Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
670 results · page 9 of 14
May 21, 2020A remote code execution vulnerability exists in the way that the Color Management Module (ICM32.dll) handles objects in memory.CVE-2020-1117 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
A remote code execution vulnerability exists in the way that the Color Management Module (ICM32.dll) handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability and then convince users to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email or Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email. The security update addresses the vulnerability by correcting how Color Management Module handles objects in memory.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 11, 2020In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL.CVE-2020-12790 · Other software · Nystudio107 · reported by MITREHigh 7.5
In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon.
- Product
- Seomatic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2020UliCMS before 2020.2 has PageController stored XSS.CVE-2020-12704 · Other software · Ulicms · reported by MITREMedium 6.1
UliCMS before 2020.2 has PageController stored XSS.
- Product
- Ulicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.ulicms.deen.ulicms.de
May 7, 2020UliCMS before 2020.2 has XSS during PackageController uninstall.CVE-2020-12703 · Other software · Ulicms · reported by MITREMedium 6.1
UliCMS before 2020.2 has XSS during PackageController uninstall.
- Product
- Ulicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.ulicms.deen.ulicms.de
Feb 20, 2020The IPv6 implementation in Apple Mac OS X (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 RCVE-2012-5366 · Computers, phones & browsers · Apple · reported by MITREHigh 7.5
The IPv6 implementation in Apple Mac OS X (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets containing multiple Routing entries.
- Product
- MAC OS X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Feb 20, 2020The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPCVE-2012-5365 · Other software · Freebsd · reported by MITREHigh 7.5
The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets containing multiple Routing entries.
- Product
- Freebsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Feb 20, 2020The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packeCVE-2012-5364 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets containing multiple Routing entries.
- Product
- Windows 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Feb 20, 2020The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPCVE-2012-5363 · Other software · Freebsd · reported by MITREHigh 7.5
The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation messages, a different vulnerability than CVE-2011-2393.
- Product
- Freebsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Feb 20, 2020The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation messCVE-2012-5362 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation messages, a different vulnerability than CVE-2010-4669.
- Product
- Windows 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Nov 7, 2019po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post[1][content]= stored XSS.CVE-2019-18816 · Other software · Popojicms · reported by MITREMedium 6.1
po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post[1][content]= stored XSS.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2019PopojiCMS 2.0.1 allows refer= Open Redirection.CVE-2019-18815 · Other software · Popojicms · reported by MITREMedium 6.1
PopojiCMS 2.0.1 allows refer= Open Redirection.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2019JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.CVE-2019-17593 · Other software · Jizhicms · reported by MITREHigh 8.8
JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2019idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonstrated by the admincpCVE-2019-17583 · Other software · Idreamsoft · reported by MITREHigh 7.5
idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonstrated by the admincp.php?app=comment&perpage= substring followed by a large positive integer.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2019An issue was discovered in idreamsoft iCMS v7.0.14.CVE-2019-17552 · Other software · Idreamsoft · reported by MITRECritical 9.8
An issue was discovered in idreamsoft iCMS v7.0.14. There is a spider_project.admincp.php SQL injection vulnerability in the 'upload spider project scheme' feature via a two-dimensional payload.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2019The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c.CVE-2018-14882 · Other software · Tcpdump · reported by MITREHigh 7.5
The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c.
- Product
- Tcpdump
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Oct 3, 2019The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().CVE-2018-14462 · Other software · Tcpdump · reported by MITREHigh 7.5
The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().
- Product
- Tcpdump
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Oct 1, 2019An issue was discovered in XunRuiCMS 4.3.1.CVE-2019-17074 · Other software · Xunruicms · reported by MITREMedium 5.4
An issue was discovered in XunRuiCMS 4.3.1. There is a stored XSS in the module_category area.
