Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
27 results
Apr 29, 2020NETGEAR ReadyNAS devices before 6.6.1 are affected by command injection.CVE-2017-18856 · Network & remote access · Netgear · reported by MITREMedium 6.7
NETGEAR ReadyNAS devices before 6.6.1 are affected by command injection.
- Product
- Readynas OS Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 29, 2020NETGEAR ReadyNAS 6.6.1 and earlier is affected by command injection.CVE-2017-18854 · Network & remote access · Netgear · reported by MITREMedium 6.7
NETGEAR ReadyNAS 6.6.1 and earlier is affected by command injection.
- Product
- Readynas OS Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 27, 2020NETGEAR ReadyNAS devices before 6.9.3 are affected by incorrect configuration of security settings.CVE-2018-21159 · Network & remote access · Netgear · reported by MITREMedium 4.9
NETGEAR ReadyNAS devices before 6.9.3 are affected by incorrect configuration of security settings.
- Product
- Readynas OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 23, 2020NETGEAR ReadyNAS devices before 6.9.3 are affected by CSRF.CVE-2018-21160 · Network & remote access · Netgear · reported by MITREHigh 8.8
NETGEAR ReadyNAS devices before 6.9.3 are affected by CSRF.
- Product
- Readynas OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 23, 2020NETGEAR ReadyNAS devices before 6.9.3 are affected by CSRF.CVE-2018-21102 · Network & remote access · Netgear · reported by MITREHigh 8.8
NETGEAR ReadyNAS devices before 6.9.3 are affected by CSRF.
- Product
- Readynas OS Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 21, 2020NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.CVE-2017-18809 · Network & remote access · Netgear · reported by MITREMedium 4.8
NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- Product
- Readynas OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 21, 2020NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by incorrect configuration of security settings.CVE-2017-18808 · Network & remote access · Netgear · reported by MITREMedium 4.2
NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by incorrect configuration of security settings.
- Product
- Readynas OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 21, 2020NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.CVE-2017-18807 · Network & remote access · Netgear · reported by MITREMedium 4.8
NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- Product
- Readynas OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 21, 2020NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.CVE-2017-18820 · Network & remote access · Netgear · reported by MITREMedium 4.8
NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- Product
- Readynas OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 21, 2020NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by incorrect configuration of security settings.CVE-2017-18819 · Network & remote access · Netgear · reported by MITRELow 3.3
NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by incorrect configuration of security settings.
- Product
- Readynas OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 21, 2020NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.CVE-2017-18816 · Network & remote access · Netgear · reported by MITREMedium 4.8
NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- Product
- Readynas OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 21, 2020NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.CVE-2017-18815 · Network & remote access · Netgear · reported by MITREMedium 4.8
NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- Product
- Readynas OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 21, 2020NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.CVE-2017-18814 · Network & remote access · Netgear · reported by MITREMedium 4.8
NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- Product
- Readynas OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 21, 2020NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.CVE-2017-18813 · Network & remote access · Netgear · reported by MITREMedium 4.8
NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- Product
- Readynas OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 21, 2020NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.CVE-2017-18812 · Network & remote access · Netgear · reported by MITREMedium 4.8
NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- Product
- Readynas OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 21, 2020NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.CVE-2017-18811 · Network & remote access · Netgear · reported by MITREMedium 4.8
NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- Product
- Readynas OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
Apr 21, 2020NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.CVE-2017-18810 · Network & remote access · Netgear · reported by MITREMedium 4.8
NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- Product
- Readynas OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comkb.netgear.com
May 13, 2019Cross-site scripting in Application Manager in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via multiple application metadata fields: CVE-2018-12304 · Other software · Seagate · reported by MITREMedium 6.1
Cross-site scripting in Application Manager in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via multiple application metadata fields: Short Description, Publisher Name, Publisher Contact, or Website URL.
- Product
- NAS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
May 13, 2019Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via directory names.CVE-2018-12303 · Other software · Seagate · reported by MITREMedium 5.4
Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via directory names.
- Product
- NAS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
May 13, 2019Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to steal session tokens via cross-site scriptinCVE-2018-12302 · Other software · Seagate · reported by MITREMedium 6.1
Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to steal session tokens via cross-site scripting.
- Product
- NAS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
May 13, 2019Unvalidated URL in Download Manager in Seagate NAS OS version 4.3.15.1 allows attackers to access the loopback interface via a Download URL of 127.0.0.1 or locaCVE-2018-12301 · Other software · Seagate · reported by MITREHigh 7.5
Unvalidated URL in Download Manager in Seagate NAS OS version 4.3.15.1 allows attackers to access the loopback interface via a Download URL of 127.0.0.1 or localhost.
- Product
- NAS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
May 13, 2019Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL parCVE-2018-12300 · Other software · Seagate · reported by MITREMedium 6.1
Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL parameter.
- Product
- NAS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
May 13, 2019Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploaded file names.CVE-2018-12299 · Other software · Seagate · reported by MITREMedium 5.4
Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploaded file names.
- Product
- NAS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
May 13, 2019Directory Traversal in filebrowser in Seagate NAS OS 4.3.15.1 allows attackers to read files within the application's container via a URL path.CVE-2018-12298 · Other software · Seagate · reported by MITREHigh 7.5
Directory Traversal in filebrowser in Seagate NAS OS 4.3.15.1 allows attackers to read files within the application's container via a URL path.
- Product
- NAS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
May 13, 2019Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via URL path names.CVE-2018-12297 · Other software · Seagate · reported by MITREMedium 6.1
Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via URL path names.
- Product
- NAS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
May 13, 2019Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NASCVE-2018-12296 · Other software · Seagate · reported by MITREHigh 7.5
Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NAS without authentication via empty POST requests.
- Product
- NAS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
May 13, 2019SQL injection in folderViewSpecific.psp in Seagate NAS OS version 4.3.15.1 allows attackers to execute arbitrary SQL commands via the dirId URL parameter.CVE-2018-12295 · Other software · Seagate · reported by MITRECritical 9.8
SQL injection in folderViewSpecific.psp in Seagate NAS OS version 4.3.15.1 allows attackers to execute arbitrary SQL commands via the dirId URL parameter.
- Product
- NAS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.