Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Nov 12, 2024Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation directory could allow an aCVE-2024-21938 · Other software · AMD · reported by psirt@amd.comHigh 7.3
Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
- Product
- AMD Management Plug-In for SCCM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Incorrect default permissions in the Intel(R) SCS Add-on software installer for Microsoft SCCM all versions may allow an authenticated user to potentially enablCVE-2023-22440 · Other software · Intel · reported by secure@intel.comMedium 6.7
Incorrect default permissions in the Intel(R) SCS Add-on software installer for Microsoft SCCM all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Setup And Configuration Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022The SCCM plugin for GLPI is a plugin to synchronize computers from SCCM (version 1802) to GLPI.CVE-2021-39190 · Other software · pluginsGLPI · reported by GitHubMedium 5.3
The SCCM plugin for GLPI is a plugin to synchronize computers from SCCM (version 1802) to GLPI. In versions prior to 2.3.0, the Configuration page is publicly accessible in read-only mode. This issue is patched in version 2.3.0. No known workarounds exist.
- Product
- sccm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2020Uncontrolled search path in Intel(R) SCS Add-on for Microsoft* SCCM before version 2.1.10 may allow an authenticated user to potentially enable escalation of prCVE-2020-12320 · Other software · Intel · reported by secure@intel.comHigh 7.8
Uncontrolled search path in Intel(R) SCS Add-on for Microsoft* SCCM before version 2.1.10 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- SCS Add-on For Microsoft Sccm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2020Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an information disclosure vulnerabilityCVE-2020-5389 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an information disclosure vulnerability. Authenticated low privileged OMIMSCC users may be able to retrieve sensitive information from the logs.
- Product
- OMIMSSC (OpenManage Integration for Microsoft System Center)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2020Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain a hard-coded cryptographic key vulnerabCVE-2020-5374 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain a hard-coded cryptographic key vulnerability. A remote unauthenticated attacker may exploit this vulnerability to gain access to the appliance data for remotely managed devices.
- Product
- OMIMSSC (OpenManage Integration for Microsoft System Center)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2020Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an improper authentication vulnerabilitCVE-2020-5373 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to retrieve the system inventory data of the managed device.
- Product
- OMIMSSC (OpenManage Integration for Microsoft System Center)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2020Ivanti Workspace Control before 10.4.30.0, when SCCM integration is enabled, allows local users to obtain sensitive information (keying material).CVE-2020-11533 · Network & remote access · Ivanti · reported by MITREMedium 5.5
Ivanti Workspace Control before 10.4.30.0, when SCCM integration is enabled, allows local users to obtain sensitive information (keying material).
- Product
- Workspace Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
Mar 23, 2020Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command toCVE-2019-19034 · Email & office · Zohocorp · reported by MITREHigh 7.2
Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command to schedule scans for SCCM. This allows an attacker to execute arbitrary commands on the AssetExplorer Server with NT AUTHORITY/SYSTEM privileges.
- Product
- Manageengine Assetexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.