Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,458 results · page 89 of 130
Aug 25, 2021baserCMS is an open source content management system with a focus on Japanese language support.CVE-2021-39136 · Other software · baserproject · reported by GitHubHigh 8.7
baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2021ckeditor is an open source WYSIWYG HTML editor with rich content support.CVE-2021-37695 · Other software · ckeditor · reported by GitHubHigh 7.3
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
- Product
- ckeditor4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2021ckeditor is an open source WYSIWYG HTML editor with rich content support.CVE-2021-32809 · Other software · ckeditor · reported by GitHubMedium 4.6
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
- Product
- ckeditor4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Aug 12, 2021ckeditor is an open source WYSIWYG HTML editor with rich content support.CVE-2021-32808 · Other software · ckeditor · reported by GitHubHigh 7.6
ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside the undo feature. The vulnerability allows a user to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0. The problem has been recognized and patched. The fix will be available in version 4.16.2.
- Product
- ckeditor4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021MIRACASE MHUB500 USB splitters through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attaCVE-2021-38549 · Other software · Benda · reported by MITREMedium 5.9
MIRACASE MHUB500 USB splitters through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We assume that the USB splitter supplies power to some speakers. The power indicator LED of the USB splitter is connected directly to the power line, as a result, the intensity of the USB splitter's power indicator LED is correlative to its power consumption. The sound played by the connected speakers affects the USB splitter's power consumption and as a result is also correlative to the light intensity of the LED. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LED of the USB splitter, we can recover the sound played by the connected speakers.
- Product
- Miracase Hmub500 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnassiben.comnassiben.com
Aug 11, 2021Raspberry Pi 3 B+ and 4 B devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote aCVE-2021-38545 · Other software · Raspberrypi · reported by MITREMedium 5.9
Raspberry Pi 3 B+ and 4 B devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We assume that the Raspberry Pi supplies power to some speakers. The power indicator LED of the Raspberry Pi is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects the Raspberry Pi's power consumption and as a result is also correlative to the light intensity of the LED. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LED of the Raspberry Pi, we can recover the sound played by the speakers.
- Product
- Raspberry PI 4 Model B Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnassiben.comnassiben.com
Aug 11, 2021TP-Link UE330 USB splitter devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote CVE-2021-38543 · Network & remote access · Tp-link · reported by MITREMedium 5.9
TP-Link UE330 USB splitter devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We assume that the USB splitter supplies power to some speakers. The power indicator LED of the USB splitter is connected directly to the power line, as a result, the intensity of the USB splitter's power indicator LED is correlative to its power consumption. The sound played by the connected speakers affects the USB splitter's power consumption and as a result is also correlative to the light intensity of the LED. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LED of the USB splitter, we can recover the sound played by the connected speakers.
- Product
- Ue330 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnassiben.comnassiben.com
Aug 8, 2021The mac80211 subsystem in the Linux kernel before 5.12.13, when a device supporting only 5 GHz is used, allows attackers to cause a denial of service (NULL poinCVE-2021-38206 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
The mac80211 subsystem in the Linux kernel before 5.12.13, when a device supporting only 5 GHz is used, allows attackers to cause a denial of service (NULL pointer dereference in the radiotap parser) by injecting a frame with 802.11a rates.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn.kernel.orggithub.com
Aug 8, 2021arch/powerpc/perf/core-book3s.c in the Linux kernel before 5.12.13, on systems with perf_event_paranoid=-1 and no specific PMU driver support registered, allowsCVE-2021-38200 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
arch/powerpc/perf/core-book3s.c in the Linux kernel before 5.12.13, on systems with perf_event_paranoid=-1 and no specific PMU driver support registered, allows local users to cause a denial of service (perf_instruction_pointer NULL pointer dereference and OOPS) via a "perf record" command.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn.kernel.orggithub.com
Aug 7, 2021In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len valCVE-2021-38160 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comcdn.kernel.org
Aug 5, 2021SuperMartijn642's Config Lib is a library used by a number of mods for the game Minecraft.CVE-2021-37632 · Other software · SuperMartijn642 · reported by GitHubHigh 8.1
SuperMartijn642's Config Lib is a library used by a number of mods for the game Minecraft. The versions of SuperMartijn642's Config Lib between 1.0.4 and 1.0.8 are affected by a vulnerability and can be exploited on both servers and clients. Using SuperMartijn642's Config Lib, servers will send a packet to clients with the server's config values. In order to read `enum` values from the packet data, `ObjectInputStream#readObject` is used. `ObjectInputStream#readObject` will instantiate a class based on the input data. Since, the packet data is not validated before `ObjectInputStream#readObject` is called, an attacker can instantiate any class by sending a malicious packet. If a suitable class is found, the vulnerability can lead to a number of exploits, including remote code execution. Although the vulnerable packet is typically only send from server to client, it can theoretically also be send from client to server. This means both clients and servers running SuperMartijn642's Config Lib between 1.0.4 and 1.0.8 are vulnerable. The vulnerability has been patched in SuperMartijn642's Config lib 1.0.9. Both, players and server owners, should update to 1.0.9 or higher.
