Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Jan 3, 2022An information exposure issue has been discovered in Opmantek Open-AudIT 4.2.0.CVE-2021-44674 · Other software · Opmantek · reported by MITREMedium 6.5
An information exposure issue has been discovered in Opmantek Open-AudIT 4.2.0. The vulnerability allows an authenticated attacker to read file outside of the restricted directory.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.opmantek.comgithub.com
Dec 22, 2021An issue was discovered in Opmantek Open-AudIT after 3.5.0.CVE-2021-40612 · Other software · Opmantek · reported by MITRECritical 9.8
An issue was discovered in Opmantek Open-AudIT after 3.5.0. Without authentication, a vulnerability in code_igniter/application/controllers/util.php allows an attacker perform command execution without echoes.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.opmantek.comgithub.com
Dec 20, 2021Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability.CVE-2021-44916 · Other software · Opmantek · reported by MITREMedium 6.1
Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad value is passed to the routine via a URL, malicious JavaScript code can be executed in the victim's browser.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcommunity.opmantek.com
Feb 5, 2021Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS).CVE-2021-3333 · Other software · Opmantek · reported by MITREMedium 6.1
Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS). When outputting SQL statements for debugging, a maliciously crafted query can trigger an XSS attack. This attack only succeeds if the user is already logged in to Open-AudIT before they click the malicious link.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.opmantek.comcommunity.opmantek.com
Jan 20, 2021Within the Open-AudIT up to version 3.5.3 application, the web interface hides SSH secrets, Windows passwords, and SNMP strings from users using HTML 'password CVE-2021-3130 · Other software · Opmantek · reported by MITREMedium 5.9
Within the Open-AudIT up to version 3.5.3 application, the web interface hides SSH secrets, Windows passwords, and SNMP strings from users using HTML 'password field' obfuscation. By using Developer tools or similar, it is possible to change the obfuscation so that the credentials are visible.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopmantek.comraw.githubusercontent.com
Apr 29, 2020An issue was discovered in Open-AudIT 3.2.2.CVE-2020-11943 · Other software · Opmantek · reported by MITREHigh 8.8
An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.opmantek.comcoresecurity.com
Apr 29, 2020An issue was discovered in Open-AudIT 3.2.2.CVE-2020-11942 · Other software · Opmantek · reported by MITRECritical 9.8
An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.opmantek.comcoresecurity.com
Apr 28, 2020Open-AudIT 3.3.0 allows an XSS attack after login.CVE-2020-12261 · Other software · Opmantek · reported by MITREMedium 5.4
Open-AudIT 3.3.0 allows an XSS attack after login.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcommunity.opmantek.com
Apr 28, 2020An issue was discovered in Open-AudIT 3.3.1.CVE-2020-12078 · Other software · Opmantek · reported by MITREHigh 8.8
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in the discoveries_helper.php file (inside the all_ip_list function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgist.github.com
Apr 27, 2020An issue was discovered in Open-AudIT 3.2.2.CVE-2020-11941 · Other software · Opmantek · reported by MITREHigh 8.8
An issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcommunity.opmantek.com
Sep 13, 2019The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field.CVE-2019-16293 · Other software · Opmantek · reported by MITREHigh 8.8
The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.opmantek.comcommunity.opmantek.com
Sep 19, 2018Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbitrary web script viaCVE-2018-16607 · Other software · Opmantek · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbitrary web script via the Orgs name field.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comdocs.google.com
Jul 25, 2018Cross-site scripting (XSS) vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web script or HTML via theCVE-2018-14493 · Other software · Opmantek · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the group name.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comexploit-db.com
Jul 6, 2018Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary weCVE-2018-11124 · Other software · Opmantek · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribute.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comexploit-db.com
May 9, 2018Cross-site scripting (XSS) vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a coCVE-2018-10314 · Other software · Opmantek · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the action parameter in the Discover -> Audit Scripts -> List Scripts -> Download section.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comexploit-db.com
Apr 19, 2018Open-AudIT before 2.2 has CSV Injection.CVE-2018-9137 · Other software · Open-audit · reported by MITREMedium 6.8
Open-AudIT before 2.2 has CSV Injection.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.opmantek.comexploit-db.com
Apr 12, 2018Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name of aCVE-2018-9155 · Other software · Open-audit · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the Admin->Logs section (with a logs?logs.type= URI) and the Manage->Attributes section (via the "Name (display)" field to the attributes/create URI).
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comexploit-db.com
Mar 26, 2018An issue was discovered in Open-AudIT Professional 2.1.CVE-2018-8937 · Other software · Open-audit · reported by MITREMedium 6.1
An issue was discovered in Open-AudIT Professional 2.1. It is possible to inject a malicious payload in the redirect_url parameter to the /login URI to trigger an open redirect. A "data:text/html;base64," payload can be used with JavaScript code.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnileshsapariya.blogspot.aenileshsapariya.blogspot.ae
Mar 25, 2018Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the credentials URI.CVE-2018-8979 · Other software · Open-audit · reported by MITREHigh 8.8
Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the credentials URI.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnileshsapariya.blogspot.aeexploit-db.com
Mar 25, 2018Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI.CVE-2018-8978 · Other software · Open-audit · reported by MITREMedium 5.4
Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnileshsapariya.blogspot.aenileshsapariya.blogspot.ae
Mar 22, 2018Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.CVE-2018-8903 · Other software · Open-audit · reported by MITREMedium 5.4
Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.
- Product
- Open-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnileshsapariya.blogspot.aeexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.