Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,841 results · page 95 of 137
Jun 29, 2022A vulnerability, which was classified as critical, was found in Teleopti WFM 7.1.0.CVE-2017-20111 · Other software · Teleopti · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in Teleopti WFM 7.1.0. This affects an unknown part of the component Administration. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- Product
- WFM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1.CVE-2017-20106 · Other software · Lithium · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1. This issue affects some unknown processing of the component Compose Message Handler. The manipulation of the argument upload_url leads to server-side request forgery. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Product
- Forum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comvulnerability-lab.com
Jun 27, 2022A vulnerability classified as critical has been found in Kama Click Counter Plugin up to 3.4.8.CVE-2017-20103 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Kama Click Counter Plugin up to 3.4.8. This affects an unknown part of the file wp-admin/admin.php. The manipulation of the argument order_by/order with the input ASC%2c(select*from(select(sleep(2)))a) leads to sql injection (Blind). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.9 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Kama Click Counter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical.CVE-2017-20099 · Other software · unspecified · reported by VulDBHigh 7.3
A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated remotely.
- Product
- Analytics Stats Counter Statistics Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022When performing the analytical operation of the DepthwiseConv2D operator, if the attribute depth_multiplier is 0, it will cause a division by 0 exception.CVE-2021-33651 · Other software · Mindspore · reported by securities@openeuler.orgHigh 7.5
When performing the analytical operation of the DepthwiseConv2D operator, if the attribute depth_multiplier is 0, it will cause a division by 0 exception.
- Product
- Mindspore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022A vulnerability was found in Album Lock 4.0 and classified as critical.CVE-2017-20102 · Other software · unspecified · reported by VulDBMedium 4.4
A vulnerability was found in Album Lock 4.0 and classified as critical. Affected by this issue is some unknown functionality of the file /getImage. The manipulation of the argument filePaht leads to path traversal. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
- Product
- Album Lock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comvulnerability-lab.com
Jun 24, 2022IBM Robotic Process Automation 21.0.1 and 21.0.2 could allow a user with psychical access to the system to obtain sensitive information due to insufficiently prCVE-2022-33953 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.6
IBM Robotic Process Automation 21.0.1 and 21.0.2 could allow a user with psychical access to the system to obtain sensitive information due to insufficiently protected access tokens. IBM X-Force ID: 229198.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 24, 2022A vulnerability classified as critical was found in Simple Ads Manager Plugin.CVE-2017-20095 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Simple Ads Manager Plugin. This vulnerability affects unknown code. The manipulation leads to code injection. The attack can be initiated remotely.
- Product
- Simple Ads Manager Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022A vulnerability, which was classified as critical, was found in VaultPress Plugin 1.8.4.CVE-2017-20086 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in VaultPress Plugin 1.8.4. This affects an unknown part. The manipulation leads to code injection. It is possible to initiate the attack remotely.
- Product
- VaultPress Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to eaCVE-2022-21952 · Other software · SUSE · reported by meissner@suse.deHigh 7.5
A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.
- Product
- SUSE Manager Server 4.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.combugzilla.suse.com
Jun 22, 2022A vulnerability has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832 and classified as critical.CVE-2017-20084 · Other software · JUNG · reported by VulDBMedium 5.3
A vulnerability has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832 and classified as critical. Affected by this vulnerability is an unknown functionality of the component KNX Group Address. The manipulation leads to backdoor. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Smart Visu Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022A vulnerability, which was classified as critical, was found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832.CVE-2017-20083 · Other software · JUNG · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. Affected is an unknown function of the component SSH Server. The manipulation leads to backdoor. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Smart Visu Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022Incorrect Permission Assignment for Critical Resource vulnerability in ABB REX640 PCL1, REX640 PCL2, REX640 PCL3 allows an authenticated attacker to launch an aCVE-2022-1596 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 6.5
Incorrect Permission Assignment for Critical Resource vulnerability in ABB REX640 PCL1, REX640 PCL2, REX640 PCL3 allows an authenticated attacker to launch an attack against the user database file and try to take control of an affected system node.
