Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
49 results
Oct 23, 2026MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store.CVE-2026-115929 · Other software · MongoDB, Inc. · reported by cna@mongodb.comHigh 7.6
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.
- Product
- Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mozilla.orggithub.com
Oct 21, 2026MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source.CVE-2026-113870 · Other software · MongoDB · reported by cna@mongodb.comHigh 8.6
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.
- Product
- Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that dataCVE-2026-96750 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.3
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.
- Product
- Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents.CVE-2026-57171 · Other software · oscal-compass · reported by GitHubHigh 7.7
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output path without path-traversal validation, allowing arbitrary file write outside the Trestle workspace. These commands join the user-supplied output argument onto the Trestle root and write to the result, but guard it only with an is_directory_name_allowed() task-name-collision check rather than the PathSecurityValidator.validate_local_path() guard used by the jinja command, so an absolute path or one containing traversal sequences escapes the workspace and writes files under an attacker-chosen location as the invoking process owner. The security boundary is crossed when a trusted CI job, shared service, or wrapper derives the output argument from repository-controlled, tenant-controlled, or otherwise untrusted data while expecting output to stay inside the workspace. When --force-overwrite is used, the selected output directory is first recursively deleted, extending the primitive to destru
- Product
- compliance-trestle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents.CVE-2026-57170 · Other software · oscal-compass · reported by GitHubHigh 7.8
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse the content of an included Markdown file as Jinja2 template code in a non-sandboxed environment, allowing server-side template injection that can lead to arbitrary code execution. The MDSectionInclude and MDCleanInclude tags in Trestle/core/jinja/tags.py pass included file content to Parser(self.environment, ...).parse(), splicing it into the host template's compilation, and the environment is a plain jinja2.Environment rather than a SandboxedEnvironment, so any expressions in the file are evaluated with full access to the usual SSTI gadget chain. Because Trestle's Markdown writers emit OSCAL prose and component-description fields verbatim, applying delimiter neutralization only to parameter tables, attacker-controlled OSCAL data such as a control statement, part prose, or component description containing Jinja2 syntax flows into an included Markdown file and is executed when the include tag re-parses it. This issue is fixed in version 4.1.0.
- Product
- compliance-trestle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Compliance-trestle (Trestle) is a tooling platform for managing compliance as code.CVE-2026-52776 · Other software · oscal-compass · reported by GitHubHigh 8.6
Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local, cloud-metadata, and internal network endpoints it was designed to block. The blocklist does not canonicalize IPv4-mapped IPv6 literals such as [::ffff:169.254.169.254], which resolve to IPv6Address objects that never match the blocked IPv4 ranges, and it does not block the unspecified address 0.0.0.0, which routes to local services on Linux and inside containers. An attacker who can supply or influence an OSCAL artifact that trestle fetches, such as a malicious profile whose imports reference one of these bypass URLs, can cause the HTTPSFetcher and SFTPFetcher paths to contact cloud instance-metadata services, loopback interfaces, or internal hosts. This issue is fixed in versions 3.12.4 and 4.1.0.
- Product
- compliance-trestle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents.CVE-2026-54757 · Other software · oscal-compass · reported by GitHubHigh 7.8
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the MDCleanInclude and MDSectionInclude Jinja2 tags re-parse untrusted Markdown content as template source code using a non-sandboxed jinja2.Environment. An attacker who controls content that Trestle renders, such as a crafted workspace Markdown file, a third-party SSP document, or a YAML lookup-table value, can inject a Jinja2 expression that traverses Python object internals to execute arbitrary operating system commands in the context of the Trestle process. This issue is fixed in versions 3.12.4 and 4.1.0.
- Product
- compliance-trestle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026compliance-trestle is a tooling platform for managing compliance as code.CVE-2026-46345 · Other software · oscal-compass · reported by GitHubHigh 8.4
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace. The application does not properly validate, `../`, `..\`, or absolute paths. This allows arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue.
- Product
- compliance-trestle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026compliance-trestle is a tooling platform for managing compliance as code.CVE-2026-46439 · Other software · oscal-compass · reported by GitHubHigh 7.8
compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection (SSTI) vulnerability exists in the `trestle author jinja` command. The command recursively evaluates rendered templates, allowing an attacker to achieve arbitrary command execution with privileges of the running process by injecting malicious payloads into data fields (such as SSP documents or Lookup Tables). The vulnerability does not require attacker control of the template itself. Only attacker-controlled input data rendered into a trusted template is required. This distinction is critical: the template author may only intend to render plain text (e.g., `Title: {{ ssp.metadata.title }}`), but because of the recursive parsing, the data field itself becomes executable. The vulnerability is caused by recursive re-compilation and re-rendering of already-rendered output. Versions 3.12.3 and 4.0.3 patch the issue.
