Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
82 results · page 1 of 2
Mar 22, 2026NetNumber Titan Master 7.9.1 contains a path traversal vulnerability in the drp endpoint that allows authenticated users to download arbitrary files by injectinCVE-2019-25610 · Other software · Netnumber · reported by VulnCheckHigh 7.1
NetNumber Titan Master 7.9.1 contains a path traversal vulnerability in the drp endpoint that allows authenticated users to download arbitrary files by injecting directory traversal sequences. Attackers can manipulate the path parameter with base64-encoded payloads containing ../ sequences to bypass authorization and retrieve sensitive system files like /etc/shadow.
- Product
- NetNumber Titan ENUM/DNS/NP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comnetnumber.com
Dec 15, 2025Ateme TITAN File 3.9.12.4 contains an authenticated server-side request forgery vulnerability in the job callback URL parameter that allows attackers to bypass CVE-2023-53893 · Other software · Ateme · reported by VulnCheckMedium 5.3
Ateme TITAN File 3.9.12.4 contains an authenticated server-side request forgery vulnerability in the job callback URL parameter that allows attackers to bypass network restrictions. Attackers can exploit the unvalidated parameter to initiate file, service, and network enumeration by forcing the application to make HTTP, DNS, or file requests to arbitrary destinations.
- Product
- TITAN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordateme.comexploit-db.com
Sep 30, 2025TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality.CVE-2025-56676 · Other software · Titansystems · reported by MITREMedium 5.4
TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain unauthorized access to any user account by exploiting the password reset mechanism. The vulnerability occurs because the reset token is not correctly bound to the requesting account and is accepted for other user emails during login, enabling privilege escalation and information disclosure.
- Product
- Zender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netdarklotus.medium.com
Aug 21, 2025An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14.CVE-2024-45438 · Other software · reported by MITRECritical 9.1
An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTitan interface allows unauthenticated users to trigger account-level actions using a crafted GET request. Notably, when a non-existent email address is provided as part of the email parameter, SpamTitan will automatically create a user record and associate quarantine settings with it - all without requiring authentication.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.titanhq.comseclists.org
Nov 1, 2024Titan Anti-spam & Security: Missing AuthorizationCVE-2024-38777 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CreativeMotion Titan Anti-spam & Security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Titan Anti-spam & Security: from n/a through 7.3.6.
- Product
- Titan Anti-spam & Security
- Affected
- up to 7.3.6
- What to do
- Affects up to 7.3.6. Update Titan Anti-spam & Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2024Titan SFTP and Titan MFT Server 2.0.25.2426 and earlier have a vulnerability a vulnerability where sensitive information, including passwords, is exposed in cleCVE-2024-44685 · Other software · southrivertech · reported by MITREMedium 5
Titan SFTP and Titan MFT Server 2.0.25.2426 and earlier have a vulnerability a vulnerability where sensitive information, including passwords, is exposed in clear text within the JSON response when configuring SMTP settings via the Web UI.
- Product
- titan_sftp_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhelpdesk.southrivertech.com
Oct 16, 2023Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive CVE-2023-45690 · Other software · South River Technologies · reported by cve@rapid7.comMedium 4.9
Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem
- Product
- Titan MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpdesk.southrivertech.comrapid7.com
Oct 16, 2023Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker with admiCVE-2023-45689 · Other software · South River Technologies · reported by cve@rapid7.comMedium 6.5
Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker with administrative privileges to read any file on the filesystem via path traversal
- Product
- Titan MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpdesk.southrivertech.comrapid7.com
Oct 16, 2023Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of anCVE-2023-45688 · Other software · South River Technologies · reported by cve@rapid7.comMedium 4.3
Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of an arbitrary file on the filesystem using path traversal in the ftp "SIZE" command
- Product
- Titan MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpdesk.southrivertech.comrapid7.com
Oct 16, 2023A session fixation vulnerability in South River Technologies' Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the server's auCVE-2023-45687 · Other software · South River Technologies · reported by cve@rapid7.comHigh 8.8
A session fixation vulnerability in South River Technologies' Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the server's authentication if they can trick an administrator into authorizating a session id of their choosing
- Product
- Titan MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpdesk.southrivertech.comrapid7.com
Oct 16, 2023Insufficient path validation when writing a file via WebDAV in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacCVE-2023-45686 · Other software · South River Technologies · reported by cve@rapid7.comHigh 7.2
Insufficient path validation when writing a file via WebDAV in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal
- Product
- Titan MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpdesk.southrivertech.comrapid7.com
Oct 16, 2023Insufficient path validation when extracting a zip archive in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authentiCVE-2023-45685 · Other software · South River Technologies · reported by cve@rapid7.comCritical 9.1
Insufficient path validation when extracting a zip archive in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal
- Product
- Titan MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpdesk.southrivertech.comrapid7.com
Aug 22, 2023There is an open redirect vulnerability in Titan FTP server 19.0 and below.CVE-2022-44215 · Other software · Southrivertech · reported by MITREMedium 6.1
There is an open redirect vulnerability in Titan FTP server 19.0 and below. Users are redirected to any target URL.