- Product
- REX640 PCL1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jun 21, 2022A vulnerability, which was classified as critical, was found in Hindu Matrimonial Script.CVE-2017-20081 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Hindu Matrimonial Script. This affects an unknown part of the file /admin/reports.php. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability, which was classified as critical, has been found in Hindu Matrimonial Script.CVE-2017-20080 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Hindu Matrimonial Script. Affected by this issue is some unknown functionality of the file /admin/googleads.php. The manipulation leads to improper privilege management. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability classified as critical was found in Hindu Matrimonial Script.CVE-2017-20079 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Hindu Matrimonial Script. Affected by this vulnerability is an unknown functionality of the file /admin/photo.php. The manipulation leads to improper privilege management. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability classified as critical has been found in Hindu Matrimonial Script.CVE-2017-20078 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Hindu Matrimonial Script. Affected is an unknown function of the file /admin/featured.php. The manipulation leads to improper privilege management. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability was found in Hindu Matrimonial Script and classified as critical.CVE-2017-20074 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability was found in Hindu Matrimonial Script and classified as critical. Affected by this issue is some unknown functionality of the file /admin/newsletter1.php. The manipulation leads to improper privilege management. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability has been found in Hindu Matrimonial Script and classified as critical.CVE-2017-20073 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability has been found in Hindu Matrimonial Script and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/cms.php. The manipulation leads to improper privilege management. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability, which was classified as critical, was found in Hindu Matrimonial Script.CVE-2017-20072 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Hindu Matrimonial Script. Affected is an unknown function of the file /admin/generalsettings.php. The manipulation leads to improper privilege management. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability, which was classified as critical, has been found in Hindu Matrimonial Script.CVE-2017-20071 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Hindu Matrimonial Script. This issue affects some unknown processing of the file /admin/renewaldue.php. The manipulation leads to improper privilege management. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability classified as critical was found in Hindu Matrimonial Script.CVE-2017-20070 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Hindu Matrimonial Script. This vulnerability affects unknown code of the file /admin/communitymanagement.php. The manipulation leads to improper privilege management. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability classified as critical has been found in Hindu Matrimonial Script.CVE-2017-20069 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Hindu Matrimonial Script. This affects an unknown part of the file /admin/countrymanagement.php. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 19, 2022A vulnerability has been found in FFmpeg 2.0 and classified as critical.CVE-2014-125020 · Other software · unspecified · reported by VulDBHigh 7.3
A vulnerability has been found in FFmpeg 2.0 and classified as critical. This vulnerability affects the function decode_update_thread_context. The manipulation leads to memory corruption. The attack can be initiated remotely. It is recommended to apply a patch to fix this issue.
- Product
- FFmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.videolan.orgvuldb.com
Jun 18, 2022A vulnerability classified as critical was found in FFmpeg 2.0.CVE-2014-125017 · Other software · unspecified · reported by VulDBHigh 7.3
A vulnerability classified as critical was found in FFmpeg 2.0. This vulnerability affects the function rpza_decode_stream. The manipulation leads to memory corruption. The attack can be initiated remotely. The name of the patch is Fixes Invalid Writes. It is recommended to apply a patch to fix this issue.
- Product
- FFmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.videolan.orgvuldb.com
Jun 18, 2022A vulnerability classified as critical has been found in FFmpeg 2.0.CVE-2014-125015 · Other software · unspecified · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in FFmpeg 2.0. Affected is the function read_var_block_data. The manipulation leads to memory corruption. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
- Product
- FFmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.videolan.orgvuldb.com
Jun 17, 2022A vulnerability classified as critical was found in GE Voluson S8.CVE-2020-36549 · Other software · GE · reported by ics-cert@hq.dhs.govHigh 8.8
A vulnerability classified as critical was found in GE Voluson S8. Affected is the underlying Windows XP operating system. Missing patches might introduce an excessive attack surface. Access to the local network is required for this attack to succeed.
