Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,841 results · page 89 of 137
Jan 15, 2023A vulnerability, which was classified as critical, has been found in bony2023 Discussion-Board.CVE-2015-10051 · Other software · bony2023 · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in bony2023 Discussion-Board. Affected by this issue is the function display_all_replies of the file functions/main.php. The manipulation of the argument str leads to sql injection. The patch is identified as 26439bc4c63632d63ba89ebc0f149b25a9010361. It is recommended to apply a patch to fix this issue. VDB-218378 is the identifier assigned to this vulnerability.
- Product
- Discussion-Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability has been found in lolfeedback and classified as critical.CVE-2015-10046 · Other software · Lolfeedback Project · reported by VulDBMedium 5.5
A vulnerability has been found in lolfeedback and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The identifier of the patch is 6cf0b5f2228cd8765f734badd37910051000f2b2. It is recommended to apply a patch to fix this issue. The identifier VDB-218353 was assigned to this vulnerability.
- Product
- Lolfeedback
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability, which was classified as critical, was found in tutrantta project_todolist.CVE-2015-10045 · Other software · tutrantta · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in tutrantta project_todolist. Affected is the function getAffectedRows/where/insert/update in the library library/Database.php. The manipulation leads to sql injection. The name of the patch is 194a0411bbe11aa4813f13c66b9e8ea403539141. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218352.
- Product
- project_todolist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability classified as critical was found in gophergala sqldump.CVE-2015-10044 · Other software · gophergala · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in gophergala sqldump. This vulnerability affects unknown code. The manipulation leads to sql injection. The patch is identified as 76db54e9073b5248b8863e71a63d66a32d567d21. It is recommended to apply a patch to fix this issue. VDB-218350 is the identifier assigned to this vulnerability.
- Product
- sqldump
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability, which was classified as critical, has been found in pointhi searx_stats.CVE-2014-125077 · Other software · pointhi · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in pointhi searx_stats. This issue affects some unknown processing of the file cgi/cron.php. The manipulation leads to sql injection. The patch is named 281bd679a4474ddb222d16c1c380f252839cc18f. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218351.
- Product
- searx_stats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability classified as critical was found in visegripped Stracker.CVE-2022-4889 · Other software · visegripped · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file doc_root/public_html/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is 63e1b040373ee5b6c7d1e165ecf5ae1603d29e0a. It is recommended to apply a patch to fix this issue. The identifier VDB-218377 was assigned to this vulnerability.
- Product
- Stracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2023A vulnerability, which was classified as critical, was found in abreen Apollo.CVE-2015-10043 · Other software · abreen · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in abreen Apollo. This affects an unknown part. The manipulation of the argument file leads to path traversal. The patch is named 6206406630780bbd074aff34f4683fb764faba71. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218307.
- Product
- Apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2023A vulnerability has been found in ssn2013 cis450Project and classified as critical.CVE-2015-10020 · Other software · ssn2013 · reported by VulDBMedium 5.5
A vulnerability has been found in ssn2013 cis450Project and classified as critical. This vulnerability affects the function addUser of the file HeatMapServer/src/com/datformers/servlet/AddAppUser.java. The manipulation leads to sql injection. The name of the patch is 39b495011437a105c7670e17e071f99195b4922e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218380.
- Product
- cis450Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2023A vulnerability, which was classified as critical, has been found in GGGGGGGG ToN-MasterServer.CVE-2017-20169 · Other software · GGGGGGGG · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in GGGGGGGG ToN-MasterServer. Affected by this issue is some unknown functionality of the file public_html/irc_updater/svr_request_pub.php. The manipulation leads to sql injection. The patch is identified as 3a4c7e6d51bf95760820e3245e06c6e321a7168a. It is recommended to apply a patch to fix this issue. VDB-218306 is the identifier assigned to this vulnerability.