- Product
- Titan FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jun 2, 2023An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative actions by sending requestCVE-2023-27745 · Other software · Southrivertech · reported by MITREHigh 8.8
An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative actions by sending requests to the user server.
- Product
- Titan FTP Server Nextgen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsouthrivertech.comwhiteoaksecurity.com
Jun 2, 2023An issue was discovered in South River Technologies TitanFTP NextGen server that allows for a vertical privilege escalation leading to remote code execution.CVE-2023-27744 · Other software · Southrivertech · reported by MITREHigh 7.8
An issue was discovered in South River Technologies TitanFTP NextGen server that allows for a vertical privilege escalation leading to remote code execution.
- Product
- Titan FTP Server Nextgen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsouthrivertech.comwhiteoaksecurity.com
Feb 14, 2023An issue was discovered in TitanFTP through 1.94.1205.CVE-2023-22629 · Other software · Southrivertech · reported by MITREHigh 8.8
An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the newPath parameter. An authenticated attacker can upload any file and then move it anywhere on the server's filesystem.
- Product
- Titan FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comf20.be
Oct 17, 2022An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page.CVE-2022-40055 · Other software · Gxgroup · reported by MITRECritical 9.8
An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page.
- Product
- Gpon ONT Titanium 2122a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.alphathreat.inblog.alphathreat.in
Sep 16, 2022Titan Anti-spam & Security: Does not properly checks HTTP headers in order to validate the origin IP addressCVE-2022-2877 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
- Product
- Titan Anti-spam & Security
- Fixed in
- 7.3.1
- What to do
- Update Titan Anti-spam & Security to 7.3.1 or newer.
Aug 25, 2022Key reuse in GoSecure Titan Inbox Detection & Response (IDR) through 2022-04-05 leads to remote code execution.CVE-2022-28747 · Other software · Gosecure · reported by MITRECritical 9.8
Key reuse in GoSecure Titan Inbox Detection & Response (IDR) through 2022-04-05 leads to remote code execution. To exploit this vulnerability, an attacker must craft and sign a serialized payload.
- Product
- Titan Inbox Detection & Response
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD records3.us-west-2.amazonaws.comgosecure.net
Jun 19, 2022An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050.CVE-2022-34006 · Other software · Southrivertech · reported by MITREHigh 7.8
An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. When installing, Microsoft SQL Express 2019 installs by default with an SQL instance running as SYSTEM with BUILTIN\Users as sysadmin, thus enabling unprivileged Windows users to execute commands locally as NT AUTHORITY\SYSTEM, aka NX-I674 (sub-issue 2). NOTE: as of 2022-06-21, the 1.2.1050 release corrects this vulnerability in a new installation, but not in an upgrade installation.
- Product
- Titan FTP Server Nextgen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsouthrivertech.comsouthrivertech.com
Jun 19, 2022An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050.CVE-2022-34005 · Other software · Southrivertech · reported by MITRECritical 9.8
An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. There is Remote Code Execution due to a hardcoded password for the sa account on the Microsoft SQL Express 2019 instance installed by default during TitanFTP NextGen installation, aka NX-I674 (sub-issue 1). NOTE: as of 2022-06-21, the 1.2.1050 release corrects this vulnerability in a new installation, but not in an upgrade installation.
- Product
- Titan FTP Server Nextgen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsouthrivertech.comsouthrivertech.com
Jun 15, 2022In param_find_digests_internal and related functions of the Titan-M source, there is a possible out of bounds write due to an incorrect bounds check.CVE-2022-20233 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In param_find_digests_internal and related functions of the Titan-M source, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-222472803References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 15, 2022In the TitanM chip, there is a possible out of bounds write due to a missing bounds check.CVE-2022-20152 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In the TitanM chip, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-202006198References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 16, 2022In the TitanM chip, there is a possible out of bounds write due to a missing bounds check.CVE-2021-39729 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In the TitanM chip, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-202006191References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 22, 2021Certain Starcharge products are affected by Improper Input Validation.CVE-2021-45419 · Other software · Starcharge · reported by MITREHigh 8.8
Certain Starcharge products are affected by Improper Input Validation. The affected products include: Nova 360 Cabinet <= 1.3.0.0.7b102 - Fixed: Beta1.3.0.1.0 and Titan 180 Premium <= 1.3.0.0.6 - Fixed: 1.3.0.0.9.