- Product
- compliance-trestle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026compliance-trestle is a tooling platform for managing compliance as code.CVE-2026-46380 · Other software · oscal-compass · reported by GitHubMedium 6.7
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints. Versions 3.12.2 and 4.0.3 fix the issue.
- Product
- compliance-trestle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026compliance-trestle is a tooling platform for managing compliance as code.CVE-2026-45774 · Other software · oscal-compass · reported by GitHubMedium 6.9
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the compliance-trestle library's profile import mechanism resolves `trestle://` URIs and relative file paths by joining them with `trestle_root` and calling `.resolve()`, but performs no boundary check to ensure the resolved path stays within the trestle workspace. An attacker can craft a malicious OSCAL profile YAML with `imports[].href` containing path traversal sequences to read arbitrary files from the server filesystem. Versions 3.12.3 and 4.0.3 patch the issue.
- Product
- compliance-trestle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026compliance-trestle is a tooling platform for managing compliance as code.CVE-2026-45725 · Other software · oscal-compass · reported by GitHubHigh 7.1
compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) constructs the local cache file path from the URL path component without sanitizing path traversal sequences (`../`). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location outside the intended cache directory, enabling arbitrary file write with attacker-controlled content to the filesystem. Versions 3.12.3 and 4.0.3 patch the issue.
- Product
- compliance-trestle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2026When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form.CVE-2026-14881 · Other software · MongoDB · reported by cna@mongodb.comHigh 8.4
When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.
- Product
- MongoDB Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behaCVE-2026-9101 · Other software · MongoDB, Inc. · reported by cna@mongodb.comMedium 5.3
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
- Product
- Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more.CVE-2026-42603 · Other software · OWASP-BLT · reported by GitHubHigh 8.8
OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and executes code directly from the attacker's fork, enabling RCE with write permissions. This vulnerability is fixed in 2.1.2.
- Product
- BLT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more.CVE-2026-40316 · Other software · OWASP-BLT · reported by GitHubHigh 8.8
OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Versions prior to 2.1.1 contain an RCE vulnerability in the .github/workflows/regenerate-migrations.yml workflow. The workflow uses the pull_request_target trigger to run with full GITHUB_TOKEN write permissions, copies attacker-controlled files from untrusted pull requests into the trusted runner workspace via git show, and then executes python manage.py makemigrations, which imports Django model modules including attacker-controlled website/models.py at runtime. Any module-level Python code in the attacker's models.py is executed during import, enabling arbitrary code execution in the privileged CI environment with access to GITHUB_TOKEN and repository secrets. The attack is triggerable by any external contributor who can open a pull request, provided a maintainer applies the regenerate-migrations label, potentially leading to secret exfiltration, repository compromise, and supply chain attacks. A patch for this issue is expected to be released in version 2.1.1.
- Product
- BLT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the `Open Object in Tree` endpoint, allowing attackers to steal session cooCVE-2025-66574 · Other software · Compass Plustechologies · reported by VulnCheckMedium 5.3
TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the `Open Object in Tree` endpoint, allowing attackers to steal session cookies and potentially escalate privileges.
- Product
- TranzAxis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcompassplustechnologies.comexploit-db.com
Sep 3, 2025A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.CVE-2025-0280 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.5
A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.
- Product
- Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Feb 27, 2025MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevCVE-2025-1755 · Other software · MongoDB Inc · reported by cna@mongodb.comHigh 7.5
MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is stored in C:\node_modules\. This issue affects MongoDB Compass prior to 1.42.1
- Product
- MongoDB Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgaccess.redhat.com
Jan 30, 2025DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass.CVE-2024-55416 · Other software · Thecontrolgroup · reported by MITRELow 3.5
DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed.
- Product
- Voyager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass.CVE-2024-55415 · Other software · Thecontrolgroup · reported by MITREMedium 5.7
DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass.
- Product
- Voyager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connectionCVE-2024-6376 · Other software · MongoDB Inc · reported by cna@mongodb.comHigh 7
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2
- Product
- MongoDB Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgjira.mongodb.org
Apr 24, 2024MongoDB Compass may accept and use insufficiently validated input from an untrusted external source.CVE-2024-3371 · Other software · MongoDB Inc · reported by cna@mongodb.comHigh 7.1
MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.
