Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5 results
Jan 21, 2022Fresenius Kabi Agilia Link + version 3.0 does not enforce transport layer encryption.CVE-2021-41835 · Other software · Fresenius Kabi · reported by ics-cert@hq.dhs.govHigh 7.3
Fresenius Kabi Agilia Link + version 3.0 does not enforce transport layer encryption. Therefore, transmitted data may be sent in cleartext. Transport layer encryption is offered on Port TCP/443, but the affected service does not perform an automated redirect from the unencrypted service on Port TCP/80 to the encrypted service.
- Product
- Agilia Link+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2022The SSL/TLS configuration of Fresenius Kabi Agilia Link + version 3.0 has serious deficiencies that may allow an attacker to compromise SSL/TLS sessions in diffCVE-2021-31562 · Other software · Fresenius Kabi · reported by ics-cert@hq.dhs.govMedium 6.5
The SSL/TLS configuration of Fresenius Kabi Agilia Link + version 3.0 has serious deficiencies that may allow an attacker to compromise SSL/TLS sessions in different ways. An attacker may be able to eavesdrop on transferred data, manipulate data allegedly secured by SSL/TLS, and impersonate an entity to gain access to sensitive information.
- Product
- Agilia Link+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2022Requests may be used to interrupt the normal operation of the device.CVE-2021-23236 · Other software · Fresenius Kabi · reported by ics-cert@hq.dhs.govHigh 7.5
Requests may be used to interrupt the normal operation of the device. When exploited, Fresenius Kabi Agilia Link+ version 3.0 must be rebooted via a hard reset triggered by pressing a button on the rack system.
- Product
- Agilia Link+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2022Sensitive endpoints in Fresenius Kabi Agilia Link+ v3.0 and prior can be accessed without any authentication information such as the session cookie.CVE-2021-23233 · Other software · Fresenius Kabi · reported by ics-cert@hq.dhs.govHigh 7.3
Sensitive endpoints in Fresenius Kabi Agilia Link+ v3.0 and prior can be accessed without any authentication information such as the session cookie. An attacker can send requests to sensitive endpoints as an unauthenticated user to perform critical actions or modify critical configuration parameters.
- Product
- Agilia Link+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2022The web application on Agilia Link+ version 3.0 implements authentication and session management mechanisms exclusively on the client-side and does not protect CVE-2021-23196 · Other software · Fresenius Kabi · reported by ics-cert@hq.dhs.govHigh 7.3
The web application on Agilia Link+ version 3.0 implements authentication and session management mechanisms exclusively on the client-side and does not protect authentication attributes sufficiently.
- Product
- Agilia Link+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.