Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
593 results · page 9 of 12
Oct 15, 2018Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper access control.CVE-2018-17534 · Other software · Teltonika · reported by MITREMedium 6.8
Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper access control. This allows attackers with physical access to execute arbitrary commands with root privileges.
- Product
- Rut900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 15, 2018Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to cross-site scripting vulnerabilities in hotspotlogin.cgi due to insufficient user input saCVE-2018-17533 · Other software · Teltonika · reported by MITREMedium 6.1
Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to cross-site scripting vulnerabilities in hotspotlogin.cgi due to insufficient user input sanitization.
- Product
- Rut900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 15, 2018Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlCVE-2018-17532 · Other software · Teltonika · reported by MITRECritical 9.8
Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization. This allows remote attackers to execute arbitrary commands with root privileges.
- Product
- Rut900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 5, 2018Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes.CVE-2018-11082 · Other software · Cloud Foundry · reported by security_alert@emc.comMedium 6.6
Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user.
- Product
- UAA Release
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudfoundry.orgcloudfoundry.org
Sep 6, 2018The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks.CVE-2018-5389 · Other software · strongSwan · reported by cret@cert.orgMedium 5.9
The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. Reusing a key pair across different versions and modes of IKE could lead to cross-protocol authentication bypasses. It is well known, that the aggressive mode of IKEv1 PSK is vulnerable to offline dictionary or brute force attacks. For the main mode, however, only an online attack against PSK authentication was thought to be feasible. This vulnerability could allow an attacker to recover a weak Pre-Shared Key or enable the impersonation of a victim host or network.
- Product
- Strongswan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.cisco.commy.f5.com
Sep 5, 2018TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by skipping the "Cancel" step, which makes itCVE-2018-16550 · Other software · Teamviewer · reported by MITRECritical 9.8
TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by skipping the "Cancel" step, which makes it easier to determine the correct value of the default 4-digit PIN.
- Product
- Teamviewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwitter.comtwitter.com
Aug 22, 2018Apache Struts Remote Code Execution VulnerabilityCVE-2018-11776 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.1
Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.
- Product
- Struts
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comarubanetworks.com
Jul 26, 2018It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values withCVE-2017-2582 · Other software · Red Hat · reported by Red HatMedium 6.5
It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.
- Product
- keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jul 9, 2018In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-CVE-2018-13785 · Other software · Libpng · reported by MITREMedium 6.5
In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.
- Product
- Libpng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Jun 29, 2018onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecms_username and onefilecms_password fields.CVE-2018-12993 · Other software · Onefilecms · reported by MITRECritical 9.8
onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecms_username and onefilecms_password fields.
- Product
- Onefilecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2018IBM BigFix Platform 9.2 and 9.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.CVE-2018-1475 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM BigFix Platform 9.2 and 9.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 140756.
- Product
- BigFix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Apr 12, 2018WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.CVE-2014-6412 · WordPress plugins & themes · reported by MITREHigh 8.1
WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.
- Fixed in
- 4.4
- What to do
- Update the plugin to 4.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Apr 6, 2018the Brute Force Login Protection module 1.3 for: Cross-site request forgery (CSRF)CVE-2014-5034 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that have unknown impact via a crafted request to the brute-force-login-protection page to wp-admin/options-general.php.
- Product
- the Brute Force Login Protection module 1.3 for
- Affected
- 1.3 to 1.3
- What to do
- Affects 1.3 to 1.3. Update the Brute Force Login Protection module 1.3 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2018The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted CVE-2018-1327 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.
- Product
- Apache Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Mar 12, 2018Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looCVE-2018-1000097 · Other software · Canonical · reported by MITREHigh 7.8
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file..
- Product
- Ubuntu Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgusn.ubuntu.com
Mar 2, 2018IBM Security Guardium Big Data Intelligence (SonarG) 3.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account crCVE-2018-1373 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 137773.
- Product
- Security Guardium Big Data Intelligence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Dec 13, 2017It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur.CVE-2017-14589 · Websites & servers · Atlassian · reported by security@atlassian.comCritical 9.6
It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted administration rights to Bamboo or who hosts a website that a Bamboo administrator visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Bamboo. All versions of Bamboo before 6.1.6 (the fixed version for 6.1.x) and from 6.2.0 before 6.2.5 (the fixed version for 6.2.x) are affected by this vulnerability.
- Product
- Bamboo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comconfluence.atlassian.com
Dec 5, 2017It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end.CVE-2017-16857 · Websites & servers · Atlassian · reported by security@atlassian.comHigh 8.5
It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end. This allows an attacker to merge any code into unsuspecting repositories. This affects all versions of the auto-unapprove plugin, however since the auto-unapprove plugin is not bundled with Bitbucket Server it does not affect any particular version of Bitbucket.
- Product
- Auto-Unapprove Plugin (for Bitbucket Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comjira.atlassian.com
Dec 1, 2017In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious requestCVE-2017-15707 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.2
In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
- Product
- Apache Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017The Files APP 7.1.1.309 and earlier versions in some Huawei mobile phones has a brute-force password cracking vulnerability due to the improper design of the SaCVE-2017-2715 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.8
The Files APP 7.1.1.309 and earlier versions in some Huawei mobile phones has a brute-force password cracking vulnerability due to the improper design of the Safe key database. An unauthorized attacker could access sensitive database information and may crack users' Safe passwords, leading to information leak.
- Product
- Files £¨Files is the smartphone APP£©
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2017The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression wCVE-2016-3090 · Websites & servers · Apache · reported by Red HatHigh 8.8
The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.
- Product
- Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurity.netapp.com
Oct 19, 2017The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, reCVE-2015-6668 · WordPress plugins & themes · reported by MITREHigh 7.5
The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, related to an insecure direct object reference.