- Product
- Titan 180 Premium Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2021Certain Starcharge products are vulnerable to Directory Traversal via main.cgi.CVE-2021-45418 · Other software · Starcharge · reported by MITREHigh 8.8
Certain Starcharge products are vulnerable to Directory Traversal via main.cgi. The affected products include: Nova 360 Cabinet <=1.3.0.0.6 - Fixed: 1.3.0.0.9 and Titan 180 Premium <=1.3.0.0.7b102 - Fixed: Beta1.3.0.1.0.
- Product
- Titan 180 Premium Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2021The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in aCVE-2021-24435 · WordPress plugins & themes · reported by WPScanMedium 6.1
The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues
- Affected
- up to 1.12.1
- What to do
- Affects up to 1.12.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 10, 2021In the Titan-M chip firmware, there is a possible disclosure of stack memory due to uninitialized data.CVE-2021-0453 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In the Titan-M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-175117199
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data.CVE-2021-0452 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-175117261
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data.CVE-2021-0451 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-175117871
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data.CVE-2021-0450 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-175117880
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data.CVE-2021-0449 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-175117965
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 22, 2020SpamTitan before 7.09 allows attackers to tamper with backups, because backups are not encrypted.CVE-2020-35658 · Other software · Titanhq · reported by MITREMedium 5.3
SpamTitan before 7.09 allows attackers to tamper with backups, because backups are not encrypted.
- Product
- Spamtitan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.titanhq.comsecator.pl
Sep 17, 2020A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07.CVE-2020-24046 · Other software · Titanhq · reported by MITREHigh 7.2
A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number of tools of the operating system. This restricted shell can be bypassed after changing the properties of the user admin in the operating system file /etc/passwd. This file cannot be accessed though the restricted shell, but it can be modified by abusing the Backup/Import Backup functionality of the web interface. An authenticated attacker would be able to obtain the file /var/tmp/admin.passwd after executing a Backup operation. This file can be manually modified to change the GUID of the user to 0 (root) and change the restricted shell to a normal shell /bin/sh. After the modification is done, the file can be recompressed to a .tar.bz file and imported again via the Import Backup functionality. The properties of the admin user will be overwritten and a root shell will be granted to the user upon the next successful login.
- Product
- Spamtitan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsensepost.com
Sep 17, 2020A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07.CVE-2020-24045 · Other software · Titanhq · reported by MITREHigh 7.2
A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number of tools of the operating system. The restricted shell can be bypassed by presenting a fake vmware-tools ISO image to the guest virtual machine running SpamTitan Gateway. This ISO image should contain a valid Perl script at the vmware-freebsd-tools/vmware-tools-distrib/vmware-install.pl path. The fake ISO image will be mounted and the script wmware-install.pl will be executed with super-user privileges as soon as the hidden option to install VMware Tools is selected in the main menu of the restricted shell (option number 5). The contents of the script can be whatever the attacker wants, including a backdoor or similar.
- Product
- Spamtitan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsensepost.com
Sep 17, 2020An issue was discovered in Titan SpamTitan 7.07.CVE-2020-11804 · Other software · Titanhq · reported by MITREHigh 8.8
An issue was discovered in Titan SpamTitan 7.07. Due to improper sanitization of the parameter quid, used in the page mailqueue.php, code injection can occur. The input for this parameter is provided directly by an authenticated user via an HTTP GET request.
- Product
- Spamtitan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 17, 2020An issue was discovered in Titan SpamTitan 7.07.CVE-2020-11803 · Other software · Titanhq · reported by MITREHigh 8.8
An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval() function. The user has to be authenticated on the web platform before interacting with the page.
- Product
- Spamtitan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 17, 2020An issue was discovered in Titan SpamTitan 7.07.CVE-2020-11700 · Other software · Titanhq · reported by MITREMedium 6.5
An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter fname, used on the page certs-x.php, would allow an attacker to retrieve the contents of arbitrary files. The user has to be authenticated before interacting with this page.
- Product
- Spamtitan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 17, 2020An issue was discovered in Titan SpamTitan 7.07.CVE-2020-11699 · Other software · Titanhq · reported by MITREHigh 8.8
An issue was discovered in Titan SpamTitan 7.07. Improper validation of the parameter fname on the page certs-x.php would allow an attacker to execute remote code on the target server. The user has to be authenticated before interacting with this page.
