Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
44 results
Sep 17, 2026Paella Player is a set of libraries to create a multi stream video player.CVE-2026-77615 · Other software · opencast · reported by GitHubHigh 8.7
Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Opencast is a free, open-source platform to support the management of educational audio and video content.CVE-2026-77614 · Other software · opencast · reported by GitHubHigh 8.8
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mh_default_org.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does not replace it when the victim logs in. An unauthenticated attacker can send a crafted link to a victim whose browser has no active Opencast session cookie, wait for the victim to authenticate, and then reuse the known identifier as the victim's authenticated session. This can expose the victim's data and actions and can produce full administrative account takeover when the victim is an administrator. This issue is fixed in versions 19.7 and 20.2.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settle a large debt position for a negligible asset cost.CVE-2026-4931 · Other software · Marginal · reported by cret@cert.orgHigh 8.6
Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settle a large debt position for a negligible asset cost.
- Product
- Marginal Smart Contract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2025Opencast is a free, open-source platform to support the management of educational audio and video content.CVE-2025-61906 · Other software · opencast · reported by GitHubLow 2.3
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, in some situations, Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for publishing, and thus possibly exposing internal media. This risk of this actually impacting someone is very low, though. This can only be triggered by users with write access to an event. They also have to use the editor, which is usually an action taken if they want to publish media and not something users would use on internal media they do not want to publish. Finally, they have to first click on "Save & Publish" before then selecting the "Save" option. Nevertheless, while very unlikely, this can happen. This issue is fixed in Opencast 17.8 and 18.2.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2025Opencast is a free, open-source platform to support the management of educational audio and video content.CVE-2025-61788 · Other software · opencast · reported by GitHubMedium 5.1
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, the paella would include and render some user inputs (metadata like title, description, etc.) unfiltered and unmodified. The vulnerability allows attackers to inject and malicious HTML and JavaScript in the player, which would then be executed in the browsers of users watching the prepared media. This can then be used to modify the site or to execute actions in the name of logged-in users. To inject malicious metadata, an attacker needs write access to the system. For example, the ability to upload media and modify metadata. This cannot be exploited by unauthenticated users. This issue is fixed in Opencast 17.8 and 18.2.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025Opencast is a free, open-source platform to support the management of educational audio and video content.CVE-2025-55202 · Other software · opencast · reported by GitHubLow 2.7
Opencast is a free, open-source platform to support the management of educational audio and video content. In version 18.0 and versions before 17.7, the protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases. The path is checked without checking for the file separator. This could allow attackers access to files within another folder which starts with the same path. This issue has been fixed in versions 17.7 and 18.1. To mitigate this issue, check for folders that start with the same path as the ui-config folder.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2025Opencast is a free, open-source platform to support the management of educational audio and video content.CVE-2025-54380 · Other software · opencast · reported by GitHubMedium 6.5
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2024Opencast is free and open source software for automated video capture and distribution.CVE-2024-52797 · Other software · opencast · reported by GitHubMedium 6.5
Opencast is free and open source software for automated video capture and distribution. First noticed in Opencast 13 and 14, Opencast's Elasticsearch integration may generate syntactically invalid Elasticsearch queries in relation to previously acceptable search queries. From Opencast version 11.4 and newer, Elasticsearch queries are retried a configurable number of times in the case of error to handle temporary losses of connection to Elasticsearch. These invalid queries would fail, causing the retry mechanism to begin requerying with the same syntactically invalid query immediately, in an infinite loop. This causes a massive increase in log size which can in some cases cause a denial of service due to disk exhaustion. Opencast 13.10 and Opencast 14.3 contain patches which address the base issue, with Opencast 16.7 containing changes which harmonize the search behaviour between the admin UI and external API. Users are strongly recommended to upgrade as soon as possible if running versions prior to 13.10 or 14.3. While the relevant endpoints require (by default) `ROLE_ADMIN` or `ROLE_API_SERIES_VIEW`, the problem queries are otherwise innocuous. This issue could be easily triggere
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2024Insecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co.CVE-2024-33435 · Other software · guangzhou_yingshi_electronic_technology · reported by MITRECritical 9.8
Insecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co. Ncast Yingshi high-definition intelligent recording and playback system 2007-2017 allows a remote attacker to execute arbitrary code via the /manage/IPSetup.php backend function
- Product
- ncast_yingshi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2024Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server.CVE-2024-31450 · Other software · owncast · reported by GitHubLow 2.7
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3.
