Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Sep 3, 2024SquaredUp DS for SCOM 6.2.1.11104 allows XSS.CVE-2024-45180 · Other software · Squaredup · reported by MITREMedium 5.4
SquaredUp DS for SCOM 6.2.1.11104 allows XSS.
- Product
- Squaredup DS For Scom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordscomsupport.squaredup.comsquaredup.com
Feb 23, 2023SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 1 of 2).CVE-2022-46785 · Other software · Squaredup · reported by MITREMedium 6.1
SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 1 of 2).
- Product
- Dashboard Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordscomsupport.squaredup.comscomsupport.squaredup.com
Feb 23, 2023SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows open redirection.CVE-2022-46784 · Other software · Squaredup · reported by MITREMedium 6.1
SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows open redirection. (The issue was originally found in 5.5.1 GA.)
- Product
- Dashboard Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordscomsupport.squaredup.comscomsupport.squaredup.com
Feb 23, 2023SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 2 of 2).CVE-2022-46786 · Other software · Squaredup · reported by MITREMedium 5.4
SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 2 of 2).
- Product
- Dashboard Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordscomsupport.squaredup.comsupport.squaredup.com
Dec 7, 2021A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script CVE-2021-40096 · Other software · Squaredup · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via modification of the authorisationUrl in some integration configurations.
- Product
- Squaredup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.squaredup.comsupport.squaredup.com
Dec 7, 2021An issue was discovered in SquaredUp for SCOM 5.2.1.6654.CVE-2021-40095 · Other software · Squaredup · reported by MITREMedium 4.9
An issue was discovered in SquaredUp for SCOM 5.2.1.6654. The Download Log feature in System / Maintenance was susceptible to a local file inclusion vulnerability (when processing remote input in the log files downloaded by an authenticated administrator user), leading to the ability to read arbitrary files on the server filesystems.
- Product
- Squaredup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.squaredup.comsupport.squaredup.com
Dec 7, 2021A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654.CVE-2021-40094 · Other software · Squaredup · reported by MITREMedium 5.4
A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. If successfully exploited, this vulnerability may allow attackers to inject malicious code into a user's device.
- Product
- Squaredup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.squaredup.comsupport.squaredup.com
Dec 7, 2021A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script CVE-2021-40093 · Other software · Squaredup · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via dashboard actions.
- Product
- Squaredup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.squaredup.comsupport.squaredup.com
Dec 7, 2021A cross-site scripting (XSS) vulnerability in Image Tile in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via an CVE-2021-40092 · Other software · Squaredup · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Image Tile in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via an SVG file.
- Product
- Squaredup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.squaredup.comsupport.squaredup.com
Dec 6, 2021An SSRF issue was discovered in SquaredUp for SCOM 5.2.1.6654.CVE-2021-40091 · Other software · Squaredup · reported by MITRECritical 9.8
An SSRF issue was discovered in SquaredUp for SCOM 5.2.1.6654.
- Product
- Squaredup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.squaredup.comsupport.squaredup.com
Feb 3, 2021SquaredUp allowed Stored XSS before version 4.6.0.CVE-2020-9390 · Other software · Squaredup · reported by MITREMedium 5.4
SquaredUp allowed Stored XSS before version 4.6.0. A user was able to create a dashboard that executed malicious content in iframe or by uploading an SVG that contained a script.
- Product
- Squaredup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordscomsupport.squaredup.comsupport.squaredup.com
Feb 3, 2021A username enumeration issue was discovered in SquaredUp before version 4.6.0.CVE-2020-9389 · Other software · Squaredup · reported by MITRELow 3.7
A username enumeration issue was discovered in SquaredUp before version 4.6.0. The login functionality was implemented in a way that would enable a malicious user to guess valid username due to a different response time from invalid usernames.
- Product
- Squaredup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.squaredup.comsupport.squaredup.com
Feb 3, 2021CSRF protection was not present in SquaredUp before version 4.6.0.CVE-2020-9388 · Other software · Squaredup · reported by MITREMedium 6.5
CSRF protection was not present in SquaredUp before version 4.6.0. A CSRF attack could have been possible by an administrator executing arbitrary code in a HTML dashboard tile via a crafted HTML page, or by uploading a malicious SVG payload into a dashboard.
- Product
- Squaredup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordscomsupport.squaredup.comsupport.squaredup.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.