- Product
- SuperMartijn642sConfigLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2021curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl.CVE-2021-22925 · Other software · Siemens · reported by support@hackerone.comMedium 5.3
curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Aug 4, 2021EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images.CVE-2021-3539 · Other software · EspoCRM · reported by cve@rapid7.comMedium 6.3
EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 6.1.7 of the product.
- Product
- EspoCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2021Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images.CVE-2021-36803 · Other software · Akaunting · reported by cve@rapid7.comMedium 6.3
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 2.1.13 of the product.
- Product
- Akaunting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2021Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an access issue with the remotesupport userCVE-2020-26180 · Other software · Dell · reported by security_alert@emc.comMedium 6.3
Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an access issue with the remotesupport user account. A remote malicious user with low privileges may gain access to data stored on the /ifs directory through most protocols.
- Product
- PowerScale OneFS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2021TX9 Automatic Food Dispenser v3.2.57 devices allow access to a shell as root/superuser, a related issue to CVE-2019-16734.CVE-2021-37555 · Other software · Trixie · reported by MITRECritical 9.8
TX9 Automatic Food Dispenser v3.2.57 devices allow access to a shell as root/superuser, a related issue to CVE-2019-16734. To connect, the telnet service is used on port 23 with the default password of 059AnkJ for the root account. The user can then download the filesystem through preinstalled BusyBox utilities (e.g., tar and nc).
- Product
- Tx9 Automatic Food Dispenser Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2021Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden.CVE-2021-21440 · Other software · OTRS AG · reported by security@otrs.comMedium 5.2
Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.27 and prior versions; 8.0.x version 8.0.14 and prior versions.
- Product
- ((OTRS)) Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgotrs.com
Jul 22, 2021Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Home PCs version 2.0, 2.0.1, 2.0.2, 2.1, 2.1CVE-2020-5316 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Home PCs version 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3, 2.2, 2.2.1, 2.2.2, 2.2.3, 3.0, 3.0.1, 3.0.2, 3.1, 3.2, 3.2.1, 3.2.2, 3.3, 3.3.1, 3.3.2, 3.3.3, 3.4 contain an uncontrolled search path vulnerability. A locally authenticated low privileged user could exploit this vulnerability to cause the loading of arbitrary DLLs by the SupportAssist binaries, resulting in the privileged execution of arbitrary code.
- Product
- Dell SupportAssist Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Accounts).CVE-2021-2364 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Accounts). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSupplier Portal. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle iSupplier Portal accessible data as well as unauthorized access to critical data or complete access to all Oracle iSupplier Portal accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
- Product
- iSupplier Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2021uBlock Origin before 1.36.2 and nMatrix before 4.4.9 support an arbitrary depth of parameter nesting for strict blocking, which allows crafted web sites to causCVE-2021-36773 · Other software · Sciruby · reported by MITREHigh 7.5
uBlock Origin before 1.36.2 and nMatrix before 4.4.9 support an arbitrary depth of parameter nesting for strict blocking, which allows crafted web sites to cause a denial of service (unbounded recursion that can trigger memory consumption and a loss of all blocking functionality).
