Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,030 results · page 9 of 21
Feb 24, 2020Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listmasCVE-2020-9369 · Other software · Sympa · reported by MITREHigh 7.5
Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listmasters) via a series of requests with malformed parameters.
- Product
- Sympa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Feb 20, 2020btif/src/btif_dm.c in Android before 5.1 does not properly enforce the temporary nature of a Bluetooth pairing, which allows user-assisted remote attackers to bCVE-2014-7914 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.1
btif/src/btif_dm.c in Android before 5.1 does not properly enforce the temporary nature of a Bluetooth pairing, which allows user-assisted remote attackers to bypass intended access restrictions via crafted Bluetooth packets after the tapping of a crafted NFC tag.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Feb 18, 2020It was found that the jclouds scriptbuilder Statements class wrote a temporary file to a predictable location.CVE-2014-4651 · Websites & servers · Apache · reported by Red HatCritical 9.8
It was found that the jclouds scriptbuilder Statements class wrote a temporary file to a predictable location. An attacker could use this flaw to access sensitive data, cause a denial of service, or perform other attacks.
- Product
- Apache jclouds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgissues.apache.org
Feb 7, 2020LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintUpdate.CVE-2012-1567 · Computers, phones & browsers · LinuxMint · reported by Red HatHigh 7.5
LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintUpdate.
- Product
- Mint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Feb 7, 2020LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintNanny.CVE-2012-1566 · Computers, phones & browsers · LinuxMint · reported by Red HatHigh 7.5
LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintNanny.
- Product
- Mint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jan 31, 2020The Batch::BatchRun module 1.03 for Perl does not properly handle temporary files.CVE-2011-4117 · Other software · Batch::BatchRun · reported by Red HatHigh 7.5
The Batch::BatchRun module 1.03 for Perl does not properly handle temporary files.
- Product
- Batch::BatchRun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jan 31, 2020Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files.CVE-2011-4115 · Other software · Parallel::ForkManager · reported by Red HatHigh 7.5
Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files.
- Product
- Parallel::ForkManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jan 28, 2020The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temCVE-2014-3856 · Other software · Fishshell · reported by MITREHigh 7
The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name.
- Product
- Fish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2020The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands CVE-2014-2906 · Other software · Fishshell · reported by MITREHigh 7
The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name.
- Product
- Fish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Jan 27, 2020SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to obtain password hashes and possibly other unspecifCVE-2014-7303 · Other software · HP · reported by MITREHigh 7.8
SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to obtain password hashes and possibly other unspecified sensitive information by reading etc/dbdump.db.
- Product
- SGI Tempo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.f-secure.compacketstormsecurity.com
Jan 27, 2020SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to change the permissions of arbitrary files by execuCVE-2014-7302 · Other software · HP · reported by MITREHigh 7.8
SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to change the permissions of arbitrary files by executing /opt/sgi/sgimc/bin/vx.
- Product
- SGI Tempo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comlabs.mwrinfosecurity.com
Jan 27, 2020SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to obtain password hashes and possibly other unspecifCVE-2014-7301 · Other software · HP · reported by MITREMedium 6.6
SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to obtain password hashes and possibly other unspecified sensitive information by reading /etc/odapw.
- Product
- SGI Tempo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.f-secure.compacketstormsecurity.com
Jan 23, 2020In IXP EasyInstall 6.2.13723, it is possible to temporarily disable UAC by using the Agent Service on a client system.CVE-2019-19894 · Other software · Ixpdata · reported by MITREMedium 5.5
In IXP EasyInstall 6.2.13723, it is possible to temporarily disable UAC by using the Agent Service on a client system. An authenticated attacker (non-admin) can disable UAC for other users by renaming and replacing %SYSTEMDRIVE%\IXP\DATA\IXPAS.IXP.
- Product
- Easyinstall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordimprosec.comimprosec.com
Dec 30, 2019The isearch package (textproc/isearch) before 1.47.01nb1 uses the tempnam() function to create insecure temporary files into a publicly-writable area (/tmp).CVE-2012-5663 · Other software · textproc/isearch package · reported by Red HatHigh 7.5
The isearch package (textproc/isearch) before 1.47.01nb1 uses the tempnam() function to create insecure temporary files into a publicly-writable area (/tmp).
- Product
- textproc/isearch package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgnats.netbsd.orgopenwall.com
Dec 13, 2019Pen 0.18.0 has Insecure Temporary File Creation vulnerabilitiesCVE-2014-2387 · Other software · PEN Project · reported by MITREMedium 4.4
Pen 0.18.0 has Insecure Temporary File Creation vulnerabilities
- Product
- PEN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Nov 25, 2019openvas-scanner before 2011-09-11 creates a temporary file insecurely when generating OVAL system characteristics document with the ovaldi integrated tool enablCVE-2011-3351 · Other software · openvas-scanner · reported by Red HatHigh 7.1
openvas-scanner before 2011-09-11 creates a temporary file insecurely when generating OVAL system characteristics document with the ovaldi integrated tool enabled. A local attacker could use this flaw to conduct symlink attacks to overwrite arbitrary files on the system.
