other software · Businessspace · reported by MITREHigh 7.5
SQL injection vulnerability in the classified page (classified.php) in BusinessSpace 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
Product
Businessspace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Feb 10, 2009Cross-site request forgery (CSRF) vulnerability in IBM Workplace for Business Controls and Reporting 2.x and IBM Workplace Web Content Management 6.x has unknowCVE-2008-6106 · Other software · IBM · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in IBM Workplace for Business Controls and Reporting 2.x and IBM Workplace Web Content Management 6.x has unknown impact and remote attack vectors. NOTE: some of these details are obtained from third party information.
Product
Workplace For Business Controls And Reporting
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com www-1.ibm.com
Feb 10, 2009Cross-site scripting (XSS) vulnerability in IBM Workplace for Business Controls and Reporting 2.x and IBM Workplace Web Content Management 6.x allows remote attCVE-2008-6105 · Other software · IBM · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in IBM Workplace for Business Controls and Reporting 2.x and IBM Workplace Web Content Management 6.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information.
Product
Workplace For Business Controls And Reporting
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com www-1.ibm.com
Feb 4, 2009PreProjects Pre Courier and Cargo Business stores dbcourior.mdb under the web root with insufficient access control, which allows remote attackers to obtain pasCVE-2008-6054 · Other software · Preprojects.com · reported by MITREMedium 5
PreProjects Pre Courier and Cargo Business stores dbcourior.mdb under the web root with insufficient access control, which allows remote attackers to obtain passwords via a direct request.
Product
PRE Courier And Cargo Business
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstorm.linuxsecurity.com secunia.com
Feb 2, 2009SQL injection vulnerability in the Sigsiu Online Business Index 2 (SOBI2, com_sobi2) RC 2.8.2 component for Joomla! and Mambo allows remote attackers to executeCVE-2009-0380 · Other software · Sigsiu.net · reported by MITREHigh 7.5
SQL injection vulnerability in the Sigsiu Online Business Index 2 (SOBI2, com_sobi2) RC 2.8.2 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the bid parameter in a showbiz action to index.php, a different vector than CVE-2008-0607. NOTE: CVE disputes this issue, since neither "showbiz" nor "bid" appears in the source code for SOBI2
Product
Sobi2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record attrition.org securityfocus.com
Jan 26, 2009SQL injection vulnerability in default.asp in Active Business Directory 2 allows remote attackers to execute arbitrary SQL commands via the catid parameter.CVE-2008-5972 · Other software · Activewebsoftwares · reported by MITREHigh 7.5
SQL injection vulnerability in default.asp in Active Business Directory 2 allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Product
Active Business Directory
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Jan 14, 2009IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x bCVE-2009-0041 · Other software · Asterisk · reported by MITREMedium 5
IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and C.2.x.x before C.2.1.2.1; and s800i 1.2.x before 1.3.0 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Product
Asterisk Business Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record downloads.digium.com secunia.com
Jan 13, 2009Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10 and CU2 allows remote authenticated users to affCVE-2008-5458 · Other software · Oracle · reported by secalert_us@oracle.comMedium 5.5
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10 and CU2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com oracle.com
Jan 13, 2009Unspecified vulnerability in the iProcurement component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows remote authenticated users to affect confidentiCVE-2008-5454 · Other software · Oracle · reported by secalert_us@oracle.comMedium 4.9
Unspecified vulnerability in the iProcurement component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
Product
E-business Suite 11i
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com oracle.com
Jan 13, 2009Unspecified vulnerability in the Oracle Applications Platform Engineering component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows local users to affeCVE-2008-5450 · Other software · Oracle · reported by secalert_us@oracle.comLow 1.2
Unspecified vulnerability in the Oracle Applications Platform Engineering component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows local users to affect confidentiality via unknown vectors.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com oracle.com
Jan 13, 2009Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows remote authenticated users to CVE-2008-5446 · Other software · Oracle · reported by secalert_us@oracle.comLow 3.5
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows remote authenticated users to affect confidentiality via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is related to unrestricted guest access to the "About Us Page" in the Oracle Applications Framework (OAF), which allows attackers to obtain sensitive system and application environment information.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secniche.org secunia.com
Dec 17, 2008Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to causCVE-2008-5558 · Other software · Asterisk · reported by MITREMedium 4.3
Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service (crash) via authentication attempts involving (1) an unknown user or (2) a user using hostname matching.
