Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
64 results · page 1 of 2
Nov 19, 2025Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys.CVE-2025-13316 · Other software · Lynxtechnology · reported by cve@rapid7.comHigh 8.2
Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and gain administrator-level access to Twonky Server.
- Product
- Twonky Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw.CVE-2025-13315 · Other software · Lynxtechnology · reported by cve@rapid7.comCritical 9.3
Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.
- Product
- Twonky Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2025General Industrial Controls Lynx+ Gateway is vulnerable to a cleartext transmission vulnerability that could allow an attacker to observe network traffic to obCVE-2025-62765 · Other software · General Industrial Controls · reported by ics-cert@hq.dhs.govHigh 8.7
General Industrial Controls Lynx+ Gateway is vulnerable to a cleartext transmission vulnerability that could allow an attacker to observe network traffic to obtain sensitive information, including plaintext credentials.
- Product
- Lynx+ Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2025General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to send GET requests to oCVE-2025-59780 · Other software · General Industrial Controls · reported by ics-cert@hq.dhs.govHigh 8.7
General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to send GET requests to obtain sensitive device information.
- Product
- Lynx+ Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2025General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the deCVE-2025-58083 · Other software · General Industrial Controls · reported by ics-cert@hq.dhs.govCritical 9.2
General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the device.
- Product
- Lynx+ Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2025General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attaCVE-2025-55034 · Other software · General Industrial Controls · reported by ics-cert@hq.dhs.govHigh 8.8
General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attack resulting in unauthorized access and login.
- Product
- Lynx+ Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2024The TikTok (aka com.zhiliaoapp.musically) application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via deeplink traversal (inCVE-2024-45240 · Other software · tiktok · reported by MITREHigh 7.4
The TikTok (aka com.zhiliaoapp.musically) application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via deeplink traversal (in the application's exposed WebView). (On Android 12 and later, this is only exploitable by third-party applications.)
- Product
- tiktok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly.CVE-2024-35246 · Other software · Westermo · reported by ics-cert@hq.dhs.govHigh 8.7
An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly.
- Product
- L210-F2G Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024An attacker may be able to cause a denial-of-service condition by sending many SSH packets repeatedly.CVE-2024-32943 · Other software · Westermo · reported by ics-cert@hq.dhs.govHigh 8.7
An attacker may be able to cause a denial-of-service condition by sending many SSH packets repeatedly.
- Product
- L210-F2G Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024Plain text credentials and session ID can be captured with a network sniffer.CVE-2024-37183 · Other software · Westermo · reported by ics-cert@hq.dhs.govMedium 6.9
Plain text credentials and session ID can be captured with a network sniffer.
- Product
- L210-F2G Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2024In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers The protoCVE-2023-52505 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 4.7
In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers The protocol converter configuration registers PCC8, PCCC, PCCD (implemented by the driver), as well as others, control protocol converters from multiple lanes (each represented as a different struct phy). So, if there are simultaneous calls to phy_set_mode_ext() to lanes sharing the same PCC register (either for the "old" or for the "new" protocol), corruption of the values programmed to hardware is possible, because lynx_28g_rmw() has no locking. Add a spinlock in the struct lynx_28g_priv shared by all lanes, and take the global spinlock from the phy_ops :: set_mode() implementation. There are no other callers which modify PCC registers.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 6, 2024 A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device.CVE-2023-45735 · Other software · Westermo · reported by ics-cert@hq.dhs.govHigh 8
A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024 An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting CVE-2023-45227 · Other software · Westermo · reported by ics-cert@hq.dhs.govMedium 5.4
An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024 An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting paylCVE-2023-45222 · Other software · Westermo · reported by ics-cert@hq.dhs.govMedium 5.4
An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "autorefresh" parameter.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024 A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the devCVE-2023-45213 · Other software · Westermo · reported by ics-cert@hq.dhs.govMedium 6.6
A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the device.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024 An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username"CVE-2023-42765 · Other software · Westermo · reported by ics-cert@hq.dhs.govMedium 5.4
An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username" parameter in the SNMP configuration.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024 An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive informatiCVE-2023-40544 · Other software · Westermo · reported by ics-cert@hq.dhs.govMedium 5.7
An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive information exchanged via TCP communications.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024 An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scCVE-2023-40143 · Other software · Westermo · reported by ics-cert@hq.dhs.govMedium 5.4
An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024 The cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which cCVE-2023-38579 · Other software · Westermo · reported by ics-cert@hq.dhs.govHigh 8
The cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which could be triggered by a victim unknowingly. In a successful CSRF attack, the attacker could lead the victim user to carry out an action unintentionally.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2023Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface.CVE-2023-0750 · Other software · Lynx Technik AG · reported by vulnerability@ncsc.chCritical 9.8
Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface. When the device can be accessed over the network an attacker could bypass authentication. This would allow an attacker to : - Change the password, resulting in a DOS of the users - Change the streaming source, compromising the integrity of the stream - Change the streaming destination, compromising the confidentiality of the stream This issue affects Yellowbrik: PEC 1864. No patch has been issued by the manufacturer as this model was discontinued.
