Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Jul 2, 2024The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses.CVE-2023-41928 · Other software · Kiloview · reported by cert@ncsc.nlMedium 5.3
The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jul 2, 2024The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses.CVE-2023-41927 · Other software · Kiloview · reported by cert@ncsc.nlMedium 5.3
The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jul 2, 2024The webserver utilizes basic authentication for its user login to the configuration interface.CVE-2023-41926 · Other software · Kiloview · reported by cert@ncsc.nlHigh 8.8
The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jul 2, 2024The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords.CVE-2023-41923 · Other software · Kiloview · reported by cert@ncsc.nlHigh 7.2
The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jul 2, 2024A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered.CVE-2023-41922 · Other software · Kiloview · reported by cert@ncsc.nlHigh 7.2
A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered. This vulnerability allows for Stored XSS attacks to occur. Multiple areas within the administration interface of the webserver lack adequate input validation, resulting in multiple instances of Stored XSS vulnerabilities.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jul 2, 2024A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin CVE-2023-41921 · Other software · Kiloview · reported by cert@ncsc.nlCritical 9.8
A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uploading it to the system, thus achieving the modification of the target’s integrity to achieve an insecure state.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jul 2, 2024The vulnerability allows attackers access to the root account without having to authenticate.CVE-2023-41920 · Other software · Kiloview · reported by cert@ncsc.nlCritical 9.8
The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jul 2, 2024Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access.CVE-2023-41919 · Other software · Kiloview · reported by cert@ncsc.nlCritical 9.8
Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jul 2, 2024A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs.CVE-2023-41918 · Other software · Kiloview · reported by cert@ncsc.nlCritical 10
A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jul 2, 2024Inadequate input validation exposes the system to potential remote code execution (RCE) risks.CVE-2023-41917 · Other software · Kiloview · reported by cert@ncsc.nlCritical 10
Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Measurement feature, enabling unauthorized code execution.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.