- Product
- ToN-MasterServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in Dovgalyuk AIBattle.CVE-2015-10042 · Other software · Dovgalyuk · reported by VulDBMedium 5.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in Dovgalyuk AIBattle. Affected by this vulnerability is the function registerUser of the file site/procedures.php. The manipulation of the argument postLogin leads to sql injection. The identifier of the patch is 448e9880aac18ae7832f8d065e03e46ce0f1d3e3. It is recommended to apply a patch to fix this issue. The identifier VDB-218305 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- AIBattle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Dovgalyuk AIBattle.CVE-2015-10041 · Other software · Dovgalyuk · reported by VulDBMedium 5.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Dovgalyuk AIBattle. Affected is the function sendComments of the file site/procedures.php. The manipulation of the argument text leads to sql injection. The name of the patch is e3aa4d0900167641d41cbccf53909229f00381c9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218304. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- AIBattle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2023Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys.CVE-2017-5242 · Other software · Rapid7 · reported by cve@rapid7.comHigh 7.7
Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key should be generated the first time a virtual appliance boots.
- Product
- Nexpose Virtual Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2023A vulnerability was found in aeharding classroom-engagement-system and classified as critical.CVE-2013-10011 · Other software · aeharding · reported by VulDBMedium 6.3
A vulnerability was found in aeharding classroom-engagement-system and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to sql injection. The attack may be launched remotely. The name of the patch is 096de5815c7b414e7339f3439522a446098fb73a. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218156.
- Product
- classroom-engagement-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2023A vulnerability classified as critical was found in TuziCMS 2.0.6.CVE-2023-0244 · Other software · Tuzicms Project · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in TuziCMS 2.0.6. This vulnerability affects the function delall of the file \App\Manage\Controller\KefuController.class.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-218152.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2023A vulnerability classified as critical has been found in TuziCMS 2.0.6.CVE-2023-0243 · Other software · Tuzicms Project · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in TuziCMS 2.0.6. This affects the function index of the file App\Manage\Controller\ArticleController.class.php of the component Article Module. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-218151.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023A vulnerability was found in gmail-servlet and classified as critical.CVE-2014-125075 · Other software · Gmail-servlet Project · reported by VulDBMedium 5.5
A vulnerability was found in gmail-servlet and classified as critical. This issue affects the function search of the file src/Model.java. The manipulation leads to sql injection. The identifier of the patch is 5d72753c2e95bb373aa86824939397dc25f679ea. It is recommended to apply a patch to fix this issue. The identifier VDB-218021 was assigned to this vulnerability.
- Product
- Gmail-servlet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023A vulnerability has been found in sviehb jefferson up to 0.3 and classified as critical.CVE-2022-4885 · Other software · sviehb · reported by VulDBMedium 5
A vulnerability has been found in sviehb jefferson up to 0.3 and classified as critical. This vulnerability affects unknown code of the file src/scripts/jefferson. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.4 is able to address this issue. The name of the patch is 53b3f2fc34af0bb32afbcee29d18213e61471d87. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218020.
- Product
- jefferson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023A vulnerability, which was classified as critical, was found in IonicaBizau node-gry up to 5.x.CVE-2020-36650 · Other software · IonicaBizau · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in IonicaBizau node-gry up to 5.x. This affects an unknown part. The manipulation leads to command injection. Upgrading to version 6.0.0 is able to address this issue. The patch is named 5108446c1e23960d65e8b973f1d9486f9f9dbd6c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218019.
- Product
- node-gry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023Insufficient input validation in the SMU may allow a physical attacker to exfiltrate SMU memory contents over the I2C bus potentially leading to a loss of confiCVE-2023-20528 · Other software · AMD · reported by psirt@amd.comLow 2.4
Insufficient input validation in the SMU may allow a physical attacker to exfiltrate SMU memory contents over the I2C bus potentially leading to a loss of confidentiality.
- Product
- 2nd Gen EPYC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023TOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of integrity or denial of service.CVE-2023-20523 · Other software · AMD · reported by psirt@amd.comMedium 5.7
TOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of integrity or denial of service.
- Product
- 2nd Gen EPYC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memory potentially leading to a loss of integrCVE-2021-46767 · Other software · AMD · reported by psirt@amd.comMedium 6.1
Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memory potentially leading to a loss of integrity or denial of service.