- Product
- Nmatrix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 1, 2021Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level CVE-2021-27661 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 8.8
Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the controller’s file system, allowing them to access or modify system files by sending specifically crafted web messages to the F4-SNC.
- Product
- Facility Explorer SNC Series Supervisory Controllers (F4-SNC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govjohnsoncontrols.com
Jun 24, 2021The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied files, which may allow an attacker to executCVE-2021-33004 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.8
The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied files, which may allow an attacker to execute arbitrary code. User interaction is required on the WebAccess HMI Designer (versions 2.1.9.95 and prior).
- Product
- Webaccess/hmi Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Jun 22, 2021In onReceive of NetInitiatedActivity.java, there is a possible way to supply an attacker-controlled value to a GPS HAL handler due to a missing permission checkCVE-2021-0547 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onReceive of NetInitiatedActivity.java, there is a possible way to supply an attacker-controlled value to a GPS HAL handler due to a missing permission check. This could lead to local escalation of privilege that may result in undefined behavior in some HAL implementations with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174151048
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 21, 2021Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-supplied input.CVE-2010-1433 · Websites & servers · Joomla · reported by Red HatCritical 9.8
Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgacunetix.com
Jun 17, 2021Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system.CVE-2021-34825 · Other software · Quassel-irc · reported by MITREHigh 7.5
Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system.
- Product
- Quassel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Jun 17, 2021Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API requeCVE-2021-31818 · Other software · Octopus Deploy · reported by security@octopus.comMedium 4.3
Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Jun 16, 2021Prototype pollution in Stampit supermixer 1.0.3 allows an attacker to modify the prototype of a base object which can vary in severity depending on the implemenCVE-2020-24939 · Other software · Stampit · reported by MITREHigh 7.5
Prototype pollution in Stampit supermixer 1.0.3 allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation.
- Product
- Supermixer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Jun 16, 2021Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the productCVE-2021-34801 · Other software · Valine.js · reported by MITREMedium 5.3
Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version.
- Product
- Valine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2021Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to escalate privileges to superadministrator.CVE-2021-31928 · Other software · Annexcloud · reported by MITREHigh 8.8
Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to escalate privileges to superadministrator. It was fixed in v2021.1.0.2.
- Product
- Loyalty Experience Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comannexcloud.com
Jun 9, 2021Improper link resolution before file access in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of priCVE-2021-0094 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper link resolution before file access in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of privilege via local access.
- Product
- Driver & Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Uncontrolled search path element in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of privilege via CVE-2021-0090 · Other software · Intel · reported by secure@intel.comHigh 7.3
Uncontrolled search path element in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of privilege via local access.
- Product
- Driver & Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Insufficient control flow management in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable escalation of privilege viaCVE-2021-0073 · Other software · Intel · reported by secure@intel.comHigh 7.8
Insufficient control flow management in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Driver & Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Brocade SANnav before v.2.1.0a could allow remote attackers cause a denial-of-service condition due to a lack of proper validation, of the length of user-suppliCVE-2020-15379 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.5
Brocade SANnav before v.2.1.0a could allow remote attackers cause a denial-of-service condition due to a lack of proper validation, of the length of user-supplied data as name for custom field name.
- Product
- Brocade Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Jun 9, 2021Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incoCVE-2021-26314 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and may result in data leakage.
- Product
- All supported processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jun 9, 2021Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwriCVE-2021-26313 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwritten instructions, may cause an incorrect speculation and could result in data leakage.
- Product
- All supported processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2021SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing CVE-2021-30357 · Other software · Checkpoint · reported by cve@checkpoint.comMedium 5.3
SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing files to which the user did not have access.
- Product
- SSL Network Extender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportcontent.checkpoint.comsupportcontent.checkpoint.com
Jun 1, 2021Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server.CVE-2021-30181 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
- Product
- Apache Dubbo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jun 1, 2021Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server.CVE-2021-30180 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.