- Product
- MongoDB Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgjira.mongodb.org
Apr 10, 2024JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the component /chart/plot/CompassPlot.java.CVE-2024-23077 · Other software · jfree · reported by MITREHigh 7.5
JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the component /chart/plot/CompassPlot.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
- Product
- jfreechart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 16, 2024A Weak Cryptography for Passwords vulnerability has been detected on WIC200 affecting version 1.1.CVE-2024-0556 · Other software · Full Compass Systems · reported by cve-coordination@incibe.esHigh 7.1
A Weak Cryptography for Passwords vulnerability has been detected on WIC200 affecting version 1.1. This vulnerability allows a remote user to intercept the traffic and retrieve the credentials from another user and decode it in base64 allowing the attacker to see the credentials in plain text.
- Product
- WIC1200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024A Cross-Site Request Forgery (CSRF) vulnerability has been found on WIC1200, affecting version 1.1.CVE-2024-0555 · Other software · Full Compass Systems · reported by cve-coordination@incibe.esMedium 4.6
A Cross-Site Request Forgery (CSRF) vulnerability has been found on WIC1200, affecting version 1.1. An authenticated user could lead another user into executing unwanted actions inside the application they are logged in. This vulnerability is possible due to the lack of propper CSRF token implementation.
- Product
- WIC1200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024A Cross-site scripting (XSS) vulnerability has been found on WIC1200, affecting version 1.1.CVE-2024-0554 · Other software · Full Compass Systems · reported by cve-coordination@incibe.esMedium 5.5
A Cross-site scripting (XSS) vulnerability has been found on WIC1200, affecting version 1.1. An authenticated user could store a malicious javascript payload in the device model parameter via '/setup/diags_ir_learn.asp', allowing the attacker to retrieve the session details of another user.
- Product
- WIC1200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2023HCL Compass is vulnerable to insecure password requirements.CVE-2023-37503 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.
- Product
- HCL Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 18, 2023HCL Compass is vulnerable to failure to invalidate sessions.CVE-2023-37504 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.1
HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.
- Product
- HCL Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 18, 2023HCL Compass is vulnerable to lack of file upload security.CVE-2023-37502 · Other software · HCL Software · reported by psirt@hcl.comCritical 9
HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user's web browser.
- Product
- HCL Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 28, 2023university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component org.compass.core.executor.DefaultExecutorManager.cCVE-2023-39023 · Other software · University Compass Project · reported by MITRECritical 9.8
university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component org.compass.core.executor.DefaultExecutorManager.configure. This vulnerability is exploited via passing an unchecked argument.
- Product
- University Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023broccoli-compass v0.2.4 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.CVE-2023-27848 · Other software · Broccoli-compass Project · reported by MITRECritical 9.8
broccoli-compass v0.2.4 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.
- Product
- Broccoli-compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2023HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS).CVE-2022-42447 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.6
HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a legitimate user into accessing a special resource and executing a malicious request.
- Product
- HCL Compass2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Feb 27, 2023A vulnerability, which was classified as critical, was found in OpenCycleCompass server-php.CVE-2015-10086 · Other software · OpenCycleCompass · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in OpenCycleCompass server-php. Affected is an unknown function of the file api1/login.php. The manipulation of the argument user leads to sql injection. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is fa0d9bcf81c711a88172ad0d37a842f029ac3782. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-221808.
- Product
- server-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2022Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users.CVE-2022-30245 · Other software · Honeywell · reported by MITREMedium 6.5
Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller configuration without the knowledge of other users, altering the controller's function capabilities. The changed configuration is not updated in the User Interface, which creates an inconsistency between the configuration display and the actual configuration on the controller. After the configuration change, remediation requires reverting to the correct configuration, requiring either physical or remote access depending on the configuration that was altered.
- Product
- Alerton Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.scadafence.comgithub.com
Feb 14, 2022A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online (TWO) 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP hoCVE-2021-43106 · Other software · Compassplus · reported by MITREMedium 6.1
A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online (TWO) 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the request to be sent to a completely different Domain/IP address. This is due to that the server implicitly trusts the Host header, and fails to validate or escape it properly. An attacker can use this input to redirect target users to a malicious domain/web page. This would result in expanding the potential to further attacks and malicious actions.
- Product
- Tranzware Online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the userCVE-2021-20334 · Other software · MongoDB Inc. · reported by cna@mongodb.comMedium 4.8
A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x versions prior to 1.25.0 on Windows.
