Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
43 results
Oct 30, 2026SNARK Verifier is a generic (S)NARK verifier.CVE-2026-62337 · Other software · axiom-crypto · reported by GitHubMedium 6.9
SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. `EcPointLoader::multi_scalar_multiplication` places a `Value::Assigned(_)` base paired with `Value::Constant(ONE)` into its unscaled variable-base list and passes it directly to `sum_with_const`. The default shim delegates to halo2-lib `EccChip::sum`, whose incomplete affine addition assumes nonidentity input points. A prover-controlled proof point encoded as `(0, 0)` can therefore enter the final aggregation sum through the scalar-one shortcut and affect the MSM or accumulator computation. Practical exploitability depends on the surrounding aggregation and final-decider checks; the advisory does not establish universal acceptance of invalid proofs. This issue is fixed in version 0.2.5.
- Product
- snark-verifier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026SNARK Verifier is a generic (S)NARK verifier.CVE-2026-61618 · Other software · axiom-crypto · reported by GitHubMedium 6.9
SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. `PlonkProof::read` selects scalars using `accumulator_indices` and passes them to `AccumulatorEncoding::from_repr`. For the EVM loader, `LimbsEncoding::from_repr` forwards them to `EvmLoader::ec_point_from_limbs` in `snark-verifier/src/loader/evm/loader.rs`, where `shl` and `add` reconstruct coordinates before `validate_ec_point` checks the resulting affine point rather than the original limb bounds. The related native path in `snark-verifier/src/pcs/kzg/accumulator.rs` can reach assertion- or unwrap-based decoding and panic instead of returning a verification error. This allows noncanonical encodings at the verifier boundary and can crash the native verifier. Standard SDK aggregation circuits are expected to constrain accumulator limbs before this boundary, which limits practical exploitability. This issue is fixed in version 0.2.5.
- Product
- snark-verifier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026A stack overflow in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of CVE-2026-36908 · Other software · reported by MITREMedium 5.5
A stack overflow in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026A stack overflow in the AP4_StsdAtom::AP4_StsdAtom component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service (DoS) via a CVE-2026-36907 · Other software · reported by MITREMedium 5.5
A stack overflow in the AP4_StsdAtom::AP4_StsdAtom component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641.CVE-2026-5236 · Other software · Axiomatic · reported by VulDBLow 1.9
A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_BitReader::SkipBits of the file Ap4Dac4Atom.cpp of the component DSI v1 Parser. Such manipulation of the argument n_presentations leads to heap-based buffer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026A vulnerability was determined in Axiomatic Bento4 up to 1.6.0-641.CVE-2026-5235 · Other software · Axiomatic · reported by VulDBLow 1.9
A vulnerability was determined in Axiomatic Bento4 up to 1.6.0-641. This impacts the function AP4_BitReader::ReadCache of the file Ap4Dac4Atom.cpp of the component MP4 File Parser. This manipulation causes heap-based buffer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641.CVE-2025-8537 · Other software · Axiomatic · reported by VulDBLow 2.9
A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_DataBuffer::SetDataSize of the file Mp4Decrypt.cpp of the component mp4decrypt. The manipulation leads to allocation of resources. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jan 30, 2025A vulnerability was found in Axiomatic Bento4 up to 1.6.0-641.CVE-2025-0870 · Other software · Axiomatic · reported by VulDBMedium 6.3
A vulnerability was found in Axiomatic Bento4 up to 1.6.0-641. It has been rated as critical. Affected by this issue is the function AP4_DataBuffer::GetData in the library Ap4DataBuffer.h. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025A vulnerability classified as critical was found in Axiomatic Bento4 up to 1.6.0.CVE-2025-0753 · Other software · Axiomatic · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Axiomatic Bento4 up to 1.6.0. This vulnerability affects the function AP4_StdcFileByteStream::ReadPartial of the component mp42aac. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025A vulnerability classified as critical has been found in Axiomatic Bento4 up to 1.6.0.CVE-2025-0751 · Other software · Axiomatic · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in Axiomatic Bento4 up to 1.6.0. This affects the function AP4_BitReader::ReadBits of the component mp42aac. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2024Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability.CVE-2024-7448 · Other software · Magnet Forensics · reported by zdi-disclosures@trendmicro.comHigh 8
Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Magnet Forensics AXIOM. User interaction is required to exploit this vulnerability in that the target must acquire data from a malicious mobile device. The specific flaw exists within the Android device image acquisition functionality. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-23964.
- Product
- AXIOM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.magnetforensics.comzerodayinitiative.com
May 2, 2024Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability.CVE-2023-42128 · Other software · Magnet Forensics · reported by zdi-disclosures@trendmicro.comHigh 8
Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Magnet Forensics AXIOM. User interaction is required to exploit this vulnerability in that the target must acquire data from a malicious mobile device. The specific flaw exists within the Android device image acquisition functionality. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21255.