- Product
- owncast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server.CVE-2024-29026 · Other software · owncast · reported by GitHubHigh 8.2
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit 9215d9ba0f29d62201d3feea9e77dcd274581624 fixes this issue.
- Product
- owncast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic.CVE-2024-0305 · Other software · Guangzhou Yingke Electronic Technology · reported by VulDBMedium 5.3
A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249872.
- Product
- Ncast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6.CVE-2018-16153 · Other software · Apereo · reported by MITREHigh 7.5
An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6. It sends system digest credentials during authentication attempts to arbitrary external services in some situations.
- Product
- Opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opencast.orggithub.com
Nov 27, 2023An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth funcCVE-2023-46480 · Other software · owncast_project · reported by MITRECritical 9.8
An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function.
- Product
- owncast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2023An invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior.CVE-2023-25736 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
An invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior. This vulnerability affects Firefox < 110.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 9, 2023Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.CVE-2023-3188 · Other software · owncast · reported by security@huntr.devMedium 6.5
Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.
- Product
- owncast/owncast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior.CVE-2023-25737 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 29, 2022SQL Injection in GitHub repository owncast/owncast prior to 0.0.13.CVE-2022-3751 · Other software · owncast · reported by security@huntr.devCritical 9.8
SQL Injection in GitHub repository owncast/owncast prior to 0.0.13.
- Product
- owncast/owncast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2022Opencast is a free, open-source platform to support the management of educational audio and video content.CVE-2022-41965 · Other software · opencast · reported by GitHubMedium 5.7
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022Opencast is a free and open source solution for automated video capture and distribution at scale.CVE-2022-29237 · Other software · opencast · reported by GitHubMedium 5.4
Opencast is a free and open source solution for automated video capture and distribution at scale. Prior to Opencast 10.14 and 11.7, users could pass along URLs for files belonging to organizations other than the user's own, which Opencast would then import into the current organization, bypassing organizational barriers. Attackers must have full access to Opencast's ingest REST interface, and also know internal links to resources in another organization of the same Opencast cluster. Users who do not run a multi-tenant cluster are not affected by this issue. This issue is fixed in Opencast 10.14 and 11.7.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021Opencast is an Open Source Lecture Capture & Video Management for Education.CVE-2021-43821 · Other software · opencast · reported by GitHubCritical 9.9
Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and making them available via the web interface. Before Opencast 9.10 and 10.6, Opencast would open and include local files during ingests. Attackers could exploit this to include most local files the process has read access to, extracting secrets from the host machine. An attacker would need to have the privileges required to add new media to exploit this. But these are often widely given. The issue has been fixed in Opencast 10.6 and 11.0. You can mitigate this issue by narrowing down the read access Opencast has to files on the file system using UNIX permissions or mandatory access control systems like SELinux. This cannot prevent access to files Opencast needs to read though and we highly recommend updating.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021Owncast is an open source, self-hosted live video streaming and chat server.CVE-2021-39183 · Other software · owncast · reported by GitHubHigh 8.2
Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-src is required to be set to blob for the video player.
