Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

491new WordPress flaws this week

392,772entries in the database

4,762 results · page 84 of 96

Jun 14, 2019While deserializing any key blob during key operations, buffer overflow could occur, exposing partial key information if any key operations are invoked in SnapdCVE-2018-13907 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 5.3
While deserializing any key blob during key operations, buffer overflow could occur, exposing partial key information if any key operations are invoked in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8074, MDM9150, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCA8081, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Jun 14, 2019Failure to initialize the reserved memory which is sent to the firmware might lead to exposure of 1 byte of uninitialized kernel SKB memory to FW in Snapdragon CVE-2018-11942 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 5.5
Failure to initialize the reserved memory which is sent to the firmware might lead to exposure of 1 byte of uninitialized kernel SKB memory to FW in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24
Product
Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codeaurora.org codeaurora.org
Jun 6, 2019CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in Workday through 32 via a value (provided by a low-privileged userCVE-2019-12134 · Other software · Workday · reported by MITREHigh 8.8
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in Workday through 32 via a value (provided by a low-privileged user in a contact form field) that is mishandled in a CSV export.
Product
Workday
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sinfosec757.blogspot.com sinfosec757.blogspot.com
May 29, 2019An Information Exposure vulnerability in Fortinet FortiOS 6.0.1, 5.6.5 and below, allow attackers to learn private IP as well as the hostname of FortiGate via ACVE-2018-13365 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.3
An Information Exposure vulnerability in Fortinet FortiOS 6.0.1, 5.6.5 and below, allow attackers to learn private IP as well as the hostname of FortiGate via Application Control Block page.
Product
Fortinet FortiOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortiguard.com
May 29, 2019types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access cCVE-2019-12452 · Other software · Traefik · reported by MITREHigh 7.5
types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control (which is contrary to the API documentation), allows remote authenticated users to discover password hashes by reading the Basic HTTP Authentication or Digest HTTP Authentication section, or discover a key by reading the ClientTLS section. These can be found in the JSON response to a /api request.
Product
Traefik
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.traefik.io github.com
May 27, 2019Tor Browser before 8.0.1 has an information exposure vulnerability.CVE-2019-12383 · Other software · Torproject · reported by MITREMedium 4.3
Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting.
Product
TOR Browser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com gitweb.torproject.org
May 24, 2019Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagController.php related to change_tags.CVE-2016-8900 · Other software · Exponentcms · reported by MITRECritical 9.8
Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagController.php related to change_tags.
Product
Exponent CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
May 24, 2019Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php.CVE-2016-8898 · Other software · Exponentcms · reported by MITRECritical 9.8
Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php.
Product
Exponent CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
May 23, 2019Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change_cats.CVE-2016-8899 · Other software · Exponentcms · reported by MITRECritical 9.8
Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change_cats.
Product
Exponent CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
May 23, 2019Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php.CVE-2016-8897 · Other software · Exponentcms · reported by MITRECritical 9.8
Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php.
Product
Exponent CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
May 23, 2019Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure.CVE-2017-5210 · Other software · Open-xchange · reported by MITRECritical 9.8
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com ox.com
May 22, 2019A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause tCVE-2019-6806 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.5
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading variables in the controller using Modbus.
Product
Modicon Premium Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record schneider-electric.com talosintelligence.com
May 22, 2019A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause tCVE-2018-7844 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.5
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading memory blocks from the controller over Modbus.
Product
Modicon Premium Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record schneider-electric.com talosintelligence.com
May 22, 2019A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause tCVE-2018-7848 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.5
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading files from the controller over Modbus
Product
Modicon M580 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record schneider-electric.com talosintelligence.com
May 22, 2019OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure.CVE-2017-9809 · Other software · Open-xchange · reported by MITREMedium 5.3
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ox.com documentation.open-xchange.com
May 20, 2019IBM BigFix Platform 9.2 and 9.5 could allow a low-privilege user to manipulate the UI into exposing interface elements and information normally restricted to adCVE-2019-4058 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM BigFix Platform 9.2 and 9.5 could allow a low-privilege user to manipulate the UI into exposing interface elements and information normally restricted to administrators. IBM X-Force ID: 156570.
Product
BigFix Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
May 16, 2019An Information Exposure issue (issue 2 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11CVE-2019-10114 · Websites & servers · Gitlab · reported by MITREHigh 7.5
An Information Exposure issue (issue 2 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. During the OAuth authentication process, the application attempts to validate a parameter in an insecure way, potentially exposing data.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
May 15, 2019An Information Exposure issue (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11CVE-2019-10109 · Websites & servers · Gitlab · reported by MITREMedium 5.3
An Information Exposure issue (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. EXIF geolocation data were not removed from images when uploaded to GitLab. As a result, anyone with access to the uploaded image could obtain its geolocation, device, and software version data (if present).