- Product
- Job Manager
- Fixed in
- 0.7.25
- What to do
- Update Job Manager to 0.7.25 or newer.
Full record and what to do →NVD recordvagmour.euwpvulndb.com
Oct 16, 2017Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.CVE-2016-4461 · Websites & servers · Apache · reported by Red HatHigh 8.8
Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785.
- Product
- Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurity.netapp.com
Oct 5, 2017The IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) default authentication protocol is vulnerable to a brute force attack due to disclosing too muCVE-2016-8937 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
The IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) default authentication protocol is vulnerable to a brute force attack due to disclosing too much information during authentication. An attacker could gain user or administrative access to the TSM server. IBM X-Force ID: 118750.
- Product
- Spectrum Protect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Sep 27, 2017Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.CVE-2017-2551 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Sep 25, 2017Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.CVE-2015-5169 · Websites & servers · Apache · reported by Red HatMedium 6.1
Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
- Product
- Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2017In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is pCVE-2017-9804 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
- Product
- Apache Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comoracle.com
Sep 20, 2017The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform aCVE-2017-9793 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
- Product
- Apache Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2017In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCVE-2017-12611 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
- Product
- Apache Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comoracle.com
Sep 20, 2017In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a sCVE-2016-8738 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.9
In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
- Product
- Apache Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurity.netapp.com
Sep 20, 2017In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traveCVE-2016-6795 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.
- Product
- Apache Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurity.netapp.com
Sep 15, 2017Apache Struts Deserialization of Untrusted Data VulnerabilityCVE-2017-9805 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.1
Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
- Product
- Struts
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogoracle.comsecurityfocus.com
Aug 29, 2017Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involvinCVE-2015-5209 · Websites & servers · Apache · reported by Red HatHigh 7.5
Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.
- Product
- Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Aug 16, 2017389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on CVE-2017-7551 · Other software · 389 Directory Server · reported by Red HatCritical 9.8
389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.
- Product
- 389-ds-base
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.compagure.io
Jul 13, 2017When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack.CVE-2017-9787 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.
- Product
- Apache Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstruts.apache.orgoracle.com
Jul 13, 2017If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload CVE-2017-7672 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.9
If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.
- Product
- Apache Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstruts.apache.orgoracle.com
Jul 13, 2017IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.CVE-2016-8964 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 118853.
- Product
- BigFix Inventory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Jul 12, 2017phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly.CVE-2017-11187 · Websites & servers · Phpmyfaq · reported by MITRECritical 9.8
phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphpmyfaq.dephpmyfaq.de
Jul 10, 2017Apache Struts 1 Improper Input Validation VulnerabilityCVE-2017-9791 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
- Product
- Struts 1
- On CISA’s list since
- Feb 10, 2022 (federal fix deadline Aug 10, 2022)
- What to do
- Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogstruts.apache.orgoracle.com
Jul 3, 2017The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands wCVE-2017-8116 · Other software · Teltonika · reported by MITRECritical 9.8
The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands with root privileges via shell metacharacters in the username parameter in a login request.
- Product
- Rut900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2017IBM BigFix Compliance (TEMA SUAv1 SCA SCM) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.CVE-2017-1197 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM BigFix Compliance (TEMA SUAv1 SCA SCM) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 123672.
- Product
- BigFix Compliance Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
May 10, 2017Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier.CVE-2017-7888 · Other software · Dolibarr · reported by MITRECritical 9.8
Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxmole.comfoxmole.com
Apr 30, 2017Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method.CVE-2017-8342 · Other software · Radicale · reported by MITREHigh 8.1
Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method.
- Product
- Radicale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggithub.com
Apr 10, 2017web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.CVE-2016-10321 · Other software · Web2py · reported by MITRECritical 9.8
web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
- Product
- Web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2017Huawei home gateways WS318 with software V100R001C01B022 and earlier versions are affected by the PIN offline brute force cracking vulnerability of the WPS protCVE-2014-9690 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Huawei home gateways WS318 with software V100R001C01B022 and earlier versions are affected by the PIN offline brute force cracking vulnerability of the WPS protocol because the random number generator (RNG) used in the supplier's solution is not random enough. As a result, brute force cracking the PIN code is easier. After an attacker cracks the PIN, the attacker can access the Internet via the cracked device.
- Product
- Ws318 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2017Apache Struts Remote Code Execution VulnerabilityCVE-2017-5638 · Websites & servers · Apache · reported by security@apache.orgExploitedRansomwareCritical 9.8
Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
- Product
- Struts
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Apache’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogblog.talosintelligence.comblog.trendmicro.com
Feb 2, 2017IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.CVE-2016-6095 · Other software · IBM Corporation · reported by psirt@us.ibm.comCritical 9.8
IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
- Product
- Key Lifecycle Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Feb 1, 2017IBM Security Privileged Identity Manager Virtual Appliance version 2.0.2 uses an inadequate account lockout setting that could allow a remote attacker to brute CVE-2016-5964 · Other software · IBM Corporation · reported by psirt@us.ibm.comCritical 9.8
IBM Security Privileged Identity Manager Virtual Appliance version 2.0.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
- Product
- Privileged Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Nov 30, 2016IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a bruteCVE-2016-2944 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach.
- Product
- Bigfix Remote Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww-01.ibm.comwww-01.ibm.com
Nov 25, 2016IBM BigFix Remote Control before 9.1.3 does not properly restrict password choices, which makes it easier for remote attackers to obtain access via a brute-forcCVE-2016-2929 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM BigFix Remote Control before 9.1.3 does not properly restrict password choices, which makes it easier for remote attackers to obtain access via a brute-force approach.
- Product
- Bigfix Remote Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww-01.ibm.comwww-01.ibm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.