Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
850 results · page 1 of 17
Apr 29, 2026A vulnerability was found in PolarVista xcode-mcp-server 1.0.0.CVE-2026-7416 · Other software · PolarVista · reported by VulDBMedium 5.5
A vulnerability was found in PolarVista xcode-mcp-server 1.0.0. This issue affects the function build_project/run_tests of the file src/index.ts of the component MCP Interface. The manipulation of the argument Request results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- xcode-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Vulnerability in GE Vernova Enervista UR Setup on Windows.This issue affects Enervista: 8.6 and previous versions.CVE-2026-1763 · Other software · GE Vernova · reported by GEPowerCVD@ge.comMedium 4.6
Vulnerability in GE Vernova Enervista UR Setup on Windows.This issue affects Enervista: 8.6 and previous versions.
- Product
- Enervista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026A vulnerability in GE Vernova Enervista UR Setup on Windows allows File Manipulation.This issue affects Enervista: 8.6 and prior versions.CVE-2026-1762 · Other software · GE Vernova · reported by GEPowerCVD@ge.comLow 2.9
A vulnerability in GE Vernova Enervista UR Setup on Windows allows File Manipulation.This issue affects Enervista: 8.6 and prior versions.
- Product
- Enervista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025Flatnux 2021-03.25 contains an authenticated file upload vulnerability that allows administrative users to upload arbitrary PHP files through the file manager.CVE-2023-53956 · Other software · altervista · reported by VulnCheckHigh 8.7
Flatnux 2021-03.25 contains an authenticated file upload vulnerability that allows administrative users to upload arbitrary PHP files through the file manager. Attackers with admin credentials can upload malicious PHP scripts to the web root directory, enabling remote code execution on the server.
- Product
- flatnux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordflatnux.altervista.orgexploit-db.com
Oct 6, 2025PyVista provides 3D plotting and mesh analysis through an interface for the Visualization Toolkit (VTK).CVE-2025-61774 · Other software · pyvista · reported by GitHubCritical 9.3
PyVista provides 3D plotting and mesh analysis through an interface for the Visualization Toolkit (VTK). Version 0.46.3 of the PyVista Project is vulnerable to remote code execution via dependency confusion. Two pieces of code use`--extra-index-url`. But when `--extra-index-url` is used, pip always checks for the PyPI index first, and then the external index. One package listed in the code is not published in PyPI. If an attacker publishes a package with higher version in PyPI, the malicious code from the attacker controlled package may be pulled, leading to remote code execution and a supply chain attack. As of time of publication, a patched version is unavailable.
- Product
- pyvista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2025Improper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and earlier.CVE-2025-48006 · Other software · Saison Technology Co.,Ltd. · reported by vultures@jpcert.or.jpHigh 8.8
Improper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and earlier. If a specially crafted request is processed, arbitrary files on the file system where the server application for the product is installed may be read, or a denial-of-service (DoS) condition may occur.
- Product
- DataSpider Servista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025Cross Site Request Forgery (CSRF) vulnerability in Smartvista BackOffice SmartVista Suite 2.2.22 via crafted GET request.CVE-2025-50255 · Other software · reported by MITREHigh 7.8
Cross Site Request Forgery (CSRF) vulnerability in Smartvista BackOffice SmartVista Suite 2.2.22 via crafted GET request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to a missing SSH serverCVE-2025-27256 · Other software · GE Vernova · reported by prodsec@nozominetworks.comHigh 8.3
Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to a missing SSH server authentication. Since the client connection is not authenticated, an attacker may perform a man-in-the-middle attack on the network.
- Product
- EnerVista UR Setup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgevernova.comnozominetworks.com
Mar 10, 2025Use of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege Escalation.CVE-2025-27255 · Other software · GE Vernova · reported by prodsec@nozominetworks.comHigh 8
Use of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege Escalation. The local user database is encrypted using an hardcoded password retrievable by an attacker analyzing the application code.
- Product
- EnerVista UR Setup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgevernova.comnozominetworks.com
Mar 10, 2025CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass.CVE-2025-27254 · Other software · GE Vernova · reported by prodsec@nozominetworks.comHigh 8
CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify.