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
May 15, 2019A vulnerability in the SSH CLI key management functionality of Cisco NX-OS Software could allow an authenticated, local attacker to expose a user's private SSH CVE-2019-1731 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.4
A vulnerability in the SSH CLI key management functionality of Cisco NX-OS Software could allow an authenticated, local attacker to expose a user's private SSH key to all authenticated users on the targeted device. The attacker must authenticate with valid administrator device credentials. The vulnerability is due to incomplete error handling if a specific error type occurs during the SSH key export. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the CLI. A successful exploit could allow the attacker to expose a user's private SSH key. In addition, a similar type of error in the SSH key import could cause the passphrase-protected private SSH key to be imported unintentionally.
Product
Cisco NX-OS Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com tools.cisco.com
May 10, 2019Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to the harp server ruleCVE-2019-5437 · Other software · Harpjs · reported by support@hackerone.comMedium 5.3
Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to the harp server rules.Vulnerable versions are <= 0.29.0 and no fix was applied to our knowledge.
Product
Harp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com hackerone.com
May 10, 2019OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure.CVE-2017-12884 · Other software · Open-xchange · reported by MITREHigh 7.5
OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record app.com ox.com
May 9, 2019Information exposure through process environment vulnerability in Synology Calendar before 2.3.3-0620 allows local users to obtain credentials via cmdline.CVE-2019-11820 · Network & remote access · Synology · reported by security@synology.comMedium 5.5
Information exposure through process environment vulnerability in Synology Calendar before 2.3.3-0620 allows local users to obtain credentials via cmdline.
Product
Calendar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com synology.com
May 3, 2019On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensitive configuration objects over insecure transmission channelCVE-2019-6613 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 5.3
On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is used with various profile types and is accessed using SNMPv2.
Product
BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com support.f5.com
Apr 26, 2019Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering CVE-2019-9797 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox < 66.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Apr 24, 2019aquaverde Aquarius CMS through 4.3.5 allows Information Exposure through Log Files because of an error in the Log-File writer component.CVE-2019-9724 · Other software · Aquaverde · reported by MITREHigh 7.5
aquaverde Aquarius CMS through 4.3.5 allows Information Exposure through Log Files because of an error in the Log-File writer component.
Product
Aquarius CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tryption.ch tryption.ch
Apr 22, 2019In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory nameCVE-2019-10246 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgMedium 5.3
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
Product
Eclipse Jetty
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.eclipse.org lists.apache.org
Apr 22, 2019It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse.CVE-2019-3899 · Other software · The Heketi Project · reported by Red HatCritical 9.8
It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only affects heketi as shipped with Openshift Container Platform 3.11.
Product
heketi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Apr 22, 2019The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the origiCVE-2016-1587 · Other software · Ubuntu · reported by security@ubuntu.comHigh 7.1
The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the origin of the connection. An attacker could have used the controls to remotely add a valid, but malicious, snap package, from the Store, potentially using system resources without permission from the legitimate administrator of the system.
Product
snapweb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 22, 2019Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem.CVE-2011-3147 · Other software · Openstack · reported by MITREHigh 8.6
Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem.
Product
Nova
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bazaar.launchpad.net bazaar.launchpad.net
Apr 22, 2019I, Librarian 4.10 has XSS via the export.php export_files parameter.CVE-2019-11428 · Other software · Scilico · reported by MITREMedium 6.1
I, Librarian 4.10 has XSS via the export.php export_files parameter.
Product
I, Librarian
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 17, 2019An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTML source code.CVE-2018-13378 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.2
An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTML source code.
Product
Fortisiem
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortiguard.com
Apr 9, 2019In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies.CVE-2019-10243 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgMedium 5.3
In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. This can be used as a hint by an attacker to specifically craft attacks to the web server run by Kura.
Product
Eclipse Kura
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugs.eclipse.org
Apr 8, 2019IBM QRadar SIEM 7.3.2 could allow a user to bypass authentication exposing certain functionality which could lead to information disclosure or modification of aCVE-2019-4210 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM QRadar SIEM 7.3.2 could allow a user to bypass authentication exposing certain functionality which could lead to information disclosure or modification of application configuration. IBM X-Force ID: 158986.
Product
QRadar SIEM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Apr 8, 2019IBM Spectrum Protect 7.1 and 8.1 is affected by a password exposure vulnerability caused by insecure file permissions.CVE-2018-1787 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.1
IBM Spectrum Protect 7.1 and 8.1 is affected by a password exposure vulnerability caused by insecure file permissions. IBM X-Force ID: 148872.
Product
Spectrum Protect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com exchange.xforce.ibmcloud.com
Apr 1, 2019Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitive system informatiCVE-2018-13297 · Network & remote access · Synology · reported by security@synology.comMedium 5.3
Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitive system information via the dsm_path parameter.
