Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
May 27, 2024RhinOS 3.0-1190 is vulnerable to an XSS via the "tamper" parameter in /admin/lib/phpthumb/phpthumb.php.CVE-2024-5409 · Other software · SaltOS · reported by cve-coordination@incibe.esHigh 7.1
RhinOS 3.0-1190 is vulnerable to an XSS via the "tamper" parameter in /admin/lib/phpthumb/phpthumb.php. An attacker could create a malicious URL and send it to a victim to obtain their session details.
- Product
- RhinOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2024Vulnerability in RhinOS 3.0-1190 consisting of an XSS through the "search" parameter of /portal/search.htm.CVE-2024-5408 · Other software · SaltOS · reported by cve-coordination@incibe.esHigh 7.1
Vulnerability in RhinOS 3.0-1190 consisting of an XSS through the "search" parameter of /portal/search.htm. This vulnerability could allow a remote attacker to steal details of a victim's user session by submitting a specially crafted URL.
- Product
- RhinOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2024A vulnerability in RhinOS 3.0-1190 could allow PHP code injection through the "search" parameter in /portal/search.htm.CVE-2024-5407 · Other software · SaltOS · reported by cve-coordination@incibe.esCritical 10
A vulnerability in RhinOS 3.0-1190 could allow PHP code injection through the "search" parameter in /portal/search.htm. This vulnerability could allow a remote attacker to perform a reverse shell on the remote system, compromising the entire infrastructure.
- Product
- RhinOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2019An issue was discovered in SALTO ProAccess SPACE 5.4.3.0.CVE-2019-19459 · Other software · Saltosystem · reported by MITRECritical 9.8
An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. An attacker can write arbitrary content to arbitrary files, as demonstrated by CVE-2019-19458 files under the web root, or .bat files that will be used with auto start. This allows an attacker to execute arbitrary commands on the server.
- Product
- Proaccess Space
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsec-consult.com
Dec 3, 2019SALTO ProAccess SPACE 5.4.3.0 allows Directory Traversal in the Data Export feature.CVE-2019-19458 · Other software · Saltosystem · reported by MITREHigh 8.6
SALTO ProAccess SPACE 5.4.3.0 allows Directory Traversal in the Data Export feature.
- Product
- Proaccess Space
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsec-consult.com
Dec 3, 2019SALTO ProAccess SPACE 5.4.3.0 allows XSS.CVE-2019-19457 · Other software · Saltosystem · reported by MITREMedium 5.4
SALTO ProAccess SPACE 5.4.3.0 allows XSS.
- Product
- Proaccess Space
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsec-consult.com
Dec 3, 2019An issue was discovered in SALTO ProAccess SPACE 5.4.3.0.CVE-2019-19460 · Other software · Saltosystem · reported by MITREMedium 5.5
An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. The product's webserver runs as a Windows service with local SYSTEM permissions by default. This is against the principle of least privilege. An attacker who is able to exploit CVE-2019-19458 or CVE-2019-19459 is basically able to write to every single path on the file system, because the webserver is running with the highest privileges available.
- Product
- Proaccess Space
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsec-consult.com
Mar 21, 2019SaltOS 3.1 r8126 contains a database download vulnerability.CVE-2018-18762 · Other software · Saltos · reported by MITREMedium 6.5
SaltOS 3.1 r8126 contains a database download vulnerability.
- Product
- Saltos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Nov 16, 2018SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=[SQL] SQL Injection.CVE-2018-18763 · Other software · Saltos · reported by MITRECritical 9.8
SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=[SQL] SQL Injection.
- Product
- Saltos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Nov 16, 2018SaltOS 3.1 r8126 allows action=login&querystring=&user=[SQL] SQL Injection.CVE-2018-18761 · Other software · Saltos · reported by MITRECritical 9.8
SaltOS 3.1 r8126 allows action=login&querystring=&user=[SQL] SQL Injection.
- Product
- Saltos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Nov 16, 2018RhinOS 3.0 build 1190 allows CSRF.CVE-2018-18760 · Other software · Saltos · reported by MITREMedium 6.5
RhinOS 3.0 build 1190 allows CSRF.
- Product
- Rhinos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.