- Product
- owncast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021Opencast is an Open Source Lecture Capture & Video Management for Education.CVE-2021-43807 · Other software · opencast · reported by GitHubHigh 7.5
Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast versions prior to 9.10 allow HTTP method spoofing, allowing to change the assumed HTTP method via URL parameter. This allows attackers to turn HTTP GET requests into PUT requests or an HTTP form to send DELETE requests. This bypasses restrictions otherwise put on these types of requests and aids in cross-site request forgery (CSRF) attacks, which would otherwise not be possible. The vulnerability allows attackers to craft links or forms which may change the server state. This issue is fixed in Opencast 9.10 and 10.0. You can mitigate the problem by setting the `SameSite=Strict` attribute for your cookies. If this is a viable option for you depends on your integrations. We strongly recommend updating in any case.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2021Opencast is a free and open source solution for automated video capture and distribution.CVE-2021-32623 · Other software · opencast · reported by GitHubHigh 8.1
Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laughs attack, which allows an attacker to easily execute a (seemingly permanent) denial of service attack, essentially taking down Opencast using a single HTTP request. To exploit this, users need to have ingest privileges, limiting the group of potential attackers The problem has been fixed in Opencast 9.6. There is no known workaround for this issue.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2021Opencast is a free, open-source platform to support the management of educational audio and video content.CVE-2021-21318 · Other software · opencast · reported by GitHubMedium 5.4
Opencast is a free, open-source platform to support the management of educational audio and video content. In Opencast before version 9.2 there is a vulnerability in which publishing an episode with strict access rules will overwrite the currently set series access. This allows for an easy denial of access for all users without superuser privileges, effectively hiding the series. Access to series and series metadata on the search service (shown in media module and player) depends on the events published which are part of the series. Publishing an event will automatically publish a series and update access to it. Removing an event or republishing the event should do the same. Affected versions of Opencast may not update the series access or remove a published series if an event is being removed. On removal of an episode, this may lead to an access control list for series metadata with broader access rules than the merged access rules of all remaining events, or the series metadata still being available although all episodes of that series have been removed. This problem is fixed in Opencast 9.2.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests.CVE-2020-26234 · Other software · opencast · reported by GitHubMedium 4.8
Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. This problem is fixed in Opencast 7.9 and Opencast 8.8 Please be aware that fixing the problem means that Opencast will not simply accept any self-signed certificates any longer without properly importing them. If you need those, please make sure to import them into the Java key store. Better yet, get a valid certificate.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2020In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN.CVE-2020-5231 · Other software · opencast · reported by GitHubMedium 4.8
In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation. This issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2020In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if tCVE-2020-5206 · Other software · opencast · reported by GitHubHigh 8.7
In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2020Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used.CVE-2020-5230 · Other software · opencast · reported by GitHubHigh 7.7
Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for operation and security since such identifiers are sometimes used for file system operations which may lead to an attacker being able to escape working directories and write files to other locations. In addition, Opencast's Id.toString(…) vs Id.compact(…) behavior, the latter trying to mitigate some of the file system problems, can cause errors due to identifier mismatch since an identifier may unintentionally change. This issue is fixed in Opencast 7.6 and 8.1.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2020Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key.CVE-2020-5222 · Other software · opencast · reported by GitHubMedium 6.8
Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. This problem is fixed in Opencast 7.6 and Opencast 8.1
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2020Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm.CVE-2020-5229 · Other software · opencast · reported by GitHubHigh 7.7
Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the username instead of a random salt, causing hashes for users with the same username and password to collide which is problematic especially for popular users like the default `admin` user. This essentially means that for an attacker, it might be feasible to reconstruct a user's password given access to these hashes. Note that attackers needing access to the hashes means that they must gain access to the database in which these are stored first to be able to start cracking the passwords. The problem is addressed in Opencast 8.1 which now uses the modern and much stronger bcrypt password hashing algorithm for storing passwords. Note, that old hashes remain MD5 until the password is updated. For a list of users whose password hashes are stored using MD5, take a look at the `/user-utils/users/md5.json` REST endpoint.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2020Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH.CVE-2020-5228 · Other software · opencast · reported by GitHubHigh 7.6
Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to users unknowingly handing out public access to events without their knowledge. The problem has been addressed in Opencast 7.6 and 8.1 where the OAI-PMH endpoint is configured to require users with `ROLE_ADMIN` by default. In addition to this, Opencast 9 removes the OAI-PMH publication from the default workflow, making the publication a conscious decision users have to make by updating their workflows.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2017In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access contCVE-2017-1000221 · Other software · Apereo · reported by MITREMedium 6.5
In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need to match part of the user name used for the access restriction. For example, a user with the role ROLE_USER will have access to recordings published only for ROLE_USER_X.
- Product
- Opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopencast.jira.comopencast.jira.com
Nov 17, 2017Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execCVE-2017-1000217 · Other software · Opencast · reported by MITREHigh 8.8
Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0.
