Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
56 results · page 1 of 2
Oct 13, 2026Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Security Center allows an authorized attacker to elevate CVE-2026-71347 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.4
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Security Center allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.CVE-2026-70212 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnailsCVE-2026-65422 · Other software · Genetec Inc. · reported by security@genetec.comMedium 6.5
A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails.
- Product
- Genetec Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Windows Security Center allows an authorized attacker to elevate privileges locally.CVE-2026-77899 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Security Center allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on tCVE-2026-19682 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comCritical 9.4
A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026An authenticated command injection vulnerability exists in Security Center related to file upload processing.CVE-2026-19681 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comCritical 9.4
An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database.CVE-2026-19680 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comHigh 7.1
A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a CVE-2026-19679 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comHigh 8.7
An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assiCVE-2026-19639 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comMedium 5.3
An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control.CVE-2026-19636 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comMedium 6
An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026A local privilege escalation vulnerability exists in Security Center.CVE-2026-19635 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comHigh 8.5
A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting CVE-2026-19631 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comMedium 6.9
A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single CVE-2026-19629 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comHigh 8.6
A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized cross-group user management.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026A command injection vulnerability exists in Tenable Security Center.CVE-2026-19628 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comHigh 8.6
A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026A remote code execution vulnerability exists in Tenable Security Center's report generation functionality.CVE-2026-19626 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comCritical 9.4
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution.CVE-2026-64881 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comHigh 8.7
The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enablCVE-2026-64880 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comHigh 7.1
Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharactCVE-2026-64879 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comCritical 9.4
A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privilCVE-2026-64878 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comCritical 9.4
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.CVE-2026-64877 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comCritical 9.4
An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attCVE-2026-55727 · Other software · Genetec Inc. · reported by security@genetec.comHigh 7.5
A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams.
- Product
- Genetec Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026A high security vulnerability affecting Security Center main server installations has been identified.CVE-2026-40619 · Other software · Genetec Inc. · reported by security@genetec.comHigh 7.8
A high security vulnerability affecting Security Center main server installations has been identified. It could allow an attacker with local OS privileges to the main server to access the Server Admin credentials. A third party hired by Genetec found the issue. There is currently no evidence of active exploitation. This vulnerability is associated with specific installation package builds rather than the product version identifier alone. Certain versions (including 5.10.4.0, 5.11.3.0, 5.12.2.0 and 5.13.3.0) were released with both vulnerable and remediated installation packages under the same version number. Consequently, version-based comparison alone is insufficient to determine exposure. Only installations performed using vulnerable builds are affected. Remediated builds can be distinguished using verified installation package hashes. For the complete list of fixed build hashes, refer to the security advisory section.
- Product
- Genetec Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026SQL Injection affecting the Access Manager role.CVE-2026-27768 · Other software · Genetec Inc. · reported by security@genetec.comMedium 6.6
SQL Injection affecting the Access Manager role.
- Product
- Genetec Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtechdocs.genetec.comtechdocs.genetec.com
Feb 23, 2026An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.CVE-2026-2698 · Other software · Tenable · reported by vulnreport@tenable.comMedium 5.7
An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter.CVE-2026-2697 · Other software · Tenable · reported by vulnreport@tenable.comLow 2.1
An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2026A Command Injection vulnerability exists where an authenticated, remote attacker could execute arbitrary code on the underlying server where Tenable Security CeCVE-2026-2630 · Other software · Tenable · reported by vulnreport@tenable.comHigh 7.4
A Command Injection vulnerability exists where an authenticated, remote attacker could execute arbitrary code on the underlying server where Tenable Security Center is hosted.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to thCVE-2025-43027 · Other software · Genetec Inc. · reported by security@genetec.comCritical 9.8
A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this issue internally. There is currently no evidence that this vulnerability has been exploited in the wild.
- Product
- Genetec Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresources.genetec.comressources.genetec.com
Oct 8, 2025In Tenable Security Center versions prior to 6.7.0, an improper access control vulnerability exists where an authenticated user could access areas outside of thCVE-2025-36636 · Other software · Tenable · reported by vulnreport@tenable.comMedium 4.3
In Tenable Security Center versions prior to 6.7.0, an improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025SQL Injection affecting the Archiver role.CVE-2025-2928 · Other software · Genetec Inc. · reported by security@genetec.comHigh 7.2
SQL Injection affecting the Archiver role.
- Product
- Genetec Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtechdocs.genetec.comtechdocs.genetec.com
Dec 9, 2024An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages seCVE-2024-12174 · Other software · Tenable · reported by vulnreport@tenable.comLow 2.7
An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages sent from Security Center via a rogue SMTP server.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024A high-severity vulnerability that can lead to arbitrary code execution on the system hosting the Web SDK role was found in the Genetec Security Center product CVE-2024-7059 · Other software · Genetec Inc. · reported by security@genetec.comHigh 8.9
A high-severity vulnerability that can lead to arbitrary code execution on the system hosting the Web SDK role was found in the Genetec Security Center product line.
- Product
- Genetec Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresources.genetec.comressources.genetec.com
Aug 28, 2024The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initiative! At the same tiCVE-2024-45346 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comHigh 8.8
The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initiative! At the same time, we also welcome more outstanding and professional security experts and security teams to join the Mi Security Center (MiSRC) to jointly ensure the safe access of millions of Xiaomi users worldwide Life.