- Product
- openvas-scanner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 21, 2019xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files.CVE-2014-5255 · Other software · xcfa · reported by security@debian.orgHigh 7
xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. Note: A different vulnerability than CVE-2014-5254.
- Product
- xcfa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Nov 21, 2019xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files.CVE-2014-5254 · Other software · xcfa · reported by security@debian.orgMedium 4.7
xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files.
- Product
- xcfa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Nov 21, 2019python-rply before 0.7.4 insecurely creates temporary files.CVE-2014-1938 · Other software · Rply Project · reported by MITREMedium 5.5
python-rply before 0.7.4 insecurely creates temporary files.
- Product
- Rply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugs.debian.org
Nov 21, 2019Gamera before 3.4.1 insecurely creates temporary files.CVE-2014-1937 · Other software · Gamera Project · reported by MITREHigh 7.5
Gamera before 3.4.1 insecurely creates temporary files.
- Product
- Gamera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugs.debian.org
Nov 21, 2019rc before 1.7.1-5 insecurely creates temporary files.CVE-2014-1936 · Other software · RC Project · reported by MITREHigh 7.5
rc before 1.7.1-5 insecurely creates temporary files.
- Product
- RC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugs.debian.org
Nov 21, 20199base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames.CVE-2014-1935 · Other software · 9base Project · reported by MITREMedium 5.3
9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames.
- Product
- 9base
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugs.debian.org
Nov 20, 2019The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which couldCVE-2019-3466 · Other software · Postgresql · reported by security@debian.orgHigh 7.8
The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.
- Product
- Postgresql-common
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mirch.iousn.ubuntu.com
Nov 19, 2019foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enablCVE-2011-2924 · Other software · foomatic-filters · reported by Red HatMedium 5.5
foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enabled. This flaw may be exploited by a local attacker to conduct symlink attacks by overwriting arbitrary files accessible with the privileges of the user running the foomatic-rip universal print filter.
- Product
- foomatic-filters
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 19, 2019foomatic-rip filter, all versions, used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enabled.CVE-2011-2923 · Other software · foomatic-filters · reported by Red HatMedium 5.5
foomatic-rip filter, all versions, used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enabled. This flaw may be exploited by a local attacker to conduct symlink attacks by overwriting arbitrary files accessible with the privileges of the user running the foomatic-rip universal print filter.
- Product
- foomatic-filters
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 15, 2019OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code executionCVE-2014-0023 · Other software · OpenShift · reported by Red HatHigh 7.8
OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code execution
- Product
- OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 12, 2019An unchecked sscanf() call in ettercap before 0.7.5 allows an insecure temporary settings file to overflow a static-sized buffer on the stack.CVE-2010-3844 · Other software · ettercap · reported by Red HatHigh 8.8
An unchecked sscanf() call in ettercap before 0.7.5 allows an insecure temporary settings file to overflow a static-sized buffer on the stack.
- Product
- ettercap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugs.debian.org
Nov 12, 2019babiloo 2.0.9 before 2.0.11 creates temporary files with predictable names when downloading and unpacking dictionary files, allowing a local attacker to overwriCVE-2010-3440 · Other software · babiloo · reported by Red HatMedium 5.5
babiloo 2.0.9 before 2.0.11 creates temporary files with predictable names when downloading and unpacking dictionary files, allowing a local attacker to overwrite arbitrary files.
- Product
- babiloo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugs.debian.org
Nov 12, 2019mailscanner before 4.79.11-2.1 might allow local users to overwrite arbitrary files via a symlink attack on certain temporary files.CVE-2010-3095 · Other software · mailscanner · reported by Red HatMedium 4.7
mailscanner before 4.79.11-2.1 might allow local users to overwrite arbitrary files via a symlink attack on certain temporary files. NOTE: this issue exists because of an incomplete fix for CVE-2008-5313.
- Product
- mailscanner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugs.debian.org
Nov 12, 2019Pacemaker before 1.1.6 configure script creates temporary files insecurelyCVE-2011-5271 · Other software · Clusterlabs · reported by MITREMedium 5.5
Pacemaker before 1.1.6 configure script creates temporary files insecurely
- Product
- Pacemaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Nov 7, 2019gri before 2.12.18 generates temporary files in an insecure way.CVE-2008-7291 · Other software · GRI Project · reported by MITRECritical 9.8
gri before 2.12.18 generates temporary files in an insecure way.
- Product
- GRI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-tracker.debian.orgsecurity-tracker.debian.org
Nov 7, 2019Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to the creation of insecure temporary directCVE-2013-1809 · Other software · gambas3 · reported by Red HatHigh 7.5
Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to the creation of insecure temporary directories.