- Product
- Yellowbrik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lynx-technik.comsupport.lynx-technik.com
Aug 7, 2021Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNICVE-2021-38165 · Other software · Lynx Project · reported by MITREMedium 5.3
Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Mar 30, 2020Versiant LYNX Customer Service Portal (CSP), version 3.5.2, is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to iCVE-2020-9055 · Other software · Versiant · reported by cret@cert.orgLow 3.9
Versiant LYNX Customer Service Portal (CSP), version 3.5.2, is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to insert malicious JavaScript that is stored and displayed to the end user. This could lead to website redirects, session cookie hijacking, or information disclosure.
- Product
- LYNX Customer Service Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsp.poha.comkb.cert.org
Jun 7, 2018Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section.CVE-2018-9182 · Other software · Lynxtechnology · reported by MITREMedium 6.1
Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section.
- Product
- Twonky Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 7, 2018Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen.CVE-2018-9177 · Other software · Lynxtechnology · reported by MITREMedium 6.1
Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen.
- Product
- Twonky Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Mar 30, 2018Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary web script or HTML via the friendlynameCVE-2018-7203 · Other software · Lynxtechnology · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary web script or HTML via the friendlyname parameter to rpc/set_all.
- Product
- Twonky Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Mar 30, 2018Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories via a ..CVE-2018-7171 · Other software · Lynxtechnology · reported by MITREHigh 7.5
Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories via a .. (dot dot) in the contentbase parameter to rpc/set_all.
- Product
- Twonky Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 10, 2018The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processeCVE-2014-5002 · Other software · Lynx Project · reported by MITREHigh 7.8
The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Nov 17, 2017Lynx before 2.8.9dev.16 is vulnerable to a use after free in the HTML parser resulting in memory disclosure, because HTML_put_string() can append a chunk onto iCVE-2017-1000211 · Other software · Lynx Project · reported by MITREMedium 5.3
Lynx before 2.8.9dev.16 is vulnerable to a use after free in the HTML parser resulting in memory disclosure, because HTML_put_string() can append a chunk onto itself.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlynx.invisible-island.netsecurityfocus.com
Mar 30, 2017Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account, with a default password for whCVE-2016-10307 · Other software · Gotrango · reported by MITRECritical 9.8
Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account, with a default password for which the MD5 hash value is public (but the cleartext value is perhaps not yet public). This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.
- Product
- Apex Lynx Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.iancaling.comsecurityfocus.com
Mar 30, 2017Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0, ApexPlus <= 3.2.0, Giga <= 2.6.1, GigaLynx < 2.0, GigaOrion < 2.0, GigaPlus <= 3.2.3, GigaPro <= 1.4.1, SCVE-2016-10305 · Other software · Gotrango · reported by MITRECritical 9.8
Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0, ApexPlus <= 3.2.0, Giga <= 2.6.1, GigaLynx < 2.0, GigaOrion < 2.0, GigaPlus <= 3.2.3, GigaPro <= 1.4.1, StrataLink < 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software update package on a Trango FTP server. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.