- Product
- MongoDB Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgjira.mongodb.org
Mar 19, 2021index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerabilityCVE-2021-28126 · Websites & servers · Compassplus · reported by MITREMedium 6.1
index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability
- Product
- Tranzware E-commerce Payment Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Mar 19, 2021/exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser.CVE-2021-28110 · Websites & servers · Compassplus · reported by MITREHigh 7.5
/exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser.
- Product
- Tranzware E-commerce Payment Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Mar 18, 2021TranzWare (POI) FIMI before 4.2.20.4.2 allows login_tw.php reflected Cross-Site Scripting (XSS).CVE-2021-28109 · Other software · Compassplus · reported by MITREMedium 6.1
TranzWare (POI) FIMI before 4.2.20.4.2 allows login_tw.php reflected Cross-Site Scripting (XSS).
- Product
- Tranzware Fimi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comtadviser.ru
Apr 6, 2020compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument.CVE-2020-7635 · Other software · Compass-compile Project · reported by report@snyk.ioCritical 9.8
compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument.
- Product
- Compass-compile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2019The Compassion Switzerland addons 10.01.4 for Odoo allow SQL injection in models/partner_compassion.py.CVE-2019-15564 · Other software · Compassionuk · reported by MITRECritical 9.8
The Compassion Switzerland addons 10.01.4 for Odoo allow SQL injection in models/partner_compassion.py.
- Product
- Compassion Switzerland
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2019The Plum Compass Android device with a build fingerprint of PLUM/c179_hwf_221/c179_hwf_221:6.0/MRA58K/W16.51.5-22:user/release-keys contains a pre-installed plaCVE-2018-14989 · Other software · Plum-mobile · reported by MITREHigh 7.5
The Plum Compass Android device with a build fingerprint of PLUM/c179_hwf_221/c179_hwf_221:6.0/MRA58K/W16.51.5-22:user/release-keys contains a pre-installed platform app with a package name of com.android.settings (versionCode=23, versionName=6.0-eng.root.20161223.224055) that contains an exported broadcast receiver app component which allows any app co-located on the device to programmatically perform a factory reset. In addition, the app initiating the factory reset does not require any permissions. A factory reset will remove all user data and apps from the device. This will result in the loss of any data that have not been backed up or synced externally. The capability to perform a factory reset is not directly available to third-party apps (those that the user installs themselves with the exception of enabled Mobile Device Management (MDM) apps), although this capability can be obtained by leveraging an unprotected app component of a pre-installed platform app.
- Product
- Compass Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkryptowire.comkryptowire.com
Jul 24, 2018SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within theCVE-2018-10604 · Other software · Schweitzer Engineering Laboratories, Inc. · reported by ics-cert@hq.dhs.govHigh 8.8
SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within the Compass installation folder, resulting in escalation of privilege and/or malicious code execution.
- Product
- Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Jan 25, 2018Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearingCVE-2017-1000391 · Websites & servers · Jenkins · reported by MITREHigh 7.3
Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comjenkins.io
Oct 2, 2017Cross-site scripting (XSS) vulnerability in the Compass Rose module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or CVE-2015-7980 · Other software · Compass Rose Project · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Compass Rose module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "embedding a JavaScript library from an external source that was not reliable."
- Product
- Compass Rose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Oct 19, 2014The Compassion Satisfaction (aka com.wCompassionSatisfactionWorkshopPresentation) application 0.75.13440.35155 for Android does not verify X.509 certificates frCVE-2014-7368 · Other software · Creatingahaven · reported by cret@cert.orgMedium 5.4
The Compassion Satisfaction (aka com.wCompassionSatisfactionWorkshopPresentation) application 0.75.13440.35155 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Compassion Satisfaction
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 26, 2014The EPL Hat Trick (aka com.hat.trick.goal) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacCVE-2014-6736 · Other software · 9jacompass · reported by cret@cert.orgMedium 5.4
The EPL Hat Trick (aka com.hat.trick.goal) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- EPL HAT Trick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Jun 12, 2006PHP remote file inclusion vulnerability in inc/design.inc.php in LoveCompass aePartner 0.8.3 and earlier allows remote attackers to execute arbitrary PHP code vCVE-2006-2996 · Other software · Lovecompass · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in inc/design.inc.php in LoveCompass aePartner 0.8.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the dir[data] parameter.
- Product
- Aepartner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.