- Product
- Voluson S8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022A vulnerability, which was classified as critical, has been found in uTorrent.CVE-2018-25044 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in uTorrent. This issue affects some unknown processing of the component Guest Account. The manipulation leads to privilege escalation. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
- Product
- uTorrent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmath.sci.hiroshima-u.ac.jpbugs.chromium.org
Jun 17, 2022A vulnerability classified as critical was found in uTorrent.CVE-2018-25043 · Other software · unspecified · reported by VulDBMedium 5
A vulnerability classified as critical was found in uTorrent. This vulnerability affects unknown code of the component PRNG. The manipulation leads to weak authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
- Product
- uTorrent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmath.sci.hiroshima-u.ac.jpbugs.chromium.org
Jun 17, 2022A vulnerability classified as critical has been found in uTorrent.CVE-2018-25042 · Other software · unspecified · reported by VulDBMedium 5
A vulnerability classified as critical has been found in uTorrent. This affects an unknown part. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to upgrade the affected component.
- Product
- uTorrent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgvuldb.com
Jun 15, 2022A lack of password masking in Devolutions Remote Desktop Manager allows physically proximate attackers to observe sensitive data.CVE-2022-1342 · Other software · Devolutions · reported by security@devolutions.netMedium 4.6
A lack of password masking in Devolutions Remote Desktop Manager allows physically proximate attackers to observe sensitive data. A caching issue can cause sensitive fields to sometimes stay revealed when closing and reopening a panel, which could lead to involuntarily disclosing sensitive information. This issue affects: Devolutions Remote Desktop Manager 2022.1.24 version and prior versions.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Jun 15, 2022A vulnerability classified as critical has been found in FileCloud.CVE-2022-1958 · Other software · Filecloud · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. Upgrading to version 21.3.5.18513 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-201960.
- Product
- Filecloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022Logical defects in code implementation in some products.CVE-2022-31754 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Logical defects in code implementation in some products. Successful exploitation of this vulnerability may affect the availability of some features.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 13, 2022A vulnerability has been found in Navetti PricePoint 4.6.0.0 and classified as critical.CVE-2017-20042 · Other software · Navetti · reported by VulDBMedium 6.3
A vulnerability has been found in Navetti PricePoint 4.6.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection (Blind). The attack can be launched remotely. Upgrading to version 4.7.0.0 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- PricePoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2022A vulnerability was found in SICUNET Access Controller 0.32-05z and classified as critical.CVE-2017-20038 · Other software · SICUNET · reported by VulDBMedium 6.3
A vulnerability was found in SICUNET Access Controller 0.32-05z and classified as critical. Affected by this issue is some unknown functionality of the file card_scan_decoder.php. The manipulation of the argument No/door leads to privilege escalation. The attack may be launched remotely.
- Product
- Access Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2022A vulnerability has been found in SICUNET Access Controller 0.32-05z and classified as critical.CVE-2017-20037 · Other software · SICUNET · reported by VulDBMedium 6.3
A vulnerability has been found in SICUNET Access Controller 0.32-05z and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument c leads to privilege escalation. The attack can be launched remotely.