- Product
- EnerVista UR Setup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgevernova.comnozominetworks.com
Feb 7, 2025Incorrect Access Control in the Preview Function of Gleamtech FileVista 9.2.0.0 allows remote attackers to gain unauthorized access via exploiting a vulnerabiliCVE-2024-57249 · Other software · Gleamtech · reported by MITREMedium 6.5
Incorrect Access Control in the Preview Function of Gleamtech FileVista 9.2.0.0 allows remote attackers to gain unauthorized access via exploiting a vulnerability in access control mechanisms by removing authentication-related HTTP headers, such as the Cookie header, in the request. This bypasses the authentication process and grants attackers access to sensitive image files without proper login credentials.
- Product
- Filevista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newsgleamtech.com
Feb 7, 2025Directory Traversal in File Upload in Gleamtech FileVista 9.2.0.0 allows remote attackers to achieve Code Execution, Information Disclosure, and Escalation of PCVE-2024-57248 · Other software · Gleamtech · reported by MITREMedium 6.3
Directory Traversal in File Upload in Gleamtech FileVista 9.2.0.0 allows remote attackers to achieve Code Execution, Information Disclosure, and Escalation of Privileges via injecting malicious payloads in HTTP requests to manipulate file paths, bypass access controls, and upload malicious files.
- Product
- Filevista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newsgleamtech.com
Mar 13, 2024Cross-Site Request Forgery vulnerability in Movistar's 4G router affecting version ES_WLD71-T1_v2.0.201820.CVE-2024-2416 · Other software · Movistar · reported by cve-coordination@incibe.esMedium 6.5
Cross-Site Request Forgery vulnerability in Movistar's 4G router affecting version ES_WLD71-T1_v2.0.201820. This vulnerability allows an attacker to force an end user to execute unwanted actions in a web application in which they are currently authenticated.
- Product
- Router Movistar 4G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024Command injection vulnerability in Movistar 4G router affecting version ES_WLD71-T1_v2.0.201820.CVE-2024-2415 · Other software · Movistar · reported by cve-coordination@incibe.esHigh 7.8
Command injection vulnerability in Movistar 4G router affecting version ES_WLD71-T1_v2.0.201820. This vulnerability allows an authenticated user to execute commands inside the router by making a POST request to the URL '/cgi-bin/gui.cgi'.
- Product
- Router Movistar 4G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024The primary channel is unprotected on Movistar 4G router affecting E version S_WLD71-T1_v2.0.201820.CVE-2024-2414 · Other software · Movistar · reported by cve-coordination@incibe.esHigh 8.8
The primary channel is unprotected on Movistar 4G router affecting E version S_WLD71-T1_v2.0.201820. This device has the 'adb' service open on port 5555 and provides access to a shell with root privileges.
- Product
- Router Movistar 4G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2024The disabling function of the user registration page for Heimavista Rpage and Epage is not properly implemented, allowing remote attackers to complete user regiCVE-2024-2412 · Other software · Heimavista · reported by twcert@cert.org.twMedium 5.3
The disabling function of the user registration page for Heimavista Rpage and Epage is not properly implemented, allowing remote attackers to complete user registration on sites where user registration is supposed to be disabled.
- Product
- Rpage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 31, 2023DataSpider Servista version 4.4 and earlier uses a hard-coded cryptographic key.CVE-2023-28937 · Other software · SAISON INFORMATION SYSTEMS CO.,LTD. · reported by vultures@jpcert.or.jpHigh 8.8
DataSpider Servista version 4.4 and earlier uses a hard-coded cryptographic key. DataSpider Servista is data integration software. ScriptRunner and ScriptRunner for Amazon SQS are used to start the configured processes on DataSpider Servista. The cryptographic key is embedded in ScriptRunner and ScriptRunner for Amazon SQS, which is common to all users. If an attacker who can gain access to a target DataSpider Servista instance and obtain a Launch Settings file of ScriptRunner and/or ScriptRunner for Amazon SQS, the attacker may perform operations with the user privilege encrypted in the file. Note that DataSpider Servista and some of the OEM products are affected by this vulnerability. For the details of affected products and versions, refer to the information listed in [References].