- Product
- 2nd Gen EPYC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023A vulnerability, which was classified as critical, was found in ACI_Escola.CVE-2015-10037 · Other software · ACI Escola Project · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in ACI_Escola. This affects an unknown part. The manipulation leads to sql injection. The identifier of the patch is 34eed1f7b9295d1424912f79989d8aba5de41e9f. It is recommended to apply a patch to fix this issue. The identifier VDB-217965 was assigned to this vulnerability.
- Product
- ACI Escola
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2023A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical.CVE-2016-15017 · Other software · fabarea · reported by VulDBMedium 5.5
A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the file Classes/Service/UploadFileService.php. The manipulation leads to pathname traversal. Upgrading to version 0.9.0 is able to address this issue. The patch is identified as b25d42a4981072321c1a363311d8ea2a4ac8763a. It is recommended to upgrade the affected component. VDB-217786 is the identifier assigned to this vulnerability.
- Product
- media_upload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2023The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks.CVE-2022-48251 · Computers, phones & browsers · ARM · reported by MITREHigh 7.5
The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks. NOTE: the vendor reportedly offers the position "while power side channel attacks ... are possible, they are not directly caused by or related to the Arm architecture."
- Product
- Cortex-a53 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeprint.iacr.orgeshard.com
Jan 9, 2023A vulnerability classified as critical has been found in CherishSin klattr.CVE-2014-125072 · Other software · CherishSin · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in CherishSin klattr. This affects an unknown part. The manipulation leads to sql injection. The patch is named f8e4ecfbb83aef577011b0b4aebe96fb6ec557f1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217719.
- Product
- klattr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023A vulnerability was found in gperson angular-test-reporter and classified as critical.CVE-2015-10035 · Other software · gperson · reported by VulDBMedium 5.5
A vulnerability was found in gperson angular-test-reporter and classified as critical. This issue affects the function getProjectTables/addTest of the file rest-server/data-server.js. The manipulation leads to sql injection. The patch is named a29d8ae121b46ebfa96a55a9106466ab2ef166ae. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217715.
- Product
- angular-test-reporter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023A vulnerability has been found in j-nowak workout-organizer and classified as critical.CVE-2015-10034 · Other software · j-nowak · reported by VulDBMedium 5.5
A vulnerability has been found in j-nowak workout-organizer and classified as critical. This vulnerability affects unknown code. The manipulation leads to sql injection. The patch is identified as 13cd6c3d1210640bfdb39872b2bb3597aa991279. It is recommended to apply a patch to fix this issue. VDB-217714 is the identifier assigned to this vulnerability.
- Product
- workout-organizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability classified as critical was found in purpleparrots 491-Project.CVE-2015-10031 · Other software · purpleparrots · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in purpleparrots 491-Project. This vulnerability affects unknown code of the file update.php of the component Highscore Handler. The manipulation leads to sql injection. The name of the patch is a812a5e4cf72f2a635a716086fe1ee2b8fa0b1ab. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217648.
- Product
- 491-Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability classified as critical has been found in lojban jbovlaste.CVE-2018-25072 · Other software · lojban · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in lojban jbovlaste. This affects an unknown part of the file dict/listing.html. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The patch is named 6ff44c2e87b1113eb07d76ea62e1f64193b04d15. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217647.
- Product
- jbovlaste
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability was found in saxman maps-js-icoads and classified as critical.CVE-2014-125068 · Other software · saxman · reported by VulDBMedium 5.5
A vulnerability was found in saxman maps-js-icoads and classified as critical. This issue affects some unknown processing of the file http-server.js. The manipulation leads to path traversal. The patch is named 34b8b0cce2807b119f4cffda2ac48fc8f427d69a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217643.
- Product
- maps-js-icoads
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability, which was classified as critical, was found in pouetnet pouet 2.0.CVE-2020-36648 · Other software · pouetnet · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in pouetnet pouet 2.0. This affects an unknown part. The manipulation of the argument howmany leads to sql injection. The identifier of the patch is 11d615931352066fb2f6dcb07428277c2cd99baf. It is recommended to apply a patch to fix this issue. The identifier VDB-217641 was assigned to this vulnerability.