- Product
- Xunruicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2019An issue was discovered in idreamsoft iCMS V7.0.CVE-2019-16677 · Other software · Idreamsoft · reported by MITREMedium 6.5
An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2019TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF.CVE-2019-16659 · Other software · Tuzicms · reported by MITREHigh 8.8
TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2019TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF.CVE-2019-16658 · Other software · Tuzicms · reported by MITREHigh 8.8
TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2019TuziCMS 2.0.6 has XSS via the PATH_INFO to a group URI, as demonstrated by index.php/article/group/id/2/.CVE-2019-16657 · Other software · Tuzicms · reported by MITREMedium 6.1
TuziCMS 2.0.6 has XSS via the PATH_INFO to a group URI, as demonstrated by index.php/article/group/id/2/.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2019App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring.CVE-2019-16644 · Other software · Tuzicms · reported by MITRECritical 9.8
App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2019App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring.CVE-2019-16642 · Other software · Yejiao · reported by MITRECritical 9.8
App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2019Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, wCVE-2019-15232 · Other software · Live555 · reported by MITRECritical 9.8
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors.
- Product
- Streaming Media
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlive555.comsecurity.gentoo.org
Aug 12, 2019iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter.CVE-2019-14976 · Other software · Icmsdev · reported by MITREMedium 6.1
iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2019An arbitrary file read vulnerability in DamiCMS v6.0.0 allows remote authenticated administrators to read any files in the server via a crafted /admin.php?s=TplCVE-2018-14831 · Other software · Damicms · reported by MITREMedium 4.9
An arbitrary file read vulnerability in DamiCMS v6.0.0 allows remote authenticated administrators to read any files in the server via a crafted /admin.php?s=Tpl/Add/id/ URI.
- Product
- Damicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 5, 2019In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie.CVE-2019-13341 · Other software · 1234n · reported by MITREMedium 4.8
In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2019In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box.CVE-2019-13340 · Other software · 1234n · reported by MITREMedium 4.8
In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, CVE-2018-20520, and CVE-2019-13186.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2019In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie.CVE-2019-13339 · Other software · 1234n · reported by MITREMedium 4.8
In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2019In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box.CVE-2019-13186 · Other software · 1234n · reported by MITREMedium 6.1
In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, and CVE-2018-20520.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2019Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parametCVE-2019-11398 · Other software · Ulicms · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon.
- Product
- Ulicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comen.ulicms.de
Apr 22, 2019An XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public/api.php?app=search q parameter.CVE-2019-11427 · Other software · Idreamsoft · reported by MITREMedium 6.1
An XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public/api.php?app=search q parameter.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2019An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter.CVE-2019-11426 · Other software · Idreamsoft · reported by MITREMedium 6.1
An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2019FeiFeiCMS 4.1.190209 allows remote attackers to upload and execute arbitrary PHP code by visiting index.php?s=Admin-Index to modify the set of allowable file exCVE-2019-9825 · Other software · Feifeicms · reported by MITRECritical 9.8
FeiFeiCMS 4.1.190209 allows remote attackers to upload and execute arbitrary PHP code by visiting index.php?s=Admin-Index to modify the set of allowable file extensions, as demonstrated by adding php to the default jpg,gif,png,jpeg setting, and then using the "add article" feature.
- Product
- Feifeicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.whiterabbitxyj.comgithub.com
Mar 7, 2019An issue was discovered in DiliCMS 2.4.0.CVE-2019-8440 · Other software · Dilicms · reported by MITREMedium 4.8
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox (aka site logo) of "System setting->site setting" of admin/index.php, aka site_logo.
- Product
- Dilicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019An issue was discovered in DiliCMS 2.4.0.CVE-2019-8439 · Other software · Dilicms · reported by MITREMedium 5.4
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the second textbox of "System setting->site setting" of admin/index.php, aka site_domain.
- Product
- Dilicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019An issue was discovered in DiliCMS 2.4.0.CVE-2019-8438 · Other software · Dilicms · reported by MITREMedium 4.8
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the first textbox of "System setting->site setting" of admin/index.php, aka site_name.