- Product
- Apache Dubbo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jun 1, 2021Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces.CVE-2021-30179 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the method to invoke, the second one is an array with the parameter types for the method being invoked and the third one is an array with the actual call arguments. In addition, the caller also needs to set an RPC attachment specifying that the call is a generic call and how to decode the arguments. The possible values are: - true - raw.return - nativejava - bean - protobuf-json An attacker can control this RPC attachment and set it to nativejava to force the java deserialization of the byte array located in the third argument.
- Product
- Apache Dubbo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jun 1, 2021WP Super Cache: Did not properly sanitise its wp_cache_location parameter in its settingsCVE-2021-24329 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings, which could lead to a Stored Cross-Site Scripting issue.
- Product
- WP Super Cache
- Fixed in
- 1.7.3
- What to do
- Update WP Super Cache to 1.7.3 or newer.
Jun 1, 2021The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super CaCVE-2021-24312 · WordPress plugins & themes · reported by WPScanHigh 7.2
The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of '$' and '\n'. This is due to an incomplete fix of CVE-2021-24209.
- Fixed in
- 1.7.3
- What to do
- Update the plugin to 1.7.3 or newer.
Jun 1, 2021The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support CVE-2021-23019 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.8
The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package.
- Product
- Nginx Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
May 28, 2021radsecproxy is a generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports.CVE-2021-32642 · Other software · radsecproxy · reported by GitHubHigh 7
radsecproxy is a generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports. Missing input validation in radsecproxy's `naptr-eduroam.sh` and `radsec-dynsrv.sh` scripts can lead to configuration injection via crafted radsec peer discovery DNS records. Users are subject to Information disclosure, Denial of Service, Redirection of Radius connection to a non-authenticated server leading to non-authenticated network access. Updated example scripts are available in the master branch and 1.9 release. Note that the scripts are not part of the installation package and are not updated automatically. If you are using the examples, you have to update them manually. The dyndisc scripts work independently of the radsecproxy code. The updated scripts can be used with any version of radsecproxy.
- Product
- radsecproxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
May 28, 2021A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0.CVE-2020-35504 · Other software · Qemu · reported by Red HatMedium 6
A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
- Product
- Qemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.redhat.com
May 11, 2021Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Share URL XSS."CVE-2021-32604 · Other software · Solarwinds · reported by MITREMedium 5.4
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Share URL XSS."
- Product
- Serv-u
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comtrustwave.com
May 11, 2021SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be diCVE-2021-27619 · Websites & servers · SAP SE · reported by cna@sap.comMedium 6.5
SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be displayed to them. Although the search results are masked, the user can iteratively enter one character at a time to search and determine the masked attribute value thereby leading to information disclosure.
- Product
- SAP Commerce (Backoffice Search)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
May 7, 2021Potential UE reset while decoding a crafted Sib1 or SIB1 that schedules unsupported SIBs and can lead to denial of service in Snapdragon Auto, Snapdragon MobileCVE-2020-11268 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Potential UE reset while decoding a crafted Sib1 or SIB1 that schedules unsupported SIBs and can lead to denial of service in Snapdragon Auto, Snapdragon Mobile
- Product
- Snapdragon Auto, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
May 6, 2021Hongdian H8922 3.0.5 devices have an undocumented feature that allows access to a shell as a superuser.CVE-2021-28152 · Other software · Hongdian · reported by MITRECritical 9.8
Hongdian H8922 3.0.5 devices have an undocumented feature that allows access to a shell as a superuser. To connect, the telnet service is used on port 5188 with the default credentials of root:superzxmn.
- Product
- H8922 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.hongdian.comssd-disclosure.com
May 5, 2021Contact Form by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24276 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Contact Form by Supsystic
- Fixed in
- 1.7.15
- What to do
- Update Contact Form by Supsystic to 1.7.15 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 5, 2021Popup by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24275 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Popup by Supsystic
- Fixed in
- 1.10.5
- What to do
- Update Popup by Supsystic to 1.10.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.