- Product
- DataSpider Servista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcs.wingarc.comcs.wingarc.com
Jan 10, 2023An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03.CVE-2022-38492 · Other software · Easyvista · reported by MITREHigh 7.7
An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. One parameter allows SQL injection. Version 2022.1.110.1.02 fixes the vulnerability.
- Product
- Service Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexcellium-services.comexcellium-services.com
Jan 10, 2023An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03.CVE-2022-38491 · Other software · Easyvista · reported by MITREHigh 8.2
An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application does not implement protection against brute-force attacks. Version 2022.1.133.0 corrects this issue.
- Product
- Service Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexcellium-services.comexcellium-services.com
Jan 10, 2023An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03.CVE-2022-38490 · Other software · Easyvista · reported by MITRECritical 9.6
An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Some parameters allow SQL injection. Version 2022.1.110.1.02 corrects this issue.
- Product
- Service Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexcellium-services.comexcellium-services.com
Jan 10, 2023An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03 It is prone to stored Cross-site Scripting (XSS).CVE-2022-38489 · Other software · Easyvista · reported by MITREMedium 4.8
An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03 It is prone to stored Cross-site Scripting (XSS). Version 2022.1.110.1.02 fixes the vulnerably.
- Product
- Service Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexcellium-services.comexcellium-services.com
Oct 20, 2022Cross Site Scripting (XSS) vulnerability in New equipment page in EasyVista Service Manager 2018.1.181.1 allows remote attackers to run arbitrary code via the nCVE-2021-33231 · Other software · Easyvista · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in New equipment page in EasyVista Service Manager 2018.1.181.1 allows remote attackers to run arbitrary code via the notes field.
- Product
- Service Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarmysick.github.ioarmysick.github.io
Sep 28, 2022Heimavista Rpage has insufficient filtering for platform web URL.CVE-2022-39053 · Other software · HEIMAVISTA INC. · reported by twcert@cert.org.twMedium 6.1
Heimavista Rpage has insufficient filtering for platform web URL. An unauthenticated remote attacker can inject JavaScript and perform XSS (Reflected Cross-Site Scripting) attack.
- Product
- Rpage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 20, 2022SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups/mcc_group.jsf.CVE-2022-38619 · Other software · Bpcbt · reported by MITRECritical 9.8
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups/mcc_group.jsf.
- Product
- Smartvista Front-end
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddtro.gitbook.iodtro.gitbook.io
Sep 19, 2022SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVCVE-2022-38618 · Other software · Bpcbt · reported by MITREHigh 8.8
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/country_group.jsf.
- Product
- Smartvista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddtro.gitbook.iodtro.gitbook.io
Sep 19, 2022SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the voiceAudit:j_id97 parameter at /SVFE2/pages/audit/voiceaudit.jsf.CVE-2022-38617 · Other software · Bpcbt · reported by MITREHigh 8.8
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the voiceAudit:j_id97 parameter at /SVFE2/pages/audit/voiceaudit.jsf.
- Product
- Smartvista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddtro.gitbook.iodtro.gitbook.io
Sep 15, 2022The ‘document’ parameter of PDS Vista 7’s /application/documents/display.aspx page is vulnerable to a Local File Inclusion vulnerability which allows an low-priCVE-2022-34002 · Other software · Pdssoftware · reported by MITREMedium 6.5
The ‘document’ parameter of PDS Vista 7’s /application/documents/display.aspx page is vulnerable to a Local File Inclusion vulnerability which allows an low-privileged authenticated attacker to leak the configuration files and source code of the web application.
- Product
- PDS Vista 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassura.atlassian.netassurainc.com
Sep 13, 2022SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /feegroups/tgrt_group.jsf.CVE-2022-38616 · Other software · Bpcbt · reported by MITREHigh 8.8
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /feegroups/tgrt_group.jsf.