Product
Asterisk Business Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record downloads.digium.com osvdb.org
Dec 12, 2008SQL injection vulnerability in showcategory.php in PozScripts Business Directory Script allows remote attackers to execute arbitrary SQL commands via the cid paCVE-2008-5496 · Other software · Pozscripts · reported by MITREHigh 7.5
SQL injection vulnerability in showcategory.php in PozScripts Business Directory Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Product
Business Directory Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Nov 26, 2008webseald in WebSEAL 6.0.0.17 in IBM Tivoli Access Manager for e-business allows remote attackers to cause a denial of service (crash or hang) via HTTP requests,CVE-2008-5257 · Other software · IBM · reported by MITREMedium 4.3
webseald in WebSEAL 6.0.0.17 in IBM Tivoli Access Manager for e-business allows remote attackers to cause a denial of service (crash or hang) via HTTP requests, as demonstrated by a McAfee vulnerability scan.
Product
Tivoli Access Manager For E-business
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com www-01.ibm.com
Oct 14, 2008Unspecified vulnerability in the JDE EnterpriseOne Business Service Server component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.97.2.2 and 8CVE-2008-4004 · Other software · Jdedwards · reported by secalert_us@oracle.comLow 3.2
Unspecified vulnerability in the JDE EnterpriseOne Business Service Server component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.97.2.2 and 8.98.0.1 allows local users to affect confidentiality and integrity via unknown vectors.
Product
Enterpriseone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com oracle.com
Oct 14, 2008Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 12.0.4 allows remote authenticated users to affect confidentiality and integCVE-2008-3998 · Other software · Oracle · reported by secalert_us@oracle.comMedium 4.9
Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 12.0.4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com oracle.com
Oct 14, 2008Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2 and 12.0.4 allows remote authenticated users to afCVE-2008-3993 · Other software · Oracle · reported by secalert_us@oracle.comLow 3.5
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2 and 12.0.4 allows remote authenticated users to affect integrity via unknown vectors.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com oracle.com
Oct 14, 2008Unspecified vulnerability in the iSupplier Portal component in Oracle E-Business Suite 11.5.10.2 and 12.0.4 allows remote attackers to affect confidentiality viCVE-2008-3988 · Other software · Oracle · reported by secalert_us@oracle.comMedium 5
Unspecified vulnerability in the iSupplier Portal component in Oracle E-Business Suite 11.5.10.2 and 12.0.4 allows remote attackers to affect confidentiality via unknown vectors.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com oracle.com
Oct 14, 2008Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 12.0.4 allows remote attackers to affect confidentialCVE-2008-3985 · Other software · Oracle · reported by secalert_us@oracle.comMedium 5
Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 12.0.4 allows remote attackers to affect confidentiality via unknown vectors.
Product
E-business Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com oracle.com
Oct 14, 2008Unspecified vulnerability in the Oracle Reports Developer component in Oracle Application Server 1.0.2.2, 9.0.4.3, and 10.1.2.2, and E-Business Suite 11.5.10.2,CVE-2008-2619 · Other software · Oracle · reported by MITRELow 1.7
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Application Server 1.0.2.2, 9.0.4.3, and 10.1.2.2, and E-Business Suite 11.5.10.2, allows remote authenticated users to affect availability via unknown vectors.
Product
Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com oracle.com
Sep 4, 2008Asterisk Open Source 1.2.x before 1.2.32, 1.4.x before 1.4.24.1, and 1.6.0.x before 1.6.0.8; Asterisk Business Edition A.x.x, B.x.x before B.2.5.8, C.1.x.x befoCVE-2008-3903 · Other software · Asterisk · reported by MITRELow 3.5
Asterisk Open Source 1.2.x before 1.2.32, 1.4.x before 1.4.24.1, and 1.6.0.x before 1.6.0.8; Asterisk Business Edition A.x.x, B.x.x before B.2.5.8, C.1.x.x before C.1.10.5, and C.2.x.x before C.2.3.3; s800i 1.3.x before 1.3.0.2; and Trixbox PBX 2.6.1, when Digest authentication and authalwaysreject are enabled, generates different responses depending on whether a SIP username is valid, which allows remote attackers to enumerate valid usernames.
Product
P B X
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record downloads.asterisk.org misel.com
Aug 27, 2008The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.5 and 3.6 creates a CVE-2008-2433 · Other software · Trendmicro · reported by PSIRT-CNA@flexerasoftware.comCritical 9.8
The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.5 and 3.6 creates a random session token based only on the login time, which makes it easier for remote attackers to hijack sessions via brute-force attacks. NOTE: this can be leveraged for code execution through an unspecified "manipulation of the configuration."
Product
Client Server Messaging Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com secunia.com
Jul 24, 2008The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x beforeCVE-2008-3264 · Other software · Asterisk · reported by MITREHigh 7.8
The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers to cause a denial of service (traffic amplification) via an IAX2 FWDOWNL request.
Product
Asterisk Appliance Developer KIT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record downloads.digium.com secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.