Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Feb 5, 2024Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which maCVE-2023-6232 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.8
Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.
- Product
- Satera LBP670C Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2024Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which maCVE-2023-6230 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.8
Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.
- Product
- Satera LBP670C Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Buffer overflow in the Address Book of Mobile Device function of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker CVE-2023-0852 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.8
Buffer overflow in the Address Book of Mobile Device function of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
- Product
- Canon Office/Small Office Multifunction Printers and Laser Printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2019The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.CVE-2017-18523 · WordPress plugins & themes · reported by MITREHigh 8.8
The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.
- Product
- eelv-newsletter
- Fixed in
- 4.6.1
- What to do
- Update eelv-newsletter to 4.6.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 20, 2019The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.CVE-2017-18522 · WordPress plugins & themes · reported by MITREMedium 6.1
The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.
- Product
- eelv-newsletter
- Fixed in
- 4.6.1
- What to do
- Update eelv-newsletter to 4.6.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Oct 9, 2015The Address Book framework in Apple OS X before 10.11 allows local users to gain privileges by using an environment variable to inject code into processes that CVE-2015-5897 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.6
The Address Book framework in Apple OS X before 10.11 allows local users to gain privileges by using an environment variable to inject code into processes that rely on this framework.
- Product
- MAC OS X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comsecuritytracker.com
Dec 31, 2006export.php in The Address Book 1.04e writes username and password hash information into a publicly accessible file when dumping the MySQL database contents, whiCVE-2006-4578 · Other software · The Address Book · reported by PSIRT-CNA@flexerasoftware.comHigh 7.5
export.php in The Address Book 1.04e writes username and password hash information into a publicly accessible file when dumping the MySQL database contents, which allows remote attackers to obtain sensitive information.
- Product
- The Address Book
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2006Directory traversal vulnerability in users.php in The Address Book 1.04e allows remote attackers to include arbitrary files via a ..CVE-2006-4579 · Other software · The Address Book · reported by PSIRT-CNA@flexerasoftware.comMedium 5
Directory traversal vulnerability in users.php in The Address Book 1.04e allows remote attackers to include arbitrary files via a .. (dot dot) in the language parameter.
- Product
- The Address Book
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2006register.php in The Address Book 1.04e allows remote attackers to bypass the "Allow User Self-Registration" setting and create arbitrary users by setting the moCVE-2006-4580 · Other software · The Address Book · reported by PSIRT-CNA@flexerasoftware.comHigh 7.5
register.php in The Address Book 1.04e allows remote attackers to bypass the "Allow User Self-Registration" setting and create arbitrary users by setting the mode parameter to "confirm".
- Product
- The Address Book
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2006Unrestricted file upload vulnerability in The Address Book 1.04e validates the Content-Type header but not the file extension, which allows remote attackers to CVE-2006-4581 · Other software · The Address Book · reported by PSIRT-CNA@flexerasoftware.comMedium 5
Unrestricted file upload vulnerability in The Address Book 1.04e validates the Content-Type header but not the file extension, which allows remote attackers to upload arbitrary PHP scripts.
- Product
- The Address Book
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2006Cross-site request forgery (CSRF) vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecifiedCVE-2006-4582 · Other software · The Address Book · reported by PSIRT-CNA@flexerasoftware.comMedium 5
Cross-site request forgery (CSRF) vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecified vectors, as demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php.
- Product
- The Address Book
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2006Cross-site scripting (XSS) vulnerability in The Address Book 1.04e allows remote attackers to inject arbitrary web script or HTML by uploading the HTML file witCVE-2006-4576 · Other software · The Address Book · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site scripting (XSS) vulnerability in The Address Book 1.04e allows remote attackers to inject arbitrary web script or HTML by uploading the HTML file with a GIF or JPG extension, which is rendered by Internet Explorer.
- Product
- The Address Book
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2006Multiple SQL injection vulnerabilities in The Address Book 1.04e allow remote attackers to execute arbitrary SQL commands via the (1) lastname, (2) firstname, (CVE-2006-4575 · Other software · The Address Book · reported by PSIRT-CNA@flexerasoftware.comHigh 7.5
Multiple SQL injection vulnerabilities in The Address Book 1.04e allow remote attackers to execute arbitrary SQL commands via the (1) lastname, (2) firstname, (3) passwordOld, (4) passwordNew, (5) id, (6) language, (7) defaultLetter, (8) newuserPass, (9) newuserType, (10) newuserEmail parameters in (a) user.php; the (11) goTo and (12) search parameters in (b) search.php; and the (13) groupAddName parameter in (c) save.php.
- Product
- The Address Book
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2006Multiple cross-site scripting (XSS) vulnerabilities in The Address Book 1.04e allow remote attackers to inject arbitrary web script or HTML via Javascript eventCVE-2006-4577 · Other software · The Address Book · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Multiple cross-site scripting (XSS) vulnerabilities in The Address Book 1.04e allow remote attackers to inject arbitrary web script or HTML via Javascript events in the (1) email, (2) websites, and (3) groupAddName parameters in (a) save.php; the (4) errorMsg parameter in (b) index.php; and the (5) goTo and (6) search parameters in (c) search.php.
- Product
- The Address Book
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2006Multiple SQL injection vulnerabilities in the authentication process in katzlbt (a) The Address Book 1.04e and earlier and (b) The Address Book Reloaded before CVE-2006-4056 · Other software · The Address Book · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in the authentication process in katzlbt (a) The Address Book 1.04e and earlier and (b) The Address Book Reloaded before 2.0-rc4 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters. NOTE: portions of these details are obtained from third party information.
- Product
- The Address Book
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.