- Product
- pouet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability classified as critical has been found in YunoHost-Apps transmission_ynh.CVE-2020-36647 · Other software · YunoHost-Apps · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in YunoHost-Apps transmission_ynh. Affected is an unknown function of the file conf/nginx.conf. The manipulation leads to path traversal. The patch is identified as f136dfd44eda128129e5fd2d850a3a3c600e6a4a. It is recommended to apply a patch to fix this issue. VDB-217638 is the identifier assigned to this vulnerability.
- Product
- transmission_ynh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability has been found in SUKOHI Surpass and classified as critical.CVE-2015-10030 · Other software · SUKOHI · reported by VulDBMedium 5.5
A vulnerability has been found in SUKOHI Surpass and classified as critical. This vulnerability affects unknown code of the file src/Sukohi/Surpass/Surpass.php. The manipulation of the argument dir leads to pathname traversal. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as d22337d453a2a14194cdb02bf12cdf9d9f827aa7. It is recommended to upgrade the affected component. VDB-217642 is the identifier assigned to this vulnerability.
- Product
- Surpass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability classified as critical was found in corincerami curiosity.CVE-2014-125067 · Other software · corincerami · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in corincerami curiosity. Affected by this vulnerability is an unknown functionality of the file app/controllers/image_controller.rb. The manipulation of the argument sol leads to sql injection. The patch is named d64fddd74ca72714e73f4efe24259ca05c8190eb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217639.
- Product
- curiosity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2023A vulnerability, which was classified as critical, has been found in web-cyradm.CVE-2007-10002 · Other software · Web-cyradm Project · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in web-cyradm. Affected by this issue is some unknown functionality of the file auth.inc.php. The manipulation of the argument login/login_password/LANG leads to sql injection. The attack may be launched remotely. The name of the patch is 2bcbead3bdb5f118bf2c38c541eaa73c29dcc90f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217640.
- Product
- Web-cyradm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical.CVE-2021-4301 · Other software · slackero · reported by VulDBMedium 6.3
A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument $phpwcms['db_prepend'] leads to sql injection. The attack may be launched remotely. Upgrading to version 1.9.27 is able to address this issue. The patch is identified as 77dafb6a8cc1015f0777daeb5792f43beef77a9d. It is recommended to upgrade the affected component. VDB-217418 is the identifier assigned to this vulnerability.
- Product
- phpwcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability, which was classified as critical, was found in john5223 bottle-auth.CVE-2014-125065 · Other software · john5223 · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in john5223 bottle-auth. Affected is an unknown function. The manipulation leads to sql injection. The name of the patch is 99cfbcc0c1429096e3479744223ffb4fda276875. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217632.
- Product
- bottle-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability was found in DrAzraelTod pyChao and classified as critical.CVE-2013-10009 · Other software · DrAzraelTod · reported by VulDBMedium 5.5
A vulnerability was found in DrAzraelTod pyChao and classified as critical. Affected by this issue is the function klauen/lesen of the file mod_fun/__init__.py. The manipulation leads to sql injection. The patch is identified as 9d8adbc07c384ba51c2583ce0819c9abb77dc648. It is recommended to apply a patch to fix this issue. VDB-217634 is the identifier assigned to this vulnerability.
- Product
- pyChao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability, which was classified as critical, was found in square squalor.CVE-2020-36645 · Other software · square · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in square squalor. This affects an unknown part. The manipulation leads to sql injection. Upgrading to version v0.0.0 is able to address this issue. The patch is named f6f0a47cc344711042eb0970cb423e6950ba3f93. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217623.
- Product
- squalor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability was found in ada-l0velace Bid and classified as critical.CVE-2014-125063 · Other software · ada-l0velace · reported by VulDBMedium 5.5
A vulnerability was found in ada-l0velace Bid and classified as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is abd71140b8219fa8741d0d8a57ab27d5bfd34222. It is recommended to apply a patch to fix this issue. The identifier VDB-217625 was assigned to this vulnerability.
- Product
- Bid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability classified as critical was found in ananich bitstorm.CVE-2014-125062 · Other software · ananich · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in ananich bitstorm. Affected by this vulnerability is an unknown functionality of the file announce.php. The manipulation of the argument event leads to sql injection. The identifier of the patch is ea8da92f94cdb78ee7831e1f7af6258473ab396a. It is recommended to apply a patch to fix this issue. The identifier VDB-217621 was assigned to this vulnerability.