- Product
- Apex Plus Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.iancaling.comblog.iancaling.com
Mar 2, 2017An issue was discovered in Kaltura server Lynx-12.11.0.CVE-2017-6392 · Other software · Kaltura · reported by MITREMedium 6.1
An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "server-Lynx-12.11.0/admin_console/web/tools/XmlJWPlayer.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
- Product
- Kaltura Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Mar 2, 2017An issue was discovered in Kaltura server Lynx-12.11.0.CVE-2017-6391 · Other software · Kaltura · reported by MITREMedium 6.1
An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "admin_console/web/tools/SimpleJWPlayer.php" URL, the "admin_console/web/tools/AkamaiBroadcaster.php" URL, the "admin_console/web/tools/bigRedButton.php" URL, and the "admin_console/web/tools/bigRedButtonPtsPoc.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
- Product
- Kaltura Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Feb 13, 2017An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older.CVE-2016-8378 · Other software · Lynxspring · reported by ics-cert@hq.dhs.govCritical 9.8
An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application's database lacks sufficient safeguards for protecting credentials.
- Product
- Jenesys BAS Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Feb 13, 2017An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older.CVE-2016-8369 · Other software · Lynxspring · reported by ics-cert@hq.dhs.govHigh 8.8
An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application does not sufficiently verify if a request was intentionally provided by the user who submitted the request (CROSS-SITE REQUEST FORGERY).
- Product
- Jenesys BAS Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Feb 13, 2017An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older.CVE-2016-8361 · Other software · Lynxspring · reported by ics-cert@hq.dhs.govHigh 8.6
An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application uses a hard-coded username with no password allowing an attacker into the system without authentication.
- Product
- Jenesys BAS Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Feb 13, 2017An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older.CVE-2016-8357 · Other software · Lynxspring · reported by ics-cert@hq.dhs.govHigh 7.1
An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. A user with read-only access can send commands to the software and the application will accept those commands. This would allow an attacker with read-only access to make changes within the application.
- Product
- Jenesys BAS Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Dec 22, 2016lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked intoCVE-2016-9179 · Other software · Lynx · reported by MITREHigh 7.5
lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Oct 25, 2016Unspecified vulnerability in Oracle Sun Solaris 11.3 allows local users to affect availability via vectors related to Lynx.CVE-2016-5615 · Other software · Oracle · reported by secalert_us@oracle.comLow 3.3
Unspecified vulnerability in Oracle Sun Solaris 11.3 allows local users to affect availability via vectors related to Lynx.
- Product
- Solaris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Oct 16, 2014The Aeroexpress (aka ru.lynx.aero) application 2.6.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers tCVE-2014-6976 · Other software · Aeroexpress · reported by cret@cert.orgMedium 5.4
The Aeroexpress (aka ru.lynx.aero) application 2.6.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Aeroexpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Dec 31, 2012The Central application in i-GEN opLYNX before 2.01.9 allows remote attackers to bypass authentication via vectors involving the disabling of browser JavaScriptCVE-2012-4688 · Other software · i-GEN Solutions Corporation · reported by ics-cert@hq.dhs.govHigh 7.5
The Central application in i-GEN opLYNX before 2.01.9 allows remote attackers to bypass authentication via vectors involving the disabling of browser JavaScript support.
- Product
- opLYNX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2012Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL serversCVE-2012-5821 · Other software · Lynx · reported by MITREMedium 5.9
Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcs.utexas.edumandriva.com
Aug 20, 2010Heap-based buffer overflow in the convert_to_idna function in WWW/Library/Implementation/HTParse.c in Lynx 2.8.8dev.1 through 2.8.8dev.4 allows remote attackersCVE-2010-2810 · Other software · Lynx · reported by Red HatMedium 6.8
Heap-based buffer overflow in the convert_to_idna function in WWW/Library/Implementation/HTParse.c in Lynx 2.8.8dev.1 through 2.8.8dev.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed URL containing a % (percent) character in the domain name.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2008Untrusted search path vulnerability in Lynx before 2.8.6rel.4 allows local users to execute arbitrary code via malicious (1) .mailcap and (2) mime.types files iCVE-2006-7234 · Other software · Lynx · reported by Red HatMedium 4.6
Untrusted search path vulnerability in Lynx before 2.8.6rel.4 allows local users to execute arbitrary code via malicious (1) .mailcap and (2) mime.types files in the current working directory.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orglists.opensuse.org
Oct 22, 2008lynx 2.8.6dev.15 and earlier, when advanced mode is enabled and lynx is configured as a URL handler, allows remote attackers to execute arbitrary commands via aCVE-2008-4690 · Other software · Lynx · reported by MITREHigh 10
lynx 2.8.6dev.15 and earlier, when advanced mode is enabled and lynx is configured as a URL handler, allows remote attackers to execute arbitrary commands via a crafted lynxcgi: URL, a related issue to CVE-2005-2929. NOTE: this might only be a vulnerability in limited deployments that have defined a lynxcgi: handler.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgsecunia.com
Nov 30, 2006SQL injection vulnerability in products.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL commands via the partCVE-2006-6207 · Other software · Lynx Internet Solutions · reported by MITREHigh 7.5
SQL injection vulnerability in products.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL commands via the partno parameter. NOTE: the vendor disputes this issue, stating that it is a forced SQL error
- Product
- Evolve Merchant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Nov 16, 2006SQL injection vulnerability in viewcart.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL commands via the zoneCVE-2006-5953 · Other software · Lynx Internet Solutions · reported by MITREHigh 7.5
SQL injection vulnerability in viewcart.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL commands via the zoneid parameter.
- Product
- Evolve Merchant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2005Lynx 2.8.5, and other versions before 2.8.6dev.15, allows remote attackers to execute arbitrary commands via (1) lynxcgi:, (2) lynxexec, and (3) lynxprog links,CVE-2005-2929 · Other software · University Of Kansas · reported by MITREHigh 7.5
Lynx 2.8.5, and other versions before 2.8.6dev.15, allows remote attackers to execute arbitrary commands via (1) lynxcgi:, (2) lynxexec, and (3) lynxprog links, which are not properly restricted in the default configuration in some environments.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.sco.comftp.sco.com
Oct 17, 2005Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers coCVE-2005-3120 · Other software · Invisible-island · reported by security@debian.orgCritical 9.8
Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.sco.comftp.sco.com
May 2, 2005Directory traversal vulnerability in Computalynx CProxy 3.3.x and 3.4.x through 3.4.4 allows remote attackers to read arbitrary files or cause a denial of serviCVE-2005-0657 · Other software · Computalynx · reported by MITREMedium 6.4
Directory traversal vulnerability in Computalynx CProxy 3.3.x and 3.4.x through 3.4.4 allows remote attackers to read arbitrary files or cause a denial of service (application crash) via a .. (dot dot) in an HTTP request.
- Product
- Cproxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2004Lynx, lynx-ssl, and lynx-cur before 2.8.6dev.8 allow remote attackers to cause a denial of service (infinite loop) via a web page or HTML email that contains inCVE-2004-1617 · Other software · University Of Kansas · reported by MITREMedium 5
Lynx, lynx-ssl, and lynx-cur before 2.8.6dev.8 allow remote attackers to cause a denial of service (infinite loop) via a web page or HTML email that contains invalid HTML including (1) a TEXTAREA tag with a large COLS value and (2) a large tag name in an element that is not terminated, as demonstrated by mangleme. NOTE: a followup suggests that the relevant trigger for this issue is the large COLS value.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlcamtuf.coredump.cxlists.grok.org.uk
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.