Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
May 14, 2024Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/BackupSchedule, description field.CVE-2024-3796 · Other software · WBSAirback · reported by cve-coordination@incibe.esMedium 4.8
Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/BackupSchedule, description field. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.
- Product
- White Bear Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/BackupTemplate, name / description fields.CVE-2024-3795 · Other software · WBSAirback · reported by cve-coordination@incibe.esMedium 4.8
Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/BackupTemplate, name / description fields. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.
- Product
- White Bear Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/AdvancedSystem, description field, all parameters.CVE-2024-3794 · Other software · WBSAirback · reported by cve-coordination@incibe.esMedium 4.8
Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/AdvancedSystem, description field, all parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.
- Product
- White Bear Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/CloudAccounts, account name / user password / server CVE-2024-3793 · Other software · WBSAirback · reported by cve-coordination@incibe.esMedium 4.8
Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/CloudAccounts, account name / user password / server fields, all parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.
- Product
- White Bear Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/DeviceReplication, execution range field, all parametCVE-2024-3792 · Other software · WBSAirback · reported by cve-coordination@incibe.esMedium 4.8
Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/DeviceReplication, execution range field, all parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.
- Product
- White Bear Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/SystemConfiguration, name / free memory limit fields CVE-2024-3791 · Other software · WBSAirback · reported by cve-coordination@incibe.esMedium 4.8
Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/SystemConfiguration, name / free memory limit fields , type / password parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.
- Product
- White Bear Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/SystemUsers, login / description fields, passwd1/ pasCVE-2024-3790 · Other software · WBSAirback · reported by cve-coordination@incibe.esMedium 4.8
Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/SystemUsers, login / description fields, passwd1/ passwd2 parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.
- Product
- White Bear Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Uncontrolled resource consumption vulnerability in White Bear Solutions WBSAirback, version 21.02.04.CVE-2024-3789 · Other software · WBSAirback · reported by cve-coordination@incibe.esMedium 6.5
Uncontrolled resource consumption vulnerability in White Bear Solutions WBSAirback, version 21.02.04. This vulnerability could allow an attacker to send multiple command injection payloads to influence the amount of resources consumed.
- Product
- White Bear Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through License (/admin/CDPUsers).CVE-2024-3788 · Other software · WBSAirback · reported by cve-coordination@incibe.esMedium 6.6
Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through License (/admin/CDPUsers). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.
- Product
- White Bear Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through S3 disks (/admin/DeviceS3).CVE-2024-3787 · Other software · WBSAirback · reported by cve-coordination@incibe.esMedium 6.6
Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through S3 disks (/admin/DeviceS3). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.
- Product
- White Bear Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through Device Synchronizations (/admin/DeviceReplicCVE-2024-3786 · Other software · WBSAirback · reported by cve-coordination@incibe.esMedium 6.6
Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through Device Synchronizations (/admin/DeviceReplication). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.
- Product
- White Bear Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through Device NAS shared section (/admin/DeviceNAS)CVE-2024-3785 · Other software · WBSAirback · reported by cve-coordination@incibe.esMedium 6.6
Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through Device NAS shared section (/admin/DeviceNAS). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.
- Product
- White Bear Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through S3 Accounts (/admin/CloudAccounts).CVE-2024-3784 · Other software · WBSAirback · reported by cve-coordination@incibe.esMedium 6.6
Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through S3 Accounts (/admin/CloudAccounts). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.
- Product
- White Bear Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024The Backup Agents section in WBSAirback 21.02.04 is affected by a Path Traversal vulnerability, allowing a user with low privileges to download files from the sCVE-2024-3783 · Other software · WBSAirback · reported by cve-coordination@incibe.esHigh 7.7
The Backup Agents section in WBSAirback 21.02.04 is affected by a Path Traversal vulnerability, allowing a user with low privileges to download files from the system.
- Product
- White Bear Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024Cross-Site Request Forgery vulnerability in WBSAirback 21.02.04, which could allow an attacker to create a manipulated HTML form to perform privileged actions oCVE-2024-3782 · Other software · WBSAirback · reported by cve-coordination@incibe.esHigh 8.8
Cross-Site Request Forgery vulnerability in WBSAirback 21.02.04, which could allow an attacker to create a manipulated HTML form to perform privileged actions once it is executed by a privileged user.
- Product
- White Bear Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024Command injection vulnerability in the operating system.CVE-2024-3781 · Other software · WBSAirback · reported by cve-coordination@incibe.esCritical 9.1
Command injection vulnerability in the operating system. Improper neutralisation of special elements in Active Directory integration allows the intended command to be modified when sent to a downstream component in WBSAirback 21.02.04.
- Product
- White Bear Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.