- Product
- AXIOM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Dec 17, 2022A vulnerability was found in Axiomatic Bento4 up to 1.6.0-639.CVE-2022-4584 · Other software · Axiomatic · reported by VulDBMedium 6.3
A vulnerability was found in Axiomatic Bento4 up to 1.6.0-639. It has been rated as critical. Affected by this issue is some unknown functionality of the component mp42aac. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-216170 is the identifier assigned to this vulnerability.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability classified as critical was found in Axiomatic Bento4.CVE-2022-3974 · Other software · Axiomatic · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is the function AP4_StdcFileByteStream::ReadPartial of the file Ap4StdCFileByteStream.cpp of the component mp4info. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213553 was assigned to this vulnerability.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2022A vulnerability was found in Axiomatic Bento4.CVE-2022-3810 · Other software · Axiomatic · reported by VulDBMedium 4.3
A vulnerability was found in Axiomatic Bento4. It has been classified as problematic. This affects the function AP4_File::AP4_File of the file Mp42Hevc.cpp of the component mp42hevc. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212667.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2022A vulnerability was found in Axiomatic Bento4 and classified as problematic.CVE-2022-3809 · Other software · Axiomatic · reported by VulDBMedium 4.3
A vulnerability was found in Axiomatic Bento4 and classified as problematic. Affected by this issue is the function ParseCommandLine of the file Mp4Tag/Mp4Tag.cpp of the component mp4tag. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212666 is the identifier assigned to this vulnerability.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022A vulnerability has been found in Axiomatic Bento4 and classified as problematic.CVE-2022-3817 · Other software · Axiomatic · reported by VulDBMedium 4.3
A vulnerability has been found in Axiomatic Bento4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component mp4mux. The manipulation leads to memory leak. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212683.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022A vulnerability, which was classified as problematic, was found in Axiomatic Bento4.CVE-2022-3816 · Other software · Axiomatic · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in Axiomatic Bento4. Affected is an unknown function of the component mp4decrypt. The manipulation leads to memory leak. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212682 is the identifier assigned to this vulnerability.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022A vulnerability, which was classified as problematic, has been found in Axiomatic Bento4.CVE-2022-3815 · Other software · Axiomatic · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Axiomatic Bento4. This issue affects some unknown processing of the component mp4decrypt. The manipulation leads to memory leak. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212681 was assigned to this vulnerability.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022A vulnerability classified as problematic was found in Axiomatic Bento4.CVE-2022-3814 · Other software · Axiomatic · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Axiomatic Bento4. This vulnerability affects unknown code of the component mp4decrypt. The manipulation leads to memory leak. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212680.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022A vulnerability classified as problematic has been found in Axiomatic Bento4.CVE-2022-3813 · Other software · Axiomatic · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in Axiomatic Bento4. This affects an unknown part of the component mp4edit. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212679.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022A vulnerability was found in Axiomatic Bento4.CVE-2022-3812 · Other software · Axiomatic · reported by VulDBMedium 4.3
A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is the function AP4_ContainerAtom::AP4_ContainerAtom of the component mp4encrypt. The manipulation leads to memory leak. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212678 is the identifier assigned to this vulnerability.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022A vulnerability was found in Axiomatic Bento4.CVE-2022-3807 · Other software · Axiomatic · reported by VulDBMedium 4.3
A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Incomplete Fix CVE-2019-13238. The manipulation leads to resource consumption. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212660.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022A vulnerability, which was classified as critical, has been found in Axiomatic Bento4.CVE-2022-3785 · Other software · Axiomatic · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. Affected by this issue is the function AP4_DataBuffer::SetDataSize of the component Avcinfo. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212564.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022A vulnerability classified as critical was found in Axiomatic Bento4 5e7bb34.CVE-2022-3784 · Other software · Axiomatic · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Axiomatic Bento4 5e7bb34. Affected by this vulnerability is the function AP4_Mp4AudioDsiParser::ReadBits of the file Ap4Mp4AudioInfo.cpp of the component mp4hls. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212563.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022A vulnerability was found in Axiomatic Bento4.CVE-2022-3670 · Other software · Axiomatic · reported by VulDBHigh 7.3
A vulnerability was found in Axiomatic Bento4. It has been classified as critical. Affected is the function WriteSample of the component mp42hevc. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212010 is the identifier assigned to this vulnerability.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022A vulnerability was found in Axiomatic Bento4 and classified as problematic.CVE-2022-3669 · Other software · Axiomatic · reported by VulDBMedium 5.3
A vulnerability was found in Axiomatic Bento4 and classified as problematic. This issue affects the function AP4_AvccAtom::Create of the component mp4edit. The manipulation leads to memory leak. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212009 was assigned to this vulnerability.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022A vulnerability has been found in Axiomatic Bento4 and classified as problematic.CVE-2022-3668 · Other software · Axiomatic · reported by VulDBMedium 5.3