- Product
- gambas3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comaccess.redhat.com
Nov 7, 2019Mondo 2.24 has insecure handling of temporary files.CVE-2007-3915 · Other software · Mandriva · reported by MITRECritical 9.1
Mondo 2.24 has insecure handling of temporary files.
- Product
- Mondo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-tracker.debian.orgsecurity-tracker.debian.org
Nov 7, 2019Eximious Logo Designer 3.82 has Heap Corruption starting at ntdll!RtlpNtMakeTemporaryKey+0x0000000000001a78.CVE-2019-18820 · Other software · Eximioussoft · reported by MITREMedium 5.5
Eximious Logo Designer 3.82 has Heap Corruption starting at ntdll!RtlpNtMakeTemporaryKey+0x0000000000001a78.
- Product
- Logo Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Nov 5, 2019archivemail 0.6.2 uses temporary files insecurely leading to a possible race condition.CVE-2006-4245 · Other software · archivemail · reported by security@debian.orgHigh 8.1
archivemail 0.6.2 uses temporary files insecurely leading to a possible race condition.
- Product
- archivemail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgsecurity-tracker.debian.org
Nov 4, 2019An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped files.CVE-2013-4374 · Other software · RHQ Mongo DB Drift Server · reported by Red HatHigh 7.1
An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped files.
- Product
- RHQ Mongo DB Drift Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 4, 2019The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories.CVE-2013-4251 · Other software · SciPy · reported by Red HatHigh 7.8
The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories.
- Product
- SciPy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Nov 4, 2019Insecure temporary file vulnerability in RedHat vsdm 4.9.6.CVE-2013-4280 · Other software · RedHat · reported by Red HatMedium 5.5
Insecure temporary file vulnerability in RedHat vsdm 4.9.6.
- Product
- vdsm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 1, 2019Insecure temporary file vulnerability in Redis 2.6 related to /tmp/redis.ds.CVE-2013-0180 · Other software · Redis Labs · reported by Red HatMedium 5.5
Insecure temporary file vulnerability in Redis 2.6 related to /tmp/redis.ds.
- Product
- Redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.redhat.com
Nov 1, 2019Insecure temporary file vulnerability in Redis before 2.6 related to /tmp/redis-%p.vm.CVE-2013-0178 · Other software · Redis Labs · reported by Red HatMedium 5.5
Insecure temporary file vulnerability in Redis before 2.6 related to /tmp/redis-%p.vm.
- Product
- Redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Nov 1, 2019Mutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a series of requests to mutt temporary files.CVE-2005-2351 · Other software · mutt · reported by security@debian.orgMedium 5.5
Mutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a series of requests to mutt temporary files.
- Product
- mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgsecurity-tracker.debian.org
Oct 31, 2019An issue summary information disclosure vulnerability exists in Atlassian Jira Tempo plugin, version 4.10.0.CVE-2019-5095 · Other software · Tempo · reported by talos-cna@cisco.comMedium 4.3
An issue summary information disclosure vulnerability exists in Atlassian Jira Tempo plugin, version 4.10.0. Authenticated users can obtain the summary for issues they do not have permission to view via the Tempo plugin.
- Product
- Tempo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 31, 2019python-docutils allows insecure usage of temporary filesCVE-2009-5042 · Other software · Python-docutils Project · reported by MITRECritical 9.1
python-docutils allows insecure usage of temporary files
- Product
- Python-docutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-tracker.debian.orgsecurity-tracker.debian.org
Oct 29, 2019Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected temporary file.CVE-2019-10210 · Other software · PostgreSQL · reported by Red HatHigh 7
Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected temporary file.
- Product
- postgresql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.compostgresql.org
Oct 29, 2019paxtest handles temporary files insecurelyCVE-2010-3373 · Other software · Grsecurity · reported by MITREMedium 5.5
paxtest handles temporary files insecurely
- Product
- Paxtest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgpeople.canonical.com
Oct 25, 2019IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a local user to obtain sensitive information from temporary script files.CVE-2019-4395 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a local user to obtain sensitive information from temporary script files. IBM X-Force ID: 162333.
- Product
- Cloud Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 9, 2019tinylcy Vino through 2017-12-15 allows remote attackers to cause a denial of service ("vn_get_string error: Resource temporarily unavailable" error and daemon cCVE-2019-17414 · Other software · Vino Project · reported by MITREHigh 7.5
tinylcy Vino through 2017-12-15 allows remote attackers to cause a denial of service ("vn_get_string error: Resource temporarily unavailable" error and daemon crash) via a long URL.
- Product
- Vino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2019In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290).CVE-2017-18428 · Websites & servers · Cpanel · reported by MITRELow 2.5
In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Jul 31, 2019Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspace, where it could CVE-2019-10365 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read permission.
- Product
- Jenkins Google Kubernetes Engine Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 30, 2019In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478).CVE-2019-14414 · Websites & servers · Cpanel · reported by MITRELow 3.3
In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.