- Product
- bitstorm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability classified as critical was found in hoffie larasync.CVE-2015-10024 · Other software · hoffie · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in hoffie larasync. This vulnerability affects unknown code of the file repository/content/file_storage.go. The manipulation leads to path traversal. The name of the patch is 776bad422f4bd4930d09491711246bbeb1be9ba5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217612.
- Product
- larasync
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in peel filebroker and classified as critical.CVE-2014-125061 · Other software · peel · reported by VulDBMedium 5.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in peel filebroker and classified as critical. Affected by this issue is the function select_transfer_status_desc of the file lib/common.rb. The manipulation leads to sql injection. The name of the patch is 91097e26a6c84d3208a351afaa52e0f62e5853ef. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217616. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- filebroker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability, which was classified as critical, was found in holdennb CollabCal.CVE-2014-125060 · Other software · holdennb · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in holdennb CollabCal. Affected is the function handleGet of the file calenderServer.cpp. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The patch is identified as b80f6d1893607c99e5113967592417d0fe310ce6. It is recommended to apply a patch to fix this issue. VDB-217614 is the identifier assigned to this vulnerability.
- Product
- CollabCal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability classified as critical has been found in Fumon trello-octometric.CVE-2015-10023 · Other software · Fumon · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in Fumon trello-octometric. This affects the function main of the file metrics-ui/server/srv.go. The manipulation of the argument num leads to sql injection. The patch is named a1f1754933fbf21e2221fbc671c81a47de6a04ef. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217611.
- Product
- trello-octometric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability has been found in polterguy Phosphorus Five up to 8.2 and classified as critical.CVE-2018-25070 · Other software · polterguy · reported by VulDBMedium 5.5
A vulnerability has been found in polterguy Phosphorus Five up to 8.2 and classified as critical. This vulnerability affects the function csv.Read of the file plugins/extras/p5.mysql/NonQuery.cs of the component CSV Import. The manipulation leads to sql injection. Upgrading to version 8.3 is able to address this issue. The patch is identified as c179a3d0703db55cfe0cb939b89593f2e7a87246. It is recommended to upgrade the affected component. VDB-217606 is the identifier assigned to this vulnerability.
- Product
- Phosphorus Five
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability was found in LearnMeSomeCodes project3 and classified as critical.CVE-2014-125058 · Other software · LearnMeSomeCodes · reported by VulDBMedium 5.5
A vulnerability was found in LearnMeSomeCodes project3 and classified as critical. This issue affects the function search_first_name of the file search.rb. The manipulation leads to sql injection. The patch is named d3efa17ae9f6b2fc25a6bbcf165cefed17c7035e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217607. NOTE: Maintainer is aware of this issue as remarked in the source code.
- Product
- project3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability classified as critical has been found in Netis Netcore Router.CVE-2018-25069 · Other software · Netis · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Netis Netcore Router. This affects an unknown part. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The identifier VDB-217593 was assigned to this vulnerability.
- Product
- Netcore Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.checkpoint.comvuldb.com
Jan 7, 2023A vulnerability classified as critical was found in koroket RedditOnRails.CVE-2014-125054 · Other software · koroket · reported by VulDBMedium 4.3
A vulnerability classified as critical was found in koroket RedditOnRails. This vulnerability affects unknown code of the component Vote Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The patch is identified as 7f3c7407d95d532fcc342b00d68d0ea09ca71030. It is recommended to apply a patch to fix this issue. VDB-217594 is the identifier assigned to this vulnerability.
- Product
- RedditOnRails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical.CVE-2018-25068 · Other software · devent · reported by VulDBMedium 6.3
A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical. This vulnerability affects the function createTmpDir of the file globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java. The manipulation leads to insecure temporary file. The attack can be initiated remotely. Upgrading to version 4.5.1 is able to address this issue. The patch is identified as 77a820bac2f68e662ce261ecb050c643bd7ee560. It is recommended to upgrade the affected component. VDB-217570 is the identifier assigned to this vulnerability.
- Product
- globalpom-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.