Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Sep 30, 2020An issue was discovered in Ozeki NG SMS Gateway through 4.17.6.CVE-2020-14030 · Other software · Ozeki · reported by MITREHigh 7.2
An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. It stores SMS messages in .NET serialized format on the filesystem. By generating (and writing to the disk) malicious .NET serialized files, an attacker can trick the product into deserializing them, resulting in arbitrary code execution.
- Product
- Ozeki NG SMS Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2020An issue was discovered in Ozeki NG SMS Gateway through 4.17.6.CVE-2020-14031 · Other software · Ozeki · reported by MITREHigh 7.2
An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The outbox functionality of the TXT File module can be used to delete all/most files in a folder. Because the product usually runs as NT AUTHORITY\SYSTEM, the only files that will not be deleted are those currently being run by the system and/or files that have special security attributes (e.g., Windows Defender files).
- Product
- Ozeki NG SMS Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2020An issue was discovered in Ozeki NG SMS Gateway through 4.17.6.CVE-2020-14028 · Other software · Ozeki · reported by MITREHigh 7.2
An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. By leveraging a path traversal vulnerability in the Autoreply module's Script Name, an attacker may write to or overwrite arbitrary files, with arbitrary content, usually with NT AUTHORITY\SYSTEM privileges.
- Product
- Ozeki NG SMS Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2020An issue was discovered in Ozeki NG SMS Gateway through 4.17.6.CVE-2020-14027 · Other software · Ozeki · reported by MITREMedium 5.3
An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLE_LOCAL_INFILE, that can be leveraged by attackers to enable MySQL Load Data Local (rogue MySQL server) attacks.
- Product
- Ozeki NG SMS Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2020CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the Export Of Contacts feature in Ozeki NG SMS Gateway through 4.17.6 via a value that CVE-2020-14026 · Other software · Ozeki · reported by MITREHigh 8.8
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the Export Of Contacts feature in Ozeki NG SMS Gateway through 4.17.6 via a value that is mishandled in a CSV export.
- Product
- Ozeki NG SMS Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2020Ozeki NG SMS Gateway through 4.17.6 has multiple CSRF vulnerabilities.CVE-2020-14025 · Other software · Ozeki · reported by MITREHigh 8.8
Ozeki NG SMS Gateway through 4.17.6 has multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted changes such as installing new modules or changing a password.
- Product
- Ozeki NG SMS Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2020Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient field in the MailboCVE-2020-14024 · Other software · Ozeki · reported by MITREMedium 6.1
Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient field in the Mailbox feature, (2) OZFORM_GROUPNAME field in the Group configuration of addresses, (3) listname field in the Defining address lists configuration, or (4) any GET Parameter in the /default URL of the application.
- Product
- Ozeki NG SMS Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2020Ozeki NG SMS Gateway through 4.17.6 allows SSRF via SMS WCF or RSS To SMS.CVE-2020-14023 · Other software · Ozeki · reported by MITREMedium 4.9
Ozeki NG SMS Gateway through 4.17.6 allows SSRF via SMS WCF or RSS To SMS.
- Product
- Ozeki NG SMS Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2020Ozeki NG SMS Gateway 4.17.1 through 4.17.6 does not check the file type when bulk importing new contacts ("Import Contacts" functionality) from a file.CVE-2020-14022 · Other software · Ozeki · reported by MITREHigh 8.8
Ozeki NG SMS Gateway 4.17.1 through 4.17.6 does not check the file type when bulk importing new contacts ("Import Contacts" functionality) from a file. It is possible to upload an executable or .bat file that can be executed with the help of a functionality (E.g. the "Application Starter" module) within the application.
- Product
- Ozeki NG SMS Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2020An issue was discovered in Ozeki NG SMS Gateway through 4.17.6.CVE-2020-14029 · Other software · Ozeki · reported by MITREHigh 7.5
An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an XML External Entity attack that can be used to perform SSRF or read arbitrary local files.
- Product
- Ozeki NG SMS Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2020An issue was discovered in Ozeki NG SMS Gateway through 4.17.6.CVE-2020-14021 · Other software · Ozeki · reported by MITREMedium 4.9
An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The ASP.net SMS module can be used to read and validate the source code of ASP files. By altering the path, it can be made to read any file on the Operating System, usually with NT AUTHORITY\SYSTEM privileges.
- Product
- Ozeki NG SMS Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.