- Product
- Spamtitan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 17, 2020An issue was discovered in Titan SpamTitan 7.07.CVE-2020-11698 · Other software · Titanhq · reported by MITRECritical 9.8
An issue was discovered in Titan SpamTitan 7.07. Improper input sanitization of the parameter community on the page snmp-x.php would allow a remote attacker to inject commands into the file snmpd.conf that would allow executing commands on the target server.
- Product
- Spamtitan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Apr 23, 2020Nanometrics Centaur through 4.3.23 and TitanSMA through 4.2.20 mishandle access control for the syslog log.CVE-2020-12134 · Other software · Nanometrics · reported by MITRECritical 9.8
Nanometrics Centaur through 4.3.23 and TitanSMA through 4.2.20 mishandle access control for the syslog log.
- Product
- Centaur
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzeroscience.mkzeroscience.mk
Apr 22, 2020An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices.CVE-2020-11539 · Other software · Titan · reported by MITREHigh 8.1
An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security level) The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't have any authentication or signature verification. Thus, any attacker can control a parameter of the device.
- Product
- SF Rush Smart Band Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2020In the Titan M handling of cryptographic operations, there is a possible information disclosure due to an unusual root cause.CVE-2019-9465 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In the Titan M handling of cryptographic operations, there is a possible information disclosure due to an unusual root cause. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10 Android ID: A-133258003
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 2, 2019An issue was discovered in TitanHQ WebTitan before 5.18.CVE-2019-19021 · Other software · Titanhq · reported by MITRECritical 9.8
An issue was discovered in TitanHQ WebTitan before 5.18. It has a hidden support account (with a hard-coded password) in the web administration interface, with administrator privileges. Anybody can log in with this account.
- Product
- Webtitan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwrite-up.github.iowebtitan.com
Dec 2, 2019An issue was discovered in TitanHQ WebTitan before 5.18.CVE-2019-19020 · Other software · Titanhq · reported by MITREHigh 7.2
An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a crafted backup file that enables an attacker to execute arbitrary code by overwriting existing files or adding new PHP files under the web root. This requires the attacker to have access to a valid web interface account.
- Product
- Webtitan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwrite-up.github.iowebtitan.com
Dec 2, 2019An issue was discovered in TitanHQ WebTitan before 5.18.CVE-2019-19019 · Other software · Titanhq · reported by MITREHigh 7.5
An issue was discovered in TitanHQ WebTitan before 5.18. It contains a Remote Code Execution issue through which an attacker can execute arbitrary code as root. The issue stems from the hotfix download mechanism, which downloads a shell script via HTTP, and then executes it as root. This is analogous to CVE-2019-6800 but for a different product.
- Product
- Webtitan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwrite-up.github.iowebtitan.com
Dec 2, 2019An issue was discovered in TitanHQ WebTitan before 5.18.CVE-2019-19018 · Other software · Titanhq · reported by MITRELow 2.7
An issue was discovered in TitanHQ WebTitan before 5.18. It exposes a database configuration file under /include/dbconfig.ini in the web administration interface, revealing what database the web application is using.
- Product
- Webtitan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwrite-up.github.iowebtitan.com
Dec 2, 2019An issue was discovered in TitanHQ WebTitan before 5.18.CVE-2019-19017 · Other software · Titanhq · reported by MITREHigh 8.1
An issue was discovered in TitanHQ WebTitan before 5.18. The appliance has a hard-coded root password set during installation. An attacker could utilize this to gain root privileges on the system.
- Product
- Webtitan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwrite-up.github.iowebtitan.com
Dec 2, 2019An issue was discovered in TitanHQ WebTitan before 5.18.CVE-2019-19016 · Other software · Titanhq · reported by MITREHigh 7.5
An issue was discovered in TitanHQ WebTitan before 5.18. Some functions, such as /history-x.php, of the administration interface are vulnerable to SQL Injection through the results parameter. This could be used by an attacker to extract sensitive information from the appliance database.
- Product
- Webtitan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwrite-up.github.iowebtitan.com
Dec 2, 2019An issue was discovered in TitanHQ WebTitan before 5.18.CVE-2019-19015 · Other software · Titanhq · reported by MITRECritical 9.8
An issue was discovered in TitanHQ WebTitan before 5.18. The proxy service (which is typically exposed to all users) allows connections to the internal PostgreSQL database of the appliance. By connecting to the database through the proxy (without password authentication), an attacker is able to fully control the appliance database. Through this, several different paths exist to gain further access, or execute code.
- Product
- Webtitan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwrite-up.github.iowebtitan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.