- Product
- GetApps application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024Security Center Broker Information Disclosure VulnerabilityCVE-2024-38155 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Security Center Broker Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2024An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and lauCVE-2024-5759 · Other software · Tenable · reported by vulnreport@tenable.comMedium 5.4
An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without having the required privileges
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jun 12, 2024A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web applicatCVE-2024-1891 · Other software · Tenable · reported by vulnreport@tenable.comLow 3.5
A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web application scan result page.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Feb 14, 2024 An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify ReCVE-2024-1471 · Other software · Tenable · reported by vulnreport@tenable.comMedium 5.9
An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Repository parameters, which could lead to HTML redirection attacks.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Feb 14, 2024 A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify CVE-2024-1367 · Other software · Tenable · reported by vulnreport@tenable.comHigh 7.2
A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to the execution of arbitrary code on the Security Center host.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jun 26, 2023Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.This issue affects Tenable.Io: before Plugin Feed ID #202306261202 ; Nessus: beforeCVE-2023-2005 · Other software · Tenable · reported by vulnreport@tenable.comMedium 6.3
Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.This issue affects Tenable.Io: before Plugin Feed ID #202306261202 ; Nessus: before Plugin Feed ID #202306261202 ; Security Center: before Plugin Feed ID #202306261202 . This vulnerability could allow a malicious actor with sufficient permissions on a scan target to place a binary in a specific filesystem location, and abuse the impacted plugin in order to escalate privileges.
- Product
- Tenable.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Apr 5, 2023SQL Injection in the Hardware Inventory report of Security Center 5.11.2.CVE-2023-1522 · Other software · Genetec Inc. · reported by security@genetec.comHigh 8.8
SQL Injection in the Hardware Inventory report of Security Center 5.11.2.
- Product
- Genetec Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgenetec.comgenetec.com
Oct 11, 2022The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and professional security experCVE-2020-14131 · Other software · MI · reported by security@xiaomi.comCritical 9.8
The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and professional security experts and security teams to join the Mi Security Center (MiSRC) to jointly ensure the safe access of millions of Xiaomi users worldwide Life.
- Product
- Xiaomi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Jan 11, 2022Windows Security Center API Remote Code Execution VulnerabilityCVE-2022-21874 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Security Center API Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Sep 2, 2020Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack thCVE-2020-25045 · Other software · Kaspersky · reported by vulnerability@kaspersky.comHigh 7.8
Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges in the system.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.kaspersky.comsupport.kaspersky.com
Mar 12, 2020An elevation of privilege vulnerability exists when Windows Defender Security Center handles certain objects in memory.To exploit the vulnerability, an attackerCVE-2020-0763 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
An elevation of privilege vulnerability exists when Windows Defender Security Center handles certain objects in memory.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Windows Defender Security Center Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0762.
- Product
- Windows 10 Version 1909 for x64-based Systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Mar 12, 2020An elevation of privilege vulnerability exists when Windows Defender Security Center handles certain objects in memory.To exploit the vulnerability, an attackerCVE-2020-0762 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
An elevation of privilege vulnerability exists when Windows Defender Security Center handles certain objects in memory.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Windows Defender Security Center Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0763.
- Product
- Windows Server, version 1903 (Server Core installation)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 19, 2019Cross-Site Scripting vulnerability in Micro Focus Fortify Software Security Center Server, versions 17.2, 18.1, 18.2, has been identified in Micro Focus SoftwarCVE-2019-11649 · Other software · Micro Focus · reported by security@opentext.comMedium 5.4
Cross-Site Scripting vulnerability in Micro Focus Fortify Software Security Center Server, versions 17.2, 18.1, 18.2, has been identified in Micro Focus Software Security Center. The vulnerability could be exploited to execute JavaScript code in user’s browser. The vulnerability could be exploited to execute JavaScript code in user’s browser.
- Product
- Micro Focus Fortify Software Security Center Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsoftwaresupport.softwaregrp.comsoftwaresupport.softwaregrp.com
Dec 13, 2018A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote CVE-2018-7691 · Other software · Micro Focus · reported by security@opentext.comMedium 6.5
A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote Unauthorized Access
- Product
- Fortify Software Security Center (SSC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsoftwaresupport.softwaregrp.comexploit-db.com
Dec 13, 2018A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote CVE-2018-7690 · Other software · Micro Focus · reported by security@opentext.comMedium 6.5
A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote Unauthorized Access
- Product
- Fortify Software Security Center (SSC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsoftwaresupport.softwaregrp.comexploit-db.com
Jul 12, 2018An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated users to read arbitCVE-2018-12463 · Other software · Micro Focus · reported by security@opentext.comCritical 9.8
An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
- Product
- Fortify Software Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsoftwaresupport.softwaregrp.com
Feb 2, 2018XML External Entity (XXE) vulnerability in Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), versions 16.10, 16.CVE-2018-6486 · Other software · Micro Focus · reported by security@opentext.comHigh 7.3
XML External Entity (XXE) vulnerability in Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), versions 16.10, 16.20, 17.10. This vulnerability could be exploited to allow a XML External Entity (XXE) injection.
- Product
- Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsoftwaresupport.softwaregrp.com
Apr 12, 2014The Settings module in Websense Triton Unified Security Center 7.7.3 before Hotfix 31, Web Filter 7.7.3 before Hotfix 31, Web Security 7.7.3 before Hotfix 31, WCVE-2014-0347 · Other software · Websense · reported by cret@cert.orgLow 3.5
The Settings module in Websense Triton Unified Security Center 7.7.3 before Hotfix 31, Web Filter 7.7.3 before Hotfix 31, Web Security 7.7.3 before Hotfix 31, Web Security Gateway 7.7.3 before Hotfix 31, and Web Security Gateway Anywhere 7.7.3 before Hotfix 31 allows remote authenticated users to read cleartext passwords by replacing type="password" with type="text" in an INPUT element in the (1) Log Database or (2) User Directories component.
- Product
- Triton Unified Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgwebsense.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.