Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22 results
Mar 29, 2017The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of clCVE-2016-2379 · Other software · Pidgin · reported by cret@cert.orgHigh 8.8
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of client registration codes or (2) gain login access by eavesdropping on login messages and re-using the hashed passwords.
- Product
- Mxit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtalosintelligence.com
Jan 6, 2017A directory traversal exists in the handling of the MXIT protocol in Pidgin.CVE-2016-4323 · Other software · Pidgin · reported by cret@cert.orgLow 3.7
A directory traversal exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an overwrite of files. A malicious server or someone with access to the network traffic can provide an invalid filename for a splash image triggering the vulnerability.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017An information leak exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2380 · Other software · Pidgin · reported by cret@cert.orgLow 3.1
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an out-of-bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead to a potential out-of-bounds read.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin.CVE-2016-2378 · Other software · Pidgin · reported by cret@cert.orgHigh 8.1
A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin. Specially crafted data sent via the server could potentially result in a buffer overflow, potentially resulting in memory corruption. A malicious server or an unfiltered malicious user can send negative length values to trigger this vulnerability.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2377 · Other software · Pidgin · reported by cret@cert.orgHigh 8.1
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could potentially result in an out-of-bounds write of one byte. A malicious server can send a negative content-length in response to a HTTP request triggering the vulnerability.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2376 · Other software · Pidgin · reported by cret@cert.orgHigh 8.1
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in arbitrary code execution. A malicious server or an attacker who intercepts the network traffic can send an invalid size for a packet which will trigger a buffer overflow.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017An exploitable out-of-bounds read exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2375 · Other software · Pidgin · reported by cret@cert.orgMedium 5.3
An exploitable out-of-bounds read exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT contact information sent from the server can result in memory disclosure.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2374 · Other software · Pidgin · reported by cret@cert.orgHigh 8.1
An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT MultiMX message sent via the server can result in an out-of-bounds write leading to memory disclosure and code execution.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2373 · Other software · Pidgin · reported by cret@cert.orgMedium 5.9
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or user can send an invalid mood to trigger this vulnerability.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017An information leak exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2372 · Other software · Pidgin · reported by cret@cert.orgMedium 5.9
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle attacker can send an invalid size for a file transfer which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the file is sent to another user.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2371 · Other software · Pidgin · reported by cret@cert.orgHigh 8.1
An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could cause memory corruption resulting in code execution.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2370 · Other software · Pidgin · reported by cret@cert.orgMedium 5.9
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an out-of-bounds read. A malicious server or man-in-the-middle attacker can send invalid data to trigger this vulnerability.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2369 · Other software · Pidgin · reported by cret@cert.orgMedium 5.9
A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a denial of service vulnerability. A malicious server can send a packet starting with a NULL byte triggering the vulnerability.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin.CVE-2016-2368 · Other software · Pidgin · reported by cret@cert.orgHigh 8.1
Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could result in multiple buffer overflows, potentially resulting in code execution or memory disclosure.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017An information leak exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2367 · Other software · Pidgin · reported by cret@cert.orgMedium 5.9
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle can send an invalid size for an avatar which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the avatar is sent to another user.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2366 · Other software · Pidgin · reported by cret@cert.orgMedium 5.9
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2365 · Other software · Pidgin · reported by cret@cert.orgMedium 5.9
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2014markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a large leCVE-2014-3695 · Other software · Pidgin · reported by Red HatMedium 5
markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a large length value in an emoticon response.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Feb 6, 2014Integer signedness error in the MXit functionality in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (segmentation fault) via a craftCVE-2013-6489 · Other software · Pidgin · reported by Red HatMedium 5
Integer signedness error in the MXit functionality in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (segmentation fault) via a crafted emoticon value, which triggers an integer overflow and a buffer overflow.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imdebian.org
Feb 16, 2013Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP headeCVE-2013-0272 · Other software · Pidgin · reported by Red HatMedium 6.8
Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP header.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Feb 16, 2013The MXit protocol plugin in libpurple in Pidgin before 2.10.7 might allow remote attackers to create or overwrite files via a crafted (1) mxit or (2) mxit/imageCVE-2013-0271 · Other software · Pidgin · reported by Red HatMedium 5
The MXit protocol plugin in libpurple in Pidgin before 2.10.7 might allow remote attackers to create or overwrite files via a crafted (1) mxit or (2) mxit/imagestrips pathname.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Jul 7, 2012Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inlCVE-2012-3374 · Other software · Pidgin · reported by Red HatHigh 7.5
Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.