- Product
- Dilicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI.CVE-2018-17426 · Other software · Wuzhicms · reported by MITREMedium 5.4
WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI.CVE-2018-17425 · Other software · Wuzhicms · reported by MITREMedium 5.4
WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2019MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891.CVE-2019-9603 · Other software · 1234n · reported by MITREMedium 6.5
MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2019An issue was discovered in PopojiCMS v2.0.1.CVE-2019-9549 · Other software · Popojicms · reported by MITREHigh 8.8
An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a level=1 account, a similar issue to CVE-2018-18935.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2019XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&set_iframe=[XSS] to coreframe/app/content/postinfo.php.CVE-2019-9110 · Other software · Wuzhicms · reported by MITREMedium 6.1
XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&set_iframe=[XSS] to coreframe/app/content/postinfo.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 24, 2019XSS exists in WUZHI CMS 4.1.0 via index.php?m=message&f=message&v=add&username=[XSS] to coreframe/app/message/message.php.CVE-2019-9109 · Other software · Wuzhicms · reported by MITREMedium 6.1
XSS exists in WUZHI CMS 4.1.0 via index.php?m=message&f=message&v=add&username=[XSS] to coreframe/app/message/message.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 24, 2019XSS exists in WUZHI CMS 4.1.0 via index.php?m=core&f=map&v=baidumap&x=[XSS]&y=[XSS] to coreframe/app/core/map.php.CVE-2019-9108 · Other software · Wuzhicms · reported by MITREMedium 6.1
XSS exists in WUZHI CMS 4.1.0 via index.php?m=core&f=map&v=baidumap&x=[XSS]&y=[XSS] to coreframe/app/core/map.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 24, 2019XSS exists in WUZHI CMS 4.1.0 via index.php?m=attachment&f=imagecut&v=init&imgurl=[XSS] to coreframe/app/attachment/imagecut.php.CVE-2019-9107 · Other software · Wuzhicms · reported by MITREMedium 6.1
XSS exists in WUZHI CMS 4.1.0 via index.php?m=attachment&f=imagecut&v=init&imgurl=[XSS] to coreframe/app/attachment/imagecut.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 18, 2019An issue was discovered in idreamsoft iCMS through 7.0.14.CVE-2019-8902 · Other software · Idreamsoft · reported by MITREMedium 5.7
An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2019FeiFeiCms 4.0.181010 on Windows allows remote attackers to read or delete arbitrary files via index.php?s=Admin-Data-Down-id-..\ or index.php?s=Admin-Data-Del-iCVE-2019-8412 · Other software · Feifeicms · reported by MITREHigh 8.8
FeiFeiCms 4.0.181010 on Windows allows remote attackers to read or delete arbitrary files via index.php?s=Admin-Data-Down-id-..\ or index.php?s=Admin-Data-Del-id-..\ directory traversal.
- Product
- Feifeicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2019An issue was discovered in idreamsoft iCMS 7.0.13 on Windows.CVE-2019-7237 · Other software · Idreamsoft · reported by MITREHigh 7.5
An issue was discovered in idreamsoft iCMS 7.0.13 on Windows. editor/editor.admincp.php allows admincp.php?app=files&do=browse ..\ Directory Traversal.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2019An issue was discovered in idreamsoft iCMS 7.0.13.CVE-2019-7236 · Other software · Idreamsoft · reported by MITREHigh 7.5
An issue was discovered in idreamsoft iCMS 7.0.13. editor/editor.admincp.php allows admincp.php?app=editor&do=fileManager dir=../ Directory Traversal.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2019An issue was discovered in idreamsoft iCMS 7.0.13.CVE-2019-7235 · Other software · Idreamsoft · reported by MITREHigh 7.5
An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../ to designate an arbitrary directory because of an apps.admincp.php error. This directory can then be deleted via an admincp.php?app=apps&do=uninstall request.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.