- Product
- Access Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022A vulnerability was found in PHPList 3.2.6 and classified as critical.CVE-2017-20029 · Other software · unspecified · reported by VulDBHigh 7.3
A vulnerability was found in PHPList 3.2.6 and classified as critical. This issue affects some unknown processing of the file /lists/index.php of the component Edit Subscription. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- PHPList
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022A vulnerability was found in Solare Solar-Log 2.8.4-56/3.5.2-85 and classified as critical.CVE-2017-20023 · Other software · Solare · reported by VulDBMedium 6.3
A vulnerability was found in Solare Solar-Log 2.8.4-56/3.5.2-85 and classified as critical. This issue affects some unknown processing of the component Network Config. The manipulation leads to privilege escalation. The attack may be initiated remotely. Upgrading to version 3.5.3-86 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Solar-Log
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022A vulnerability, which was classified as critical, was found in Solare Solar-Log 2.8.4-56/3.5.2-85.CVE-2017-20021 · Other software · Solare · reported by VulDBMedium 6.5
A vulnerability, which was classified as critical, was found in Solare Solar-Log 2.8.4-56/3.5.2-85. This affects an unknown part of the component File Upload. The manipulation leads to privilege escalation. It is possible to initiate the attack remotely. Upgrading to version 3.5.3-86 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Solar-Log
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022A vulnerability classified as critical was found in Axios Italia Axios RE 1.7.0/7.0.0.CVE-2019-25068 · Other software · Axios Italia · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Axios Italia Axios RE 1.7.0/7.0.0. This vulnerability affects unknown code of the file REDefault.aspx of the component Connection Handler. The manipulation of the argument DBIDX leads to privilege escalation. The attack can be initiated remotely.
- Product
- Axios RE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022A vulnerability, which was classified as critical, was found in Podman and Varlink 1.5.1.CVE-2019-25067 · Other software · Podman Project · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Podman and Varlink 1.5.1. This affects an unknown part of the component API. The manipulation leads to Remote Privilege Escalation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-143949 was assigned to this vulnerability.
- Product
- Podman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022A vulnerability has been found in ajenti 2.1.31 and classified as critical.CVE-2019-25066 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability has been found in ajenti 2.1.31 and classified as critical. This vulnerability affects unknown code of the component API. The manipulation leads to privilege escalation. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1.32 is able to address this issue. The name of the patch is 7aa146b724e0e20cfee2c71ca78fafbf53a8767c. It is recommended to upgrade the affected component.
- Product
- ajenti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022A vulnerability, which was classified as critical, was found in MONyog Ultimate 6.63.CVE-2016-15002 · Other software · unspecified · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in MONyog Ultimate 6.63. This affects an unknown part of the component Cookie Handler. The manipulation of the argument HasServerEdit/IsAdmin leads to privilege escalation. It is possible to initiate the attack remotely.
- Product
- MONyog Ultimate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2022A vulnerability, which was classified as critical, has been found in The Next Generation of Genealogy Sitebuilding up to 11.1.0.CVE-2017-20017 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in The Next Generation of Genealogy Sitebuilding up to 11.1.0. This issue affects some unknown processing of the file /timeline2.php. The manipulation of the argument primaryID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.1.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- The Next Generation of Genealogy Sitebuilding
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2022A vulnerability, which was classified as critical, was found in SialWeb CMS.CVE-2020-36543 · Other software · SialWeb · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in SialWeb CMS. This affects an unknown part of the file /about.php. The manipulation of the argument Id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2022A vulnerability was found in Sricam IP CCTV Camera and classified as critical.CVE-2019-25062 · Other software · Sricam · reported by VulDBMedium 5.3
A vulnerability was found in Sricam IP CCTV Camera and classified as critical. This issue affects some unknown processing of the component Device Viewer. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
- Product
- IP CCTV Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 7, 2022Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers.CVE-2022-30740 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.1
Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers.
- Product
- Samsung Internet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 7, 2022Improper authorization in Samsung Pass prior to 1.0.00.33 allows physical attackers to acess account list without authentication.CVE-2022-30730 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.6
Improper authorization in Samsung Pass prior to 1.0.00.33 allows physical attackers to acess account list without authentication.
- Product
- Samsung Pass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 7, 2022A vulnerability classified as critical has been found in Demokratian.CVE-2020-36542 · Other software · unspecified · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Demokratian. This affects an unknown part of the file install/install3.php. The manipulation leads to privilege escalation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- Product
- Demokratian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalquimistadesistemas.combitbucket.org
Jun 7, 2022A vulnerability, which was classified as critical, was found in Neetai Tech.CVE-2020-36540 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Neetai Tech. Affected is an unknown function of the file /product.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Neetai Tech
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.