Product
Drive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com synology.com
Apr 1, 2019Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtaCVE-2018-13295 · Network & remote access · Synology · reported by security@synology.comMedium 4.3
Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the version parameter.
Product
Application Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com synology.com
Apr 1, 2019Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitCVE-2018-13294 · Network & remote access · Synology · reported by security@synology.comMedium 4.3
Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the uid parameter.
Product
Application Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com synology.com
Apr 1, 2019Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to obtain CVE-2018-13292 · Network & remote access · Synology · reported by security@synology.comMedium 4.3
Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to obtain sensitive information via the world readable configuration.
Product
Synology Router Manager (SRM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com synology.com
Apr 1, 2019Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to obtCVE-2018-13291 · Network & remote access · Synology · reported by security@synology.comMedium 4.3
Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to obtain sensitive information via the world readable configuration.
Product
DiskStation Manager (DSM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com synology.com
Apr 1, 2019Information exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to determine the exisCVE-2018-13290 · Network & remote access · Synology · reported by security@synology.comMedium 4.3
Information exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to determine the existence of files or obtain sensitive information of files via the file_path parameter.
Product
Synology Router Manager (SRM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com synology.com
Apr 1, 2019Information exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote attackers to obtain sensitive iCVE-2018-13289 · Network & remote access · Synology · reported by security@synology.comMedium 5.3
Information exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote attackers to obtain sensitive information via the (1) folder_path or (2) real_path parameter.
Product
Synology Router Manager (SRM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com synology.com
Apr 1, 2019Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attackers to obtainCVE-2018-13288 · Network & remote access · Synology · reported by security@synology.comMedium 5.3
Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attackers to obtain sensitive information via the (1) folder_path or (2) real_path parameter.
Product
File Station
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com synology.com
Mar 28, 2019When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables.CVE-2019-3869 · Other software · Red Hat · reported by Red HatHigh 7.2
When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.
Product
Tower
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com github.com
Mar 26, 2019The potential exists for exposure of the product's password used to restrict unauthorized access to Rockwell PLC5/SLC5/0x/RSLogix 1785-Lx and 1747-L5x controlleCVE-2010-5305 · Other software · Rockwell Automation · reported by ics-cert@hq.dhs.govCritical 9.8
The potential exists for exposure of the product's password used to restrict unauthorized access to Rockwell PLC5/SLC5/0x/RSLogix 1785-Lx and 1747-L5x controllers. The potential exists for an unauthorized programming and configuration client to gain access to the product and allow changes to the product’s configuration or program. When applicable, upgrade product firmware to a version that includes enhanced security functionality compatible with Rockwell Automation's FactoryTalk Security services.
Product
PLC5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rockwellautomation.custhelp.com cisa.gov
Mar 23, 2019The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path.CVE-2019-9960 · Other software · Limesurvey · reported by MITRECritical 9.8
The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path.
Product
Limesurvey
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 21, 2019hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model systeCVE-2019-8934 · Other software · Qemu · reported by MITRELow 3.3
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
Product
Qemu
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Mar 21, 2019In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames.CVE-2018-19513 · Other software · ENS · reported by MITREHigh 7.5
In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames. The log file could contain sensitive client data (email addresses) and also facilitates exploitation of SQL injection errors.
Product
Webgalamb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Mar 13, 2019RSA Archer versions, prior to 6.5 SP2, contain an information exposure vulnerability.CVE-2019-3716 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
RSA Archer versions, prior to 6.5 SP2, contain an information exposure vulnerability. The database connection password may get logged in plain text in the RSA Archer log files. An authenticated malicious local user with access to the log files may obtain the exposed password to use it in further attacks.
Product
RSA Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com seclists.org
Mar 13, 2019RSA Archer versions, prior to 6.5 SP1, contain an information exposure vulnerability.CVE-2019-3715 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
RSA Archer versions, prior to 6.5 SP1, contain an information exposure vulnerability. Users' session information is logged in plain text in the RSA Archer log files. An authenticated malicious local user with access to the log files may obtain the exposed information to use it in further attacks.
Product
RSA Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com seclists.org
Mar 12, 2019Data Leakage Attacks vulnerability in the web interface in McAfee Database Security prior to the 4.6.6 March 2019 update allows local users to expose passwords CVE-2019-3615 · Other software · McAfee, LCC · reported by trellixpsirt@trellix.comMedium 5.3
Data Leakage Attacks vulnerability in the web interface in McAfee Database Security prior to the 4.6.6 March 2019 update allows local users to expose passwords via incorrectly auto completing password fields in the admin browser login screen.
Product
McAfee Database Security (DAM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com kc.mcafee.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.