A vulnerability has been found in Axiomatic Bento4 and classified as problematic. This vulnerability affects the function AP4_AtomFactory::CreateAtomFromStream of the component mp4edit. The manipulation leads to memory leak. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212008.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022A vulnerability, which was classified as critical, was found in Axiomatic Bento4.CVE-2022-3667 · Other software · Axiomatic · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in Axiomatic Bento4. This affects the function AP4_MemoryByteStream::WritePartial of the file Ap4ByteStream.cpp of the component mp42aac. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212007.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022A vulnerability, which was classified as critical, has been found in Axiomatic Bento4.CVE-2022-3666 · Other software · Axiomatic · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. Affected by this issue is the function AP4_LinearReader::Advance of the file Ap4LinearReader.cpp of the component mp42ts. The manipulation leads to use after free. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212006 is the identifier assigned to this vulnerability.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022A vulnerability classified as critical was found in Axiomatic Bento4.CVE-2022-3665 · Other software · Axiomatic · reported by VulDBHigh 7.3
A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is an unknown functionality of the file AvcInfo.cpp of the component avcinfo. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212005 was assigned to this vulnerability.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022A vulnerability classified as critical has been found in Axiomatic Bento4.CVE-2022-3664 · Other software · Axiomatic · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Axiomatic Bento4. Affected is the function AP4_BitStream::WriteBytes of the file Ap4BitStream.cpp of the component avcinfo. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212004.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022A vulnerability was found in Axiomatic Bento4.CVE-2022-3663 · Other software · Axiomatic · reported by VulDBMedium 5.3
A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. This issue affects the function AP4_StsdAtom of the file Ap4StsdAtom.cpp of the component MP4fragment. The manipulation leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212003.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022A vulnerability was found in Axiomatic Bento4.CVE-2022-3662 · Other software · Axiomatic · reported by VulDBHigh 7.3
A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of the component mp42hls. The manipulation leads to use after free. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212002 is the identifier assigned to this vulnerability.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2022Adenza AxiomSL ControllerView through 10.8.1 allows redirection for SSO login URLs.CVE-2022-22919 · Other software · Adenza · reported by MITREMedium 6.1
Adenza AxiomSL ControllerView through 10.8.1 allows redirection for SSO login URLs.
- Product
- Axiomsl Controllerview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2022Adenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration.CVE-2022-24032 · Other software · Adenza · reported by MITREMedium 5.3
Adenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration. An attacker can identify valid usernames on the platform because a failed login attempt produces a different error message when the username is valid.
- Product
- Axiomsl Controllerview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2019The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, usCVE-2015-9486 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- Product
- ThemeMakers Axioma Premium Responsive
- Affected
- up to 2015-05-15
- What to do
- Affects up to 2015-05-15. Update ThemeMakers Axioma Premium Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Apr 3, 2019AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier allows remote attackers to inject HTML into the scoping dashboard features.CVE-2015-5462 · Other software · Axiomsl · reported by MITREMedium 6.1
AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier allows remote attackers to inject HTML into the scoping dashboard features.
- Product
- Axiom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexcellium-services.comexcellium-services.com
Apr 3, 2019AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier is vulnerable to a Session Fixation attack.CVE-2015-5384 · Other software · Axiomsl · reported by MITREHigh 8.8
AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier is vulnerable to a Session Fixation attack.
- Product
- Axiom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexcellium-services.comexcellium-services.com
Apr 3, 2019AxiomSL's Axiom java applet module (used for editing uploaded Excel files and associated Java RMI services) 9.5.3 and earlier allows remote attackers to (1) accCVE-2015-5463 · Other software · Axiomsl · reported by MITRECritical 9.8
AxiomSL's Axiom java applet module (used for editing uploaded Excel files and associated Java RMI services) 9.5.3 and earlier allows remote attackers to (1) access data of other basic users through arbitrary SQL commands, (2) perform a horizontal and vertical privilege escalation, (3) cause a Denial of Service on global application, or (4) write/read/delete arbitrary files on server hosting the application.
- Product
- Axiom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexcellium-services.comexcellium-services.com
Jan 27, 2014axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename,CVE-2014-1640 · Other software · Debian · reported by MITRELow 3.3
axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
- Product
- Axiom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgopenwall.com
Nov 9, 2012Advanced Productivity Software DTE Axiom before 12.3.3 does not validate the registration ID, which allows remote attackers to bypass authentication and read orCVE-2012-2455 · Other software · Advance Productivity Software · reported by MITREMedium 6.4
Advanced Productivity Software DTE Axiom before 12.3.3 does not validate the registration ID, which allows remote attackers to bypass authentication and read or modify data about users, customers, and projects via unspecified vectors.
- Product
- DTE Axiom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecunia.com
Jan 11, 2007PHP remote file inclusion vulnerability in template.php in Geoffrey Golliher Axiom Photo/News Gallery (axiompng) 0.8.6 allows remote attackers to execute arbitrCVE-2007-0200 · Other software · Geoffrey Golliher · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in template.php in Geoffrey Golliher Axiom Photo/News Gallery (axiompng) 0.8.6 allows remote attackers to execute arbitrary PHP code via a URL in the baseAxiomPath parameter.
- Product
- Axiom Photo News Gallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.