- Product
- Smartvista Front-end
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtf1t.gitbook.iotf1t.gitbook.io
Sep 9, 2022SmartVista SVFE2 v2.2.22 was discovered to contain multiple SQL injection vulnerabilities via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameteCVE-2022-38615 · Other software · Bpcbt · reported by MITREHigh 8.8
SmartVista SVFE2 v2.2.22 was discovered to contain multiple SQL injection vulnerabilities via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/service_group.jsf.
- Product
- Smartvista Front-end
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtf1t.gitbook.iotf1t.gitbook.io
Sep 9, 2022An issue in the IGB Files and OutfileService features of SmartVista Cardgen v3.28.0 allows attackers to list and download arbitrary files via modifying the PATHCVE-2022-38614 · Other software · Bpcbt · reported by MITREHigh 7.5
An issue in the IGB Files and OutfileService features of SmartVista Cardgen v3.28.0 allows attackers to list and download arbitrary files via modifying the PATH parameter.
- Product
- Smartvista Cardgen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtf1t.gitbook.iotf1t.gitbook.io
Sep 9, 2022A Path Traversal vulnerability in SmartVista Cardgen v3.28.0 allows authenticated attackers to read arbitrary files in the system.CVE-2022-38613 · Other software · Bpcbt · reported by MITREMedium 6.5
A Path Traversal vulnerability in SmartVista Cardgen v3.28.0 allows authenticated attackers to read arbitrary files in the system.
- Product
- Smartvista Cardgen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtf1t.gitbook.iotf1t.gitbook.io
Aug 19, 2022Multiple reflected XSS vulnerabilities occur when handling error message of BPC SmartVista version 3.28.0 allowing an attacker to execute javascript code at cliCVE-2022-35554 · Other software · Bpcbt · reported by MITREMedium 6.1
Multiple reflected XSS vulnerabilities occur when handling error message of BPC SmartVista version 3.28.0 allowing an attacker to execute javascript code at client side.
- Product
- Smartvista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtf1t.gitbook.iotf1t.gitbook.io
Mar 23, 2022GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup.CVE-2021-27428 · Other software · GE · reported by ics-cert@hq.dhs.govCritical 9.8
GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without appropriate privileges. The weakness is assessed, and mitigation is implemented in firmware Version 8.10.
- Product
- UR family
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govgegridsolutions.com
Mar 16, 2022Cross-site Scripting (XSS) vulnerability in ArchivistaBox webclient allows an attacker to craft a malicious link, executing JavaScript in the context of a victiCVE-2021-42552 · Other software · Archivista GmbH · reported by vulnerability@ncsc.chMedium 6.1
Cross-site Scripting (XSS) vulnerability in ArchivistaBox webclient allows an attacker to craft a malicious link, executing JavaScript in the context of a victim's browser. This issue affects all ArchivistaBox versions prior to 2022/I.
- Product
- ArchivistaBox webclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2019An issue was discovered on Alcatel-Lucent OmniVista 4760 devices.CVE-2019-20049 · Other software · Al-enterprise · reported by MITRECritical 9.8
An issue was discovered on Alcatel-Lucent OmniVista 4760 devices. A remote unauthenticated attacker can chain a directory traversal (which helps to bypass authentication) with an insecure file upload to achieve Remote Code Execution as SYSTEM. The directory traversal is in the __construct() whereas the insecure file upload is in SetSkinImages().
- Product
- Omnivista 4760
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.lsd.catpacketstormsecurity.com
Dec 27, 2019An issue was discovered on Alcatel-Lucent OmniVista 8770 devices before 4.1.2.CVE-2019-20048 · Other software · Al-enterprise · reported by MITREHigh 7.2
An issue was discovered on Alcatel-Lucent OmniVista 8770 devices before 4.1.2. An authenticated remote attacker, with elevated privileges in the Web Directory component on port 389, may upload a PHP file to achieve Remote Code Execution as SYSTEM.