- Product
- Opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgroups.google.comgroups.google.com
Aug 18, 2017In all Qualcomm products with Android releases from CAF using the Linux kernel, due to a type downcast, a value may improperly pass validation and cause an out CVE-2017-8260 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
In all Qualcomm products with Android releases from CAF using the Linux kernel, due to a type downcast, a value may improperly pass validation and cause an out of bounds write later.
- Product
- All Qualcomm products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
May 4, 2010Cross-site scripting (XSS) vulnerability in carga_foto_al.php in Siestta 2.0, when register_globals is enabled, allows remote attackers to inject arbitrary web CVE-2010-1711 · Other software · Ramoncastro · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in carga_foto_al.php in Siestta 2.0, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the usuario parameter.
- Product
- Siestta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
May 4, 2010Directory traversal vulnerability in login.php in Siestta 2.0, when register_globals is enabled, allows remote attackers to include and execute arbitrary local CVE-2010-1710 · Other software · Ramoncastro · reported by MITREMedium 6.8
Directory traversal vulnerability in login.php in Siestta 2.0, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the idioma parameter.
- Product
- Siestta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Feb 4, 2010The HTTP Authentication implementation in Geo++ GNCASTER 1.4.0.7 and earlier uses the same nonce for all authentication, which allows remote attackers to hijackCVE-2010-0554 · Other software · Geopp · reported by MITREHigh 7.5
The HTTP Authentication implementation in Geo++ GNCASTER 1.4.0.7 and earlier uses the same nonce for all authentication, which allows remote attackers to hijack web sessions or bypass authentication via a replay attack.
- Product
- Geo++ Gncaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2010Geo++ GNCASTER 1.4.0.7 and earlier allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a CVE-2010-0553 · Other software · Geopp · reported by MITREMedium 6.5
Geo++ GNCASTER 1.4.0.7 and earlier allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a long NMEA data sentence.
- Product
- Geo++ Gncaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2010Geo++ GNCASTER 1.4.0.7 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via multiple reqCVE-2010-0552 · Other software · Geopp · reported by MITREHigh 7.5
Geo++ GNCASTER 1.4.0.7 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via multiple requests for a non-existent file using a long URI.
- Product
- Geo++ Gncaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2010HTTP authentication implementation in Geo++ GNCASTER 1.4.0.7 and earlier allows remote attackers to read authentication headers of other users via a large requeCVE-2010-0551 · Other software · Geopp · reported by MITREMedium 5
HTTP authentication implementation in Geo++ GNCASTER 1.4.0.7 and earlier allows remote attackers to read authentication headers of other users via a large request with an incorrect authentication attempt, which includes sensitive memory in the response. NOTE: this is referred to as a "memory leak" by some sources, but is better characterized as "memory disclosure."
- Product
- Geo++ Gncaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2010admin.htm in Geo++ GNCASTER 1.4.0.7 and earlier does not properly enforce HTTP Digest Authentication, which allows remote authenticated users to use HTTP Basic CVE-2010-0550 · Other software · Geopp · reported by MITREMedium 4
admin.htm in Geo++ GNCASTER 1.4.0.7 and earlier does not properly enforce HTTP Digest Authentication, which allows remote authenticated users to use HTTP Basic Authentication, bypassing intended server policy.
- Product
- Geo++ Gncaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2008Buffer overflow in an ActiveX control in ccpm_0237.dll for StreamAudio ChainCast ProxyManager allows remote attackers to execute arbitrary code via a long URL aCVE-2008-0248 · Other software · Streamaudio · reported by MITREHigh 9.3
Buffer overflow in an ActiveX control in ccpm_0237.dll for StreamAudio ChainCast ProxyManager allows remote attackers to execute arbitrary code via a long URL argument to the InternalTuneIn method.
- Product
- Chaincast Proxymanager Activex Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.grok.org.uksecunia.com
Aug 13, 2007PHP remote file inclusion vulnerability in admin/addons/archive/archive.php in Ncaster 1.7.2 allows remote attackers to execute arbitrary PHP code via a URL in CVE-2007-4320 · Other software · Ncaster · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in admin/addons/archive/archive.php in Ncaster 1.7.2 allows remote attackers to execute arbitrary PHP code via a URL in the adminfolder parameter.
- Product
- Ncaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.