Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
Jun 12, 2025The Media Server’s authorization tokens have a poor quality of randomness.CVE-2025-49198 · Other software · SICK AG · reported by psirt@sick.deLow 3.1
The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by computing plausible tokens.
- Product
- SICK Media Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user account.CVE-2025-49197 · Other software · SICK AG · reported by psirt@sick.deMedium 6.5
The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user account.
- Product
- SICK Media Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the CVE-2025-49195 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server.
- Product
- SICK Media Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels.CVE-2025-49194 · Other software · SICK AG · reported by psirt@sick.deHigh 7.5
The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels. If an attacker were to intercept traffic between a client and this server, the credentials would be exposed.
- Product
- SICK Media Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025The HttpOnlyflag of the session cookie \"@@\" is set to false.CVE-2025-49189 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
The HttpOnlyflag of the session cookie \"@@\" is set to false. Since this flag helps preventing access to cookies via client-side scripts, setting the flag to false can lead to a higher possibility of Cross-Side-Scripting attacks which target the stored cookies.
- Product
- SICK Media Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver.CVE-2025-49183 · Other software · SICK AG · reported by psirt@sick.deHigh 7.5
All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.
- Product
- SICK Media Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the apCVE-2025-49182 · Other software · SICK AG · reported by psirt@sick.deHigh 7.5
Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the application.
- Product
- SICK Media Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET requests to gather sensitive information.CVE-2025-49181 · Other software · SICK AG · reported by psirt@sick.deHigh 8.6
Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET requests to gather sensitive information. An attacker could also send HTTP POST requests to modify the log files’ root path as well as the TCP ports the service is running on, leading to a Denial of Service attack.
- Product
- SICK Media Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.