- Product
- Omnivista 8770
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.lsd.catpacketstormsecurity.com
Dec 27, 2019An issue was discovered on Alcatel-Lucent OmniVista 4760 devices, and 8770 devices before 4.1.2.CVE-2019-20047 · Other software · Al-enterprise · reported by MITREHigh 7.5
An issue was discovered on Alcatel-Lucent OmniVista 4760 devices, and 8770 devices before 4.1.2. An incorrect web server configuration allows a remote unauthenticated attacker to retrieve the content of its own session files. Every session file contains the administrative LDAP credentials encoded in a reversible format. Sessions are stored in /sessions/sess_<sessionid>.
- Product
- Omnivista 4760
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.lsd.catpacketstormsecurity.com
Apr 30, 2019BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter.CVE-2018-15208 · Other software · Bpcbt · reported by MITREHigh 7.5
BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter.
- Product
- Smartvista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordneetech18.blogspot.comneetech18.blogspot.com
Apr 30, 2019BPC SmartVista 2 has Improper Access Control in the SVFE module, where it fails to appropriately restrict access: a normal user is able to access the SVFE2/pageCVE-2018-15207 · Other software · Bpcbt · reported by MITREHigh 7.2
BPC SmartVista 2 has Improper Access Control in the SVFE module, where it fails to appropriately restrict access: a normal user is able to access the SVFE2/pages/finadmin/currconvrate/currconvrate.jsf functionality that should be only accessible to an admin.
- Product
- Smartvista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordneetech18.blogspot.comneetech18.blogspot.com
Apr 30, 2019BPC SmartVista 2 has CSRF via SVFE2/pages/admpages/roles/createrole.jsf.CVE-2018-15206 · Other software · Bpcbt · reported by MITREHigh 8.8
BPC SmartVista 2 has CSRF via SVFE2/pages/admpages/roles/createrole.jsf.
- Product
- Smartvista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordneetech18.blogspot.comneetech18.blogspot.com
Dec 17, 2018Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).CVE-2018-19822 · Other software · Infovista · reported by MITREMedium 6.1
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/SharedCriteria.jsp" has reflected XSS via the ConnPoolName or GroupId parameter.
- Product
- Vistaportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 17, 2018Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).CVE-2018-19821 · Other software · Infovista · reported by MITREMedium 6.1
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/SecurityPolicies.jsp" has reflected XSS via the ConnPoolName parameter.
- Product
- Vistaportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 17, 2018Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).CVE-2018-19820 · Other software · Infovista · reported by MITREMedium 6.1
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Roles.jsp" has reflected XSS via the ConnPoolName parameter.
- Product
- Vistaportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 17, 2018Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).CVE-2018-19819 · Other software · Infovista · reported by MITREMedium 6.1
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Rights.jsp" has reflected XSS via the ConnPoolName parameter.
- Product
- Vistaportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 17, 2018Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).CVE-2018-19818 · Other software · Infovista · reported by MITREMedium 6.1
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Contacts.jsp" has reflected XSS via the ConnPoolName parameter.
- Product
- Vistaportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 17, 2018Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).CVE-2018-19817 · Other software · Infovista · reported by MITREMedium 6.1
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/AdminAuthorisationFrame.jsp" has reflected XSS via the ConnPoolName or GroupId parameter.
- Product
- Vistaportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 17, 2018Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).CVE-2018-19816 · Other software · Infovista · reported by MITREMedium 6.1
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/categorytree/ChooseCategory.jsp" has reflected XSS via the ConnPoolName parameter.
- Product
- Vistaportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 17, 2018Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).CVE-2018-19815 · Other software · Infovista · reported by MITREMedium 6.1
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/UserPopupAddNewProp.jsp" has reflected XSS via the ConnPoolName parameter.
- Product
- Vistaportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 17, 2018Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).CVE-2018-19814 · Other software · Infovista · reported by MITREMedium 6.1
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Subscriptions.jsp" has reflected XSS via the ConnPoolName or GroupId parameter.
- Product
- Vistaportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 17, 2018Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029).CVE-2018-19813 · Other software · Infovista · reported by MITREMedium 6.1
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Subscribers.jsp" has reflected XSS via the ConnPoolName or GroupId parameter.
- Product
- Vistaportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.