Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Apr 1, 2022A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a specCVE-2021-32961 · Other software · MDT Software · reported by ics-cert@hq.dhs.govHigh 7.5
A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function looks for and get execution capabilities.
- Product
- MDT AutoSave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes muCVE-2021-32957 · Other software · MDT Software · reported by ics-cert@hq.dhs.govHigh 7.5
A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes multiple commands and summarizes the information into an XML. This function and subsequent process gives full path to the executable and is therefore vulnerable to binary hijacking.
- Product
- MDT AutoSave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user’s permissions, granting the attacker theCVE-2021-32953 · Other software · MDT Software · reported by ics-cert@hq.dhs.govCritical 9.8
An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user’s permissions, granting the attacker the ability to login.
- Product
- MDT AutoSave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022An attacker could utilize a function in MDT AutoSave versions prior to v6.02.06 that permits changing a designated path to another path and traversing the direcCVE-2021-32949 · Other software · MDT Software · reported by ics-cert@hq.dhs.govHigh 7.5
An attacker could utilize a function in MDT AutoSave versions prior to v6.02.06 that permits changing a designated path to another path and traversing the directory, allowing the replacement of an existing file with a malicious file.
- Product
- MDT AutoSave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022An attacker could decipher the encryption and gain access to MDT AutoSave versions prior to v6.02.06.CVE-2021-32945 · Other software · MDT Software · reported by ics-cert@hq.dhs.govHigh 7.5
An attacker could decipher the encryption and gain access to MDT AutoSave versions prior to v6.02.06.
- Product
- MDT AutoSave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06.CVE-2021-32937 · Other software · MDT Software · reported by ics-cert@hq.dhs.govHigh 7.5
An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06. An attacker can leverage this knowledge to provide a malicious command to the working directory where the read and write activity can be initiated.
- Product
- MDT AutoSave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022An attacker could leverage an API to pass along a malicious file that could then manipulate the process creation command line in MDT AutoSave versions prior to CVE-2021-32933 · Other software · MDT Software · reported by ics-cert@hq.dhs.govCritical 10
An attacker could leverage an API to pass along a malicious file that could then manipulate the process creation command line in MDT AutoSave versions prior to v6.02.06 and run a command line argument. This could then be leveraged to run a malicious process.